Privacy Policy

The administrator of personal data is NETSENDO PSA (simple joint-stock company), entered into the Register of Entrepreneurs of the National Court Register kept by the District Court Katowice-Wschód in Katowice, 8th Commercial Division of the National Court Register.

The Administrator has not appointed a Data Protection Officer (DPO). In matters regarding the protection of personal data, please contact us at the e-mail address: contact@netsendo.com.

"Personal Data"

any information relating to an identified or identifiable natural person (Art. 4 point 1 GDPR).

"Processing"

any operation or set of operations which is performed on personal data, such as collection, recording, storage, modification, retrieval, consultation, use, disclosure, erasure or destruction (Art. 4 point 2 GDPR).

"Controller"

NETSENDO PSA — the entity that independently or jointly with others determines the purposes and means of the processing of personal data (Art. 4 point 7 GDPR).

"Service"

the website available at netsendo.com and all related subpages.

"Application" or "Software"

the NetSendo software — an email and SMS marketing automation platform, made available under the EULA, which the customer either installs on its own infrastructure (self-hosted) or orders as the NetSendo Cloud service.

"NetSendo Cloud"

the service in which we install NetSendo for the customer, run it on our infrastructure and keep it updated.

"Order"

a purchase of a NetSendo GOLD, NetSendo Cloud SILVER or NetSendo Cloud GOLD subscription on the Website.

"Link"

Sold through Link, LLC, a Stripe group company that accepts subscription payments as merchant of record.

"User"

any natural person using the Service or Application.

"Cookies"

small text files saved on the User's end device by the web browser when using the Service.

"GDPR"

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 — General Data Protection Regulation.

"ECL"

Act of July 12, 2024 — Electronic Communications Law, regulating, among others, the rules for the use of cookies.

Users' personal data is processed based on the following purposes and legal bases:

In the case where the basis for processing is the legitimate interest of the Administrator (Art. 6 sec. 1 lit. f GDPR), this interest is in particular: conducting ongoing correspondence, ensuring the security of IT systems, conducting statistical analyses and marketing own products and services. When limiting order attempts, our interest is protecting the order form against automated attempts and payment fraud.

Users' personal data may be transferred to the following categories of recipients, solely to the extent necessary to achieve the indicated processing purposes:

• IT infrastructure providers — companies that process data on our behalf: Vercel Inc. (USA; website hosting, including the order form and payment notifications, and server logs), Supabase Inc. (order and licence database in the EU region, Frankfurt), ADERLO PSA (Aderlo Cloud; the mail server from which we send transactional emails and messages about new NetSendo versions from noreply@netsendo.com, and the NetSendo Cloud servers), and the Google Cloud infrastructure provider (Frankfurt region, Germany), where our licence server runs;
• Link and Stripe — payment is accepted by Link (Sold through Link, LLC) as merchant of record and processed by Stripe group companies. We pass Link the email address and Order data needed for the payment. Link and Stripe process data for payment, tax, fraud prevention, dispute handling, transaction support and Link accounts as separate controllers, under their privacy policies (link.com/privacy, stripe.com/privacy). To the extent Stripe stores transaction data in our Stripe account for our purposes, it does so under our agreement with Stripe;
• Analytics tool providers — entities providing tools for analyzing website traffic (if used);
• Accounting office and legal advisors — entities providing accounting, tax and legal services to the Administrator;
• Public authorities — in cases provided for by applicable law (e.g., tax offices, courts, law enforcement agencies);
• NetSendo Cloud subcontractor — ADERLO PSA and, through it, Hetzner Online GmbH (data centre in Falkenstein, Germany) as sub-processors of data in NetSendo Cloud instances;
• Providers chosen by the NetSendo Cloud customer — email providers, SMS gateways and AI providers that a NetSendo Cloud customer connects to its instance. The customer chooses and contracts with them itself; the instance sends them data on its instruction.

Companies processing data on our behalf do so under data processing agreements (Article 28 GDPR). Link and Stripe are not our processors to the extent they act as separate controllers.

Personal data may be transferred to the United States in the following cases:

• Vercel Inc. hosts the Website. Website functions, including the order form and payment notifications, run in a Vercel region in the US (Washington, D.C.). Order form data (email address, plan, instance name) and the IP address from which we compute the hash are therefore processed in the US; the same applies to server logs, including visitors' IP addresses;
• Link (Sold through Link, LLC) is based in the US; we pass it the data needed for payment when redirecting to the payment page;
• Supabase Inc. stores the order and licence database in the EU region (Frankfurt); as a US company it may access it remotely to maintain the service;
• the licence server runs on Google Cloud infrastructure in Frankfurt, Germany; the provider belongs to a US-based group and may access the data remotely to maintain the service.

Data in NetSendo Cloud instances is not transferred outside the EEA.

In such a case, the transfer of data takes place on the basis of:

• a decision of the European Commission finding an adequate level of data protection in a third country (Art. 45 GDPR);
• standard contractual clauses (SCC) adopted by the European Commission (Art. 46 sec. 2 lit. c GDPR);
• binding corporate rules (BCR) approved by the competent supervisory authority (Art. 47 GDPR);
• other mechanisms provided for in Chapter V of the GDPR.

Transfers to the US are based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-US Data Privacy Framework for certified recipients, and otherwise on standard contractual clauses adopted by the European Commission.

The User has the right to obtain a copy of the safeguards used by contacting the Administrator at: contact@netsendo.com.

Personal data is stored for the period necessary to achieve the purposes for which it was collected, taking into account applicable laws:

After the indicated periods expire, personal data is deleted or effectively anonymized.

In accordance with the GDPR, every User whose personal data is processed by the Administrator has the following rights:

• Right of access to data (Art. 15 GDPR) — the right to obtain confirmation as to whether personal data is being processed, and to obtain a copy of the data.
• Right to rectification of data (Art. 16 GDPR) — the right to request correction of incorrect or completion of incomplete data.
• Right to erasure of data (Art. 17 GDPR) — "right to be forgotten" — the right to request deletion of personal data when there is no legal basis for its further processing.
• Right to restriction of processing (Art. 18 GDPR) — the right to request restriction of data processing in specific cases.
• Right to data portability (Art. 20 GDPR) — the right to receive data in a structured, commonly used machine-readable format and to transmit it to another controller.
• Right to object (Art. 21 GDPR) — the right to object to the processing of data based on the legitimate interest of the Administrator, including profiling. In the case of objection to data processing for direct marketing purposes — data will no longer be processed for this purpose.
• Right to withdraw consent (Art. 7 sec. 3 GDPR) — in cases where processing takes place on the basis of consent, the User has the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint with a supervisory authority(Art. 77 GDPR) — the User has the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO):
  Personal Data Protection Office
  ul. Stawki 2, 00-193 Warsaw
  Website: https://uodo.gov.pl

To exercise the above rights, please contact us at the e-mail address: contact@netsendo.com. A response to the request will be given without undue delay, no later than within one month of receiving the request. In the case of complex requests, this period may be extended by another two months, of which the User will be informed. If your data is in a NetSendo Cloud instance run by one of our customers, that customer is the controller. Please send your requests to it; if they reach us, we will forward them without undue delay. Requests about data processed by Link (payment, Link account) can be sent directly to Link through support.link.com.

The Administrator does not make decisions towards Users based solely on automated data processing, including profiling, which would produce legal effects towards them or similarly significantly affect their situation (Art. 22 GDPR).

Basic analytical mechanisms may be used within the Service to optimize content and match communication to User preferences. Such activities do not constitute profiling within the meaning of Art. 22 GDPR, as they do not lead to automated decisions having a significant impact on the User.

In the event of implementing profiling mechanisms or automated decision-making in the future, the Administrator will update this Privacy Policy and inform Users in an appropriate manner.

The Administrator applies appropriate technical and organizational measures ensuring protection of processed personal data, in particular securing data against unauthorized access, change, loss, damage or destruction (Art. 32 GDPR).

The security measures used include in particular:

• Data transmission encryption — communication between the User's browser and the Service server takes place using the SSL/TLS protocol (HTTPS certificate);
• Access control — access to personal data is granted only to authorized persons, based on individual permissions;
• Regular backups — Website and NetSendo Cloud data is backed up; NetSendo Cloud instances are copied once a day, encrypted, to a separate server in the EU, and the two most recent copies are kept;
• Software updates — regular updating of systems and software to eliminate known vulnerabilities;
• Personnel training — persons having access to personal data are trained in personal data protection and obliged to maintain confidentiality.

The NetSendo application offers features based on artificial intelligence, including generating email content, suggesting message topics and planning campaigns using the Campaign Architect module.

In this context, we inform that:

• AI models are provided by third parties — The User configures the integration with a chosen AI provider (e.g. OpenAI, Anthropic, Google) and provides its own API key. In a self-hosted installation requests go from the User's infrastructure, and in NetSendo Cloud from its instance, directly to the chosen provider. NETSENDO PSA does not use these requests for its own purposes.
• Where AI data is processed — in the self-hosted version AI data is processed on the User's infrastructure; in NetSendo Cloud in its instance, under the data processing agreement.
• No automated decision making — AI functions are solely supportive and suggestive. The final decision on the content and sending of the message always belongs to the User;
• AI regulation — we follow rules on artificial intelligence, including Regulation (EU) 2024/1689 (AI Act), and adapt NetSendo's AI features to them.

The Administrator reserves the right to introduce changes to this Privacy Policy in order to adapt it to the current legal state, technological changes or modifications to the scope of services provided.

Users will be informed about any significant changes by:

• publishing the updated version of the Privacy Policy on the Service website;
• updating the "Last updated" date visible at the beginning of the document;
• in the case of significant changes — notifying by e-mail (if the Administrator has the User's e-mail address).

Continued use of the Service after the publication of the updated Privacy Policy means becoming acquainted with its content. However, this does not mean consent to data processing for new purposes — in such cases, the Administrator will ask for appropriate consent from the User.

Providing personal data by the User is voluntary, however:

• In the case of concluding a contract — giving an email address and, for NetSendo Cloud, an instance name is required to place an Order. You give payment details and the billing address to Link; without them payment is not possible.
• In the case of a legal obligation — providing data for tax and accounting purposes (e.g., on an invoice) results from applicable laws and cannot be omitted.
• In other cases — providing data is fully voluntary and does not give rise to any negative consequences other than the inability to use specific functions of the Service (e.g., contact form, newsletter).