This document outlines how [BounceBrake legal entity name] complies with the General Data Protection Regulation (GDPR) and describes our practices for collecting, processing, storing, and protecting personal data of our users. We are committed to maintaining the highest standards of data protection and transparency.
1. Company Information
Data Controller: [BounceBrake legal entity name]
Registration Code: [registration number]
Registered Address: [registered address]
Data Protection Officer (DPO): [Data Protection Officer name]
Contact: support@bouncebrake.com
[BounceBrake legal entity name] is the data controller responsible for the personal data of its users (account holders and their team members). For the email lists that customers submit for verification, the customer is the controller and BounceBrake processes that data on the customer’s behalf. BounceBrake applies the General Data Protection Regulation (EU) 2016/679 whenever it processes personal data of individuals in the European Economic Area, as a company registered in [country of registration].
2. Data Collection & Purpose
We collect and process personal data for the following purposes:
- Account creation and management: name, email address, company information, and account credentials
- Email communications: email address and notification preferences, for service emails such as verification codes, password resets, invitations and job-complete notices
- Service delivery: the email addresses and other columns in the lists you submit, processed only to verify them and return results to you
Data sources include:
- IP address and request information collected in server logs during website and app visits
- Information provided directly during signup and account registration
- Lists you upload or send through the API
- Data submitted through email and customer support interactions
We do not use Google Analytics or other third-party analytics on bouncebrake.com.
3. Integration Partners
We work with trusted partners to provide our services. These partners process data only as necessary to provide their services and do not share your personal data with unauthorized third parties.
Stripe
Payment processing and subscription management. Stripe processes payment data under its own GDPR-compliant data processing agreements.
Amazon Web Services
Hosting, content delivery and transactional email (Amazon SES), under the AWS GDPR Data Processing Addendum.
Supabase
Database, authentication and file storage, under Supabase’s data processing agreement.
Infrastructure used in providing the verification service for the addresses you submit.
Smartlead and Instantly
Only when you connect them, to deliver verified leads to the campaign you choose.
4. Storage & Security
We employ cloud services and industry-standard security measures to protect your data:
- Infrastructure: Amazon Web Services (AWS) in the US East (N. Virginia) region: EC2 for the application servers, CloudFront and S3 for the websites, SES for email
- Authentication: Supabase Auth for secure sign-in and identity management
- Database: Supabase managed PostgreSQL, with row-level access controls
- File Storage: Supabase Storage in private buckets, reachable only through short-lived signed links
- Payments: Stripe for PCI-DSS compliant payment processing
Security measures include encryption of data in transit and at rest, network firewalls, access controls, secrets kept out of code, and continuous monitoring. We conduct periodic reviews to ensure our security posture meets or exceeds industry standards.
5. Data Retention
Personal data is stored and maintained for as long as your account is active and you continue to use our services. Data is retained until you request deletion. Upon receiving a valid deletion request, we will remove your personal data from our active systems within a reasonable timeframe, subject to any legal obligations that may require us to retain certain records.
6. Third-Country Transfers
Our primary data storage is located in the United States. While this constitutes a transfer of data outside the European Economic Area, we ensure GDPR compliance through the following safeguards:
- Standard Contractual Clauses (SCCs) as approved by the European Commission, included in our providers’ data processing agreements
- Our providers’ participation in the EU-US Data Privacy Framework where applicable
- Additional technical and organizational measures to protect data during transfer and storage
- Regular assessment of the data protection landscape in recipient countries
7. User Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access: Request a copy of the personal data we hold about you
- Right to rectification: Request correction of inaccurate or incomplete data
- Right to erasure: Request deletion of your personal data
- Right to restrict processing: Request that we limit how we use your data
- Right to data portability: Request your data in a common machine-readable format such as CSV or JSON
You can exercise these rights through the following channels:
- Your BounceBrake account settings (profile and notification preferences)
- Email request to support@bouncebrake.com
8. Data Breach Protocol
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, [BounceBrake legal entity name] will:
- Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
- Notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms
- Document the breach, its effects, and the remedial actions taken
- Take immediate steps to contain and mitigate the impact of the breach
- Conduct a post-incident review and implement improvements to prevent recurrence
9. Consent
We obtain consent for data processing at the time of account signup. Our consent mechanism ensures that:
- Consent is freely given, specific, informed, and unambiguous
- Users are presented with clear information about what data is collected and how it will be used
- Users can withdraw consent at any time by contacting us at support@bouncebrake.com
- Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal
10. Contact the Data Protection Officer
If you have any questions, concerns, or requests regarding your personal data or this GDPR Compliance document, please contact our Data Protection Officer:
Data Protection Officer: [Data Protection Officer name]
Company: [BounceBrake legal entity name]
Address: [registered address]
Email: support@bouncebrake.com
Website: bouncebrake.com