Terms of use

1. Who we are to each other

   You hold a consent.link account and decide why and how the data of the people who open your links is processed: you are the controller. We, RMX Tec EOOD, run consent.link and process that data only on your behalf: we are your processor under Article 28 of the GDPR. These terms apply to every account and take the place of a separate data processing agreement.

2. What is processed and for how long

   The personal data of the people who open your links, from the moment a link is created until your account is deleted and the records of the journal have reached the end of the retention period of your plan.

3. Why

   To show the consent page before your link opens, to record each decision with the evidence that it was made, to keep the journal, to send you the events you asked for, to produce exports and PDF proofs, and to let people see and withdraw their decisions at «My consents». For nothing else: we do not use the data for our own purposes, do not profile anyone and do not sell data.

4. Which data and whose

   Of the people who open your links: the decision and its time, the link and the purposes shown, the version of the text shown, the IP address, the browser (user agent and accepted languages), the country and city derived from the IP address, a pseudonymous visitor identifier and the decision token. When a person refuses, only the fact and the time of the refusal are kept, without IP address or browser.

5. Your instructions

   We process the data only on your documented instructions: these terms, the settings of your account and the calls your systems make to the API. If we believe an instruction breaks the law, we tell you before acting on it. If the law of the European Union or of a member state requires us to process the data in another way, we tell you beforehand, unless that law forbids it.

6. Confidentiality

   Only the people who need access for their work have it, and each of them is bound to confidentiality. The evidence of each visitor is encrypted with a key of its own and is shown in the cabinet only after sign-in with a code from an app. What our team does with your account is logged, and you can ask for that log.

7. Security

   Encryption in transit and of the evidence at rest; a journal to which records are only added, each linked to the previous one by a hash and anchored with independent timestamps; keys and tokens kept apart from the records; access to the servers with keys only; no visitor data in application logs or error messages. We adjust the measures as the risks change and never lower them without telling you.

8. Sub-processors

   You authorise us to use sub-processors of the kinds described on this page: hosting, an email service, a payment provider and others. Each is bound by written terms at least as protective as these, and we remain responsible for their work. The current list of companies by name is available on request at support@consent.link. We write to your account address about a new or replaced sub-processor at least 30 days before it starts. If you object, you may delete your account before that day, and the new sub-processor will not have processed your data.

9. Transfers outside the European Union

   Our servers are in Germany. Where a sub-processor is outside the European Economic Area, the transfer rests on the Standard Contractual Clauses of the European Commission or, for certified companies, on the EU–US Data Privacy Framework.

10. Requests of people and their rights

    People see and withdraw their decisions themselves at «My consents»; you can withdraw a consent through the API and search the journal in the cabinet. If a person writes to us about your links, we pass the request to you within five working days and do not answer it ourselves, unless you ask us to. We help you with such requests, with data protection impact assessments and with consultations of a supervisory authority, as far as they concern consent.link.

11. Personal data breaches

    If we become aware of a breach that affects your data, we tell you without undue delay and at the latest within 72 hours, by email to your account address: what happened, which data and how many records are affected, what we have done and what we advise. We keep you informed as we learn more.

12. Deletion and return

    You can export the journal as CSV and the proof of any record as PDF at any time. Records leave the journal when the retention period of your plan ends. When you delete your account, the keys that make the evidence readable are destroyed at once, so nobody can read what remains; the remaining records are removed when their retention period ends. We keep nothing beyond that, unless the law requires it.

13. Showing compliance and audits

    We give you what you need to show that these terms are kept: this page, the technical description of the journal and, on request, our answers to your questionnaire. Once a year, with 30 days' notice, you or an auditor bound to confidentiality may check compliance at your cost, during business hours and without access to the data of other clients.

14. Term and changes

    These terms last as long as your account and end when the data is deleted as described in clause 12. If the law changes or a supervisory authority asks for it, we update these terms: the new version appears on this page with its date, and signed-in clients accept it when they next open the cabinet.

Links in our [posts, emails and advertisements] are shortened with consent.link, a service of RMX Tec EOOD. Before the destination opens, consent.link shows a page where you choose whether we may collect your personal data for the purposes stated there. If you agree, consent.link records your decision together with your IP address, browser information and the time, encrypted, as evidence of your consent on our behalf. If you refuse, no personal data is stored. You can see and withdraw your decisions at any time at https://api.consent.link/my. Consent.link acts as our processor under its terms of use, published at https://api.consent.link/dpa.

Also name consent.link where your policy lists the recipients of data or the processors you use.