1. Parties and roles
This agreement is between the organisation using Linkray for Products (the brand, data controller) and Studio74, CVR DK46432142, Denmark (Linkray, data processor). It applies when the brand turns on Members, and forms part of the terms for using Linkray. It meets Article 28 of the GDPR.
An owner or admin accepts it on the brand’s behalf in the dashboard; the time and person are recorded.
2. What is processed
| Purpose | Running the brand’s members programme: sign-in, product registration, points, tiers and emails to members |
| Data subjects | The brand’s customers who join its programme |
| Personal data | Email, name, marketing consent and its history, registered products and serials, points, sign-in and activity times |
| Special categories | None. The brand must not collect them through Linkray |
| Duration | While the programme is on and the brand has a Linkray for Products plan |
3. Linkray’s obligations
- Process the data only on the brand’s documented instructions, which are the settings and actions in Linkray, and tell the brand if an instruction seems to break data protection law.
- Make sure everyone with access is bound by confidentiality.
- Keep appropriate technical and organisational security measures, described in our Data Policy.
- Help the brand answer members’ requests to access, correct, delete or move their data; members can also do most of this themselves.
- Help the brand with security, breach notification and impact assessments as far as Linkray’s role allows.
- Notify the brand without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach.
- Make available the information needed to show compliance, and allow reasonable audits with 30 days’ notice.
4. Sub-processors
The brand gives general authorisation to the sub-processors listed in our Data Policy, currently Supabase (database), Vercel (hosting) and Resend (emails). Linkray will announce new sub-processors at least 30 days before using them, and the brand may object. Each sub-processor is bound by equivalent obligations.
Transfers outside the EU/EEA rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.
5. The brand’s obligations
- Have a lawful basis for the programme, and consent before sending marketing emails. Linkray only lets the brand email members who ticked its consent box.
- Tell members how their data is used, for example in the brand’s privacy notice and the consent text it sets in Linkray.
- Only put personal data into Linkray that the programme needs.
6. When the agreement ends
The brand can export its members as CSV at any time. Linkray deletes members’ personal data within 30 days of the brand asking, and straight away when the brand deletes its organisation, unless the law requires keeping it. Members can delete their own data at any time. Backups are overwritten within a further 30 days.
7. Contact
Questions about this agreement, or a signed copy for your records: hey@linkray.io.