ListMatchGenie

GDPR

How ListMatchGenie meets GDPR obligations, supports Data Subject Access Requests, and handles the right to be forgotten — both for your account and for the customers in your uploaded data.

The General Data Protection Regulation (GDPR) applies whenever you process personal data of EU or UK residents — including the customer data you upload to ListMatchGenie. ListMatchGenie is a data processor under GDPR (you are the controller). This page describes how we help you meet your obligations and what we do on our own side.

For the formal contractual terms, see the Data Processing Agreement.

Your obligations as controller

When you upload personal data to ListMatchGenie:

  • You're the controller — you decide what data is processed and why
  • You need a lawful basis for the processing (consent, contract, legitimate interest)
  • You must be able to respond to the rights of your data subjects (the individuals in your uploaded files)

Our obligations as processor

ListMatchGenie acts on your instructions when processing your data. Our obligations include:

  • Processing only as documented in the DPA and this documentation
  • Ensuring subprocessors meet the same standards
  • Implementing appropriate technical and organizational measures
  • Assisting you with data subject rights
  • Notifying you of breaches within 72 hours
  • Deleting data at the end of the engagement

Data Subject Access Requests (DSAR)

If a data subject (an individual in a file you uploaded) asks you for all the data you hold on them, you may need to find their records inside the files stored with ListMatchGenie.

The DSAR export tool on the admin side lets you:

  1. Search your files for a specific identity (email, name, phone)
  2. Export every row from every file that matches
  3. Include metadata (which file, when uploaded, what matches involved the row)

The tool is available to Owner and Admin roles. Extractions are logged in the audit trail.

Right to deletion

A data subject can request that their data be deleted. The deletion tool (same admin area as DSAR) lets you:

  1. Search for the subject across all your files
  2. Preview every row that would be affected
  3. Execute deletion with a confirmation step

Deletion removes rows from your stored files and from match results where those rows appeared. Deleted data cannot be recovered after the confirmation window (30 days).

Deletion propagates

If you export a match result and then delete the underlying row, the export file on your device is outside our control. You need to re-delete from any copies you distributed. Shared-link reports are updated on next view if the underlying data changed.

Right to rectification

Corrections to individual rows are done by re-uploading the master or source file with the corrected data. The old version remains in version history for the retention period; the new version is active going forward.

Right to data portability

All data is exportable in standard formats (CSV, XLSX) on demand. No data is trapped in proprietary formats that prevent export.

Retention

  • Account data (user accounts, billing) — retained while your subscription is active. Deleted 30 days after account cancellation.
  • Uploaded files — retained per tier (Free and Starter: 30 days after last use; Pro: 90 days; Business: 1 year or indefinitely if within storage cap).
  • Match results — retained as long as the underlying files are retained.
  • Audit logs — retained per tier (see PII and security).
  • Backups — retained for 30 days after source deletion, then cryptographically erased.

Breach notification

If we detect a breach that might have affected your data, you receive:

  • An initial notification within 72 hours of detection
  • An incident report describing what happened, what was affected, and remediation steps
  • A follow-up report as investigation progresses

We maintain a SOC 2 Type II attestation (reviewed annually) and an internal incident response playbook. See security.txt for vulnerability reporting.

Data Processing Agreement

The DPA is a standard Article 28 agreement. Enterprise customers sign a countersigned version; Starter/Pro/Business customers can accept the DPA by executing through the billing page.

Transfers outside the EU/UK

Data uploaded to the EU region stays in the EU. Data uploaded to the UK region stays in the UK. Data uploaded to the US region stays in the US. There are no cross-region transfers unless you explicitly trigger a migration.

Subprocessors located outside the EU/UK are bound by the Standard Contractual Clauses (SCCs) in all cases where the subprocessor accesses EU or UK customer data. SCCs are attached to the DPA.

Questions or requests

For GDPR-specific questions, write to our Data Protection Officer: dpo@listmatchgenie.com.

For DSAR or deletion requests that involve your ListMatchGenie account (your own data, not customer data inside files), email support from the registered account.