filtrat is run from Poland and follows the EU General Data Protection Regulation (GDPR). This article explains who is responsible for what, and how the data processing agreement (DPA) works. It's a summary; the Privacy Policy and the DPA are the binding texts.
Two roles
| Data | Controller (decides why it's processed) | Processor (processes it on instructions) |
|---|---|---|
| Your own account: your email, name, billing details, usage | filtrat | — |
| Addresses and people you submit: emails to verify, people to find, leads you capture or import | You | filtrat |
For the second kind, we process the data only to give you results, under your instructions, and for nothing else. You decide what to submit, and you need a lawful basis for it, for example a legitimate interest in contacting businesses.
The DPA
The data processing agreement covers everything we process on your behalf: single checks, bulk files, the API, MCP and integrations.
- It's part of our Terms of Service, so it applies automatically when you use filtrat. You don't need to sign anything.
- Read it at filtrat.io/dpa. It lists our sub-processors and how international transfers are protected.
- Need a countersigned copy, custom clauses or your own DPA format? Email privacy@filtrat.io. We'll accommodate what we reasonably can.
Under the DPA we notify you within 72 hours of becoming aware of a breach involving your data, help you answer requests from data subjects, and delete or return your data when you leave.
When a person asks about their data
If someone whose address you verified or found contacts you, you answer them as the controller. If they contact us and we can tell which customer submitted their data, we'll point them to you. To stop a person from being contacted again, add them to an exclusion list: they'll be left out of future captures, email finding and exports.
People can also ask for a human review of an automated verification result. Their first contact is the customer who submitted the address; when they can't identify them, privacy@filtrat.io will help.
Your rights as a filtrat user
For your own account data you have the right to:
- access it and get a copy;
- correct it;
- delete it where we have no legal reason to keep it;
- restrict or object to some processing;
- move it in a machine-readable format;
- complain to a data protection authority.
Email privacy@filtrat.io to use any of these. We answer within one month, and requests are free. Some records, like invoices, must be kept for the legal retention period even if you ask us to delete them.
To export your work yourself, download your jobs and lists as CSV: see Download past results. To delete your data, see Delete your data.
Supervisory authority
Our lead supervisory authority is the Polish data protection authority (UODO). You can also contact the authority in your own EU country.
Outside the EU
California residents and residents of other US states with privacy laws have equivalent rights, including to know, delete and correct. We don't sell or share personal data as those laws define it. Use the same address, privacy@filtrat.io.