Under the General Data Protection Regulation (GDPR/AVG), you have specific rights regarding your personal data. This page explains how to exercise those rights with MailOdds, whether you are a MailOdds account holder, a shopper on a storefront we power, an SMS/RCS subscriber, or someone whose email address was submitted to us for validation.
Your Rights
| Right | What It Means | How to Exercise |
|---|---|---|
| Access Art. 15 | Obtain a copy of the personal data we hold about you | Dashboard > Settings > Privacy > Export Data, or email us |
| Rectification Art. 16 | Correct inaccurate or incomplete data | Dashboard > Account Settings, or email us |
| Erasure Art. 17 | Delete your personal data | Dashboard > Settings > Delete Account, or email us |
| Restriction Art. 18 | Limit how we process your data | Email us with details |
| Portability Art. 20 | Receive your data in a machine-readable format (JSON) | Dashboard > Settings > Privacy > Export Data |
| Objection Art. 21 | Object to processing based on legitimate interest, including profiling and direct marketing | Email us; objection to direct marketing is honoured immediately |
| Automated decisions Art. 22 | Not be subject to solely automated decisions with legal/significant effects; request human review of scoring | Per-visitor opt-out of intelligence; email us for review |
How to Submit a Request
You can exercise your rights in three ways:
- Self-service: Log in to your dashboard at Settings > Privacy for access, export, data purge, and account deletion
- Email: Send your request to privacy@mailodds.com
- DPO: Contact our Data Protection Officer at dpo@mailodds.com
Verification
To protect your data, we verify your identity before processing requests. For logged-in users, your authenticated session is sufficient. For email requests, we will send a verification link to the email address on your account. We do not require excessive identification beyond what is necessary to confirm your identity (per Art. 12(6)).
Response Timeline
We respond to all requests within one calendar month of receipt. If a request is particularly complex or we receive a high volume of requests, we may extend this by up to two additional months. If we need to extend, we will notify you within the first month with the reasons for the delay.
If You Are a Storefront Shopper or Messaging Subscriber
For most data we hold on behalf of a merchant, that merchant is the controller and MailOdds is the processor (GDPR Art. 28). This covers storefront orders and customer records, returns and refund evidence, payment metadata, SMS/RCS subscriber records, email subscriber lists and campaign tracking, inbound messages, and email addresses submitted for validation.
To exercise your rights against merchant-held data, contact the merchant (the store you ordered from or subscribed to) directly. They are the controller and decide how the request is handled. If you contact us first, our processor-forwarding path applies: we identify the relevant merchant, forward your request to them without undue delay (within three business days), and assist them in responding using the search, export, and purge tooling described below. We do not action erasure or other changes to merchant-held data on our own initiative; we act on the controller's documented instruction (Art. 28(3)(e)).
One exception: visitor intelligence. For our cross-device identity graph and the intent, heat, and risk scores we derive from it, MailOdds is an independent controller: this is our own product, based on legitimate interest (Art. 6(1)(f)) with a documented balancing test, not a merchant-instructed activity. You can exercise your rights over this data directly with us. A per-visitor opt-out is available, and you can object to this processing (including any profiling) at any time. You also have the right under Art. 22 not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and may request human review of any scoring applied to you.
Exceptions
Certain data may be retained even after an erasure request:
- Billing records: Retained for 7 years as required by Dutch fiscal law (Algemene wet inzake rijksbelastingen Art. 52)
- Legal claims: Data needed for the establishment, exercise, or defense of legal claims (Art. 17(3)(e))
- Consent evidence: Records proving that consent was validly given, retained for accountability purposes (Art. 5(2))
Complaints
If you are not satisfied with our response, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) at autoriteitpersoonsgegevens.nl.
For complaints about commercial electronic messages (spam), the competent authority is the Autoriteit Consument & Markt (ACM).
Contact
- Privacy: privacy@mailodds.com
- Data Protection Officer: dpo@mailodds.com
- Address: Nassaukade 51-2, 1052CN Amsterdam, The Netherlands
- KVK: 99761246