GDPR Compliance

Your data rights under the General Data Protection Regulation

Our GDPR Commitment

DeadCode.io is committed to protecting the privacy and rights of individuals in the European Union and European Economic Area. We comply with the General Data Protection Regulation (GDPR) and have implemented technical and organizational measures to ensure data protection by design and by default.

Your Data Rights

Under GDPR, you have the following rights regarding your personal data:

How to Exercise Your Rights

To exercise any of your data rights, you can:

• Email: Send a request to privacy@marketingstudios.in
• Dashboard: Use the data export/delete features in Settings → Privacy
• Support: Contact our support team through the help center

We will respond to your request within 30 days. If we need more time (up to 60 additional days for complex requests), we will notify you.

Data We Collect

Data Category	Purpose	Legal Basis	Retention
Account Information (email, name)	Account creation & management	Contract	Until account deletion
Repository Metadata	Scan execution & results display	Contract	90 days after disconnect
Scan Results	Service delivery	Contract	User-configurable (default 1 year)
Usage Analytics	Service improvement	Legitimate Interest	26 months
Payment Information	Billing	Contract	7 years (legal requirement)
Support Correspondence	Customer support	Contract	3 years

International Data Transfers

Some of our service providers are located outside the EU/EEA. We ensure appropriate safeguards for international transfers:

• Standard Contractual Clauses (SCCs): We use EU-approved SCCs with all non-EU processors
• EU-US Data Privacy Framework: Where applicable, we use certified vendors
• Supplementary Measures: Encryption, access controls, and contractual commitments

Sub-Processors

Sub-Processor	Purpose	Location
Cloudflare	CDN, DDoS protection, compute	Global (EU data centers available)
Supabase	Database, authentication	EU (Frankfurt)
Razorpay	Payment processing	India (PCI DSS compliant)
GitHub	Repository access (user-initiated)	US (SCCs in place)

Data Protection Measures

• Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Control: Role-based access, principle of least privilege
• Audit Logging: Comprehensive logs of all data access
• Regular Audits: Annual security assessments and penetration testing
• Staff Training: All employees complete GDPR and security training
• Incident Response: Documented procedures with 72-hour breach notification

Data Processing Agreement (DPA)

For business customers, we offer a Data Processing Agreement that details our obligations as a data processor. The DPA includes:

• Scope and nature of processing
• Technical and organizational security measures
• Sub-processor management
• International transfer mechanisms
• Audit rights
• Breach notification procedures

To request a DPA, contact legal@marketingstudios.in or your account manager.

Cookies

We use strictly necessary cookies for authentication and security. For analytics, we use privacy-respecting tools that don't require consent. See our Privacy Policy for full cookie details.

Contact Our DPO

For GDPR-related inquiries or to file a complaint:

• Data Protection Officer: dpo@marketingstudios.in
• EU Representative: Available upon request for Enterprise customers
• Supervisory Authority: You have the right to lodge a complaint with your local data protection authority