Acting as Processor, Code Chemistry Limited will process personal data on behalf of clients. They will be acting as Data Controller (hereafter also Client). The nature and purpose of the processing carried out by Code Chemistry acting as processor on behalf of Clients is described below.

Through the tools provided by Code Chemistry’s solution, Controller/Clients can insert, automate and personalise marketing content in their email marketing campaigns and marketing email traffic, according to their needs and their decisions on the type of content and the mode of display and feedback originated by their usage of Code Chemistry’s tools.

Code Chemistry has no control on or knowledge of the legal basis for the email send, nor does it have any knowledge of the origin and structure of the mailing lists used by Clients.

Code Chemistry LTD’s technology is a so-called “open-time” marketing solution that provides its Controller/Client with tools (Elements) to personalise and automate email marketing content according to their decisions and purposes.

Code Chemistry tools allow Clients to insert HTML Elements to the HTML content of emails they send to recipient lists under their exclusive control. Code Chemistry does not send any of the Client’s emails to his designated recipients and is not in any way involved in the send of Client’s marketing email traffic.

The HTML Elements allow clients to personalise the content of marketing emails and update them based on a group of parameters set by the Client, at point of opening by recipients or by their email client.

These parameters are determined by the personalisation rules made available by Code Chemistry’s solution. The parameters allowed by Code Chemistry’s solution are compliant with industry guidelines and with changes in the privacy default settings of all widely used email clients.

These personalisation rules allow, as an instance, offering of sale content and discounts, as determined by the Client. The Client selects the parameters and decides the timing of content activation based on his own decisions.

The displayed content, determined and entirely controlled by the Client, either produced directly by him or commissioned by him to third parties, is uploaded by Code Chemistry’s technology and later added to the Client’s HTML email traffic. The Client can autonomously configure Code Chemistry’s Elements, and either enable it to retrieve the content selected by the client from repositories controlled by him, or ones indicated by him to Code Chemistry.

Code Chemistry’s HTML tools are not cookies and do not embed themselves into the email recipient’s device, nor are they cached or stored in his browser. They are activated when the recipient opens specific parts of the email and do not cause or contribute to any subsequent processing of personal data beyond the tagged email.

The Elements are completely inactive in all stored emails either in the inbox or in any other partition of the recipient’s email account and are deleted together with the email message once this is deleted by the recipient.

The launch of the email campaign is determined by the client. The act of opening the email by the recipient or his email client activates, on Code Chemistry’s side, a set procedure which leads to pseudonymised encrypted personal data, necessary to the performance of the contract, being stored on Code Chemistry’s servers.

Code Chemistry processes and stores in its systems only the pseudonymised encrypted personal data of recipients which is necessary to the performance of the legitimate processing provided by Code Chemistry’s technology as stated in this contract and the fulfillment of related contractual obligations, such as invoicing. The data thus collected after activation upon opening of the email is never shared in any way with third parties and is not subject to any further processing outside the perimeter of this description. It cannot be accessed by Clients. After activation upon opening of the email, it is stored at rest in Code Chemistry’s systems, which are fully encrypted at rest. Clients have access exclusively to the general metrics of their account in the web application, which is fully isolated from the databases storing the personal data.

The data obtained by Code Chemistry from recipients are the origin IP address, general type of OS used by the opening device and approximate location data (within standard accuracy specification with built-in privacy fuzziness). The email address of the recipient is not necessary to carry out Code Chemistry’s processing. Therefore, the technology, by design, does not learn the email address of the recipient initiating the event in its databases.

As a defining feature of Code Chemistry’s privacy by design process, the proprietary HTML code of the Elements is designed so as to not provide, through the Element, a unique identifier of the recipient. This applies both to Code Chemistry and the Client.

The association between IP address and weather conditions at place and time of opening is conducted exclusively by Code Chemistry and no data is shared with the weather service solution provider.

The association between IP addresses and location data is conducted by Code Chemistry’s proprietary technology and no personal data processed and stored by Code Chemistry is ever shared with the location data solution provider.

The treatment and storage of the above mentioned Personal Data within Code Chemistry’s systems is designed to follow all relevant UK GDPR and GDPR principles and relevant ICO and EDPB guidelines, in particular those falling under the general category of as early as possible pseudonymisation of processed Personal Data ex Art 25 and Recital 78 GDPR.

Personal data is cryptographically hashed by Code Chemistry in such a way that identifiability of the Data Subject, absent further information, is prevented.

In compliance with the standalone security obligations of the Processor ex art 32 UK GDPR, processing and storage of personal data by Code Chemistry is carried out with adequate security measures such as, for instance, full encryption of its databases on top of pseudonymisation, strict segregation of Personal Data within the system, exclusive access to system parts processing and storing personal data by appointed employees using a specific reinforced login authentication procedure.

Code Chemistry will process personal data exclusively upon instruction by the Client as specified in the processing contract and will immediately cease processing of personal data upon the termination of the contract. According to the instructions of the Client, it will either securely return or securely delete the Data, including backup copies. Code Chemistry will provide the Client with full documentation of the deletion process.

In any case Code Chemistry will not retain the personal data processed on behalf of Clients for longer than necessary for the purpose of the processing.

Code Chemistry’s entire IT infrastructure is based on the AWS cloud solution with servers based in the UK and is regulated by the standard UK GDPR Amazon Web Services contract.