This agreement is between Idea Bulut Solutions SL ("we") and the organization that holds a re:target account ("you"). It is part of the terms of service and applies whenever we process personal data for you while providing re:target.

Where this agreement and the terms of service disagree about personal data, this agreement wins.

Roles

You are the controller of the personal data in your Marketing Cloud business units, and we process it as your processor. If you are a partner connecting a client's business unit, your client is the controller, you are its processor, and we are your sub-processor; you confirm that your client has authorized this.

What is processed, and why

re:target reads the metadata of the Marketing Cloud Engagement business units you connect, builds an inventory and a dependency graph from it, and produces reports. It reads metadata, not subscriber data: data extensions are read as schemas and row counts, never rows, and it asks for no subscriber, list or contact permission.

Personal data can still appear in that metadata, incidentally. In practice:

names and email addresses of the people who created or changed assets in your org;
sender names and addresses configured on emails and journeys;
names or addresses written into asset names, folder names, or query text;
the names and work emails of the people who use your re:target account.

The people concerned are your staff, your contractors and the users of your Marketing Cloud org. No special category of data is intended to be processed. Processing lasts as long as your account does, and ends with deletion as described below.

A re:target transform engagement may also process personal data in your Salesforce org, through an External Client App you create. What it touches is written into the engagement scope, which is an instruction under this agreement.

Our obligations

We process personal data only on your documented instructions. The terms of service, your use of re:target and any quote or engagement scope you accept are those instructions. If we believe an instruction breaks data protection law, we tell you.
Everyone we authorize to process it is bound to confidentiality.
We apply the security measures listed at the end of this agreement.
We help you answer requests from the people concerned, and with data protection impact assessments and consultations with a supervisory authority, as far as re:target's role allows.
We notify you without undue delay after becoming aware of a personal data breach affecting your data, with what we know and what we are doing about it, and keep you updated.
We make available the information needed to show we meet this agreement. We answer security questionnaires, and an audit or inspection is arranged by agreement, with reasonable notice and at your cost.

Sub-processors

You authorize the sub-processors listed on the security page. We give notice before adding or replacing one, by email to account owners, and you may object on reasonable data protection grounds. If we cannot resolve the objection, you may close your account, or end the affected paid offer, without penalty. Each sub-processor is bound by data protection terms that protect your data at least as well as this agreement, and we remain responsible for them.

Where it is processed

Shared hosting runs in Google Cloud in the United States, or in the EU if you ask, at no extra cost. Private hosting runs in a region you choose. Where personal data from the European Economic Area, the United Kingdom or Switzerland is processed outside it, the transfer relies on the European Commission's Standard Contractual Clauses, or on the recipient's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

Deletion

We keep the most recent scans of each business unit and prune the detailed data of older ones automatically. A metadata archive you build is deleted after 72 hours. An account admin can delete the whole account from its settings, with every member, business unit, scan and export, and a member can delete their own login. Ask, and we delete everything about a business unit, or your whole account, at once. When your account is deleted, we delete your data unless the law requires us to keep it, and email a confirmation. Deleted data leaves our database backups within 7 days. Orders are kept for our accounts with their amounts, and without the details of who placed them.

Security measures

Read-only access to Marketing Cloud Engagement: the installed package carries no write, publish or send permission, and you can revoke it at any time.
Marketing Cloud credentials are encrypted at rest and used only to request access tokens, each of which expires within 20 minutes.
Each account's data is separated from every other account's, and every request is checked against the account it belongs to.
Traffic to the site and the app is encrypted in transit, over HTTPS only.
Application and database run in one region, and nothing about an assessment is copied elsewhere.
Sign-in attempts are rate-limited.

Contact

Questions about this agreement: hello@retarget.marketing. A security incident or vulnerability: security@retarget.marketing.

Last updated October 7, 2026.

Data processing agreement