GDPR Compliance

Data Processing Agreement (DPA)

TheCombain acts as a data controller for user account data and as a data processor for lead data sourced from publicly available business websites.

Legal Basis for Processing

• Article 6(1)(b) — Contract performance (account, billing)
• Article 6(1)(f) — Legitimate interest (B2B lead generation from public sources)

B2B Data Exemption

Lead data consists of business contact information (professional emails, business phone numbers, company roles) sourced from publicly accessible websites. Under Recital 47 of the GDPR, processing of personal data that is manifestly made public by the data subject is subject to the legitimate interest legal basis.

Your Rights

• Access: Export your data via Account → Export Data
• Erasure: Delete your account via Account → Settings
• Portability: Download all your data in JSON format
• Objection: Contact dpo@thecombain.com to object to processing

Data Retention

Lead data is refreshed every 30 days. User data is retained until deletion request. Financial records retained for 7 years per tax law.

Lead Removal Requests

If your business contact information appears in our database and you wish to be removed, email removal@thecombain.com. We process removal requests within 72 hours.