Your data protection role

Who is responsible for visitor data

Each brand site is its own data controller, the business responsible for the details visitors submit through the Rep. Next Day Sales (Four49 Media LLC) is a processor acting on the controller's behalf under our Data Processing Agreement. If you're an agency, the controller is usually your client, and your agency acts as a processor for them.

Fill in controller details for each site

Open the site, go to Settings → General → Data controller and add:

• the controller's business name and registered address
• a privacy contact email
• a link to their privacy policy
• how long to keep enquiries (3–36 months). Leave it blank to use your workspace default.

The Rep's consent line names the controller and links their privacy policy. Visitors must tick it before any details are sent.

Privacy policy wording

The same card has copyable wording for the brand's own privacy policy. It explains what the Rep collects, that it sets no cookies and does no passive tracking, and how long enquiries are kept. Treat it as a starting point and have the brand confirm it with their own advisers.

Retention

Enquiries and the questions visitors typed are deleted automatically once the site's retention period ends. Visit records follow your workspace analytics retention period. Every deletion is logged.

Handling a data request

When a visitor verifies a request on our privacy request page, the workspace that owns the site gets a notice. In Data controller → Handle a data request, enter their email to Find, Export (downloads a file) or Delete everything held for them on that site. Respond within 30 days. The same export and delete actions are available from connected chat apps.