Early access is open
Cobundle

Data protection terms

Version 1.0 · 10 November 2026

These terms are part of the host terms and the sponsor terms between Gabriel Beslic, trading as Beslic Labs, Homburger Landstrasse 455, 60433 Frankfurt am Main, Germany, info@cobundle.io ("Cobundle"), and the business that accepts them ("you"). A company that both hosts and sponsors accepts them once. Words such as controller, processing and personal data breach have the meaning they have in the EU General Data Protection Regulation (GDPR).

1. What these terms cover

1.1 These terms set out who is responsible for which personal data on Cobundle, and what each side must do.

1.2 Cobundle does not process personal data on your behalf, and you don't process personal data on Cobundle's behalf. That's why these terms are not a data processing agreement under Art. 28 GDPR.

1.3 For the people on your team who use Cobundle, Cobundle is the controller. Its privacy policy explains how it handles their data.

2. Who is responsible for what

  • The embed on a host's page asks Cobundle for an offer. Data: the buyer's IP address, as with any web request; no other buyer details. Responsible: the host and Cobundle, jointly (Part A).
  • The buyer clicks Claim, and the embed sends their details to Cobundle. Data: email address; name, company and plan if the host passed them. Responsible: the host and Cobundle, jointly (Part A).
  • Cobundle stores the lead and the proof of consent, emails the buyer, handles a withdrawal, charges the sponsor and counts views and claims. Data: the lead. Responsible: Cobundle alone.
  • The sponsor receives the lead and contacts the buyer. Data: the lead. Responsible: the sponsor alone (Part B).

3. Duties of both sides

3.1 Each side complies with the GDPR and other data protection law that applies to its part, keeps the data confidential, and lets only people who need it access it.

3.2 Each side protects the data with appropriate technical and organisational measures. Cobundle's measures are described in Annex 2.

3.3 If either side becomes aware of a personal data breach that affects buyer data the other side also holds, or received from it, it tells the other side without undue delay, and in any case within 48 hours of becoming aware of it, and the two sides work together to handle it. Each side notifies authorities and buyers for its own part.

3.4 If either side receives a request from a buyer that concerns the other side's part, it forwards the request to the other side within five business days.

3.5 If a supervisory authority or a court decides that the roles are different from those described here, the two sides agree in good faith on the terms the law then requires. Until then, these terms apply as closely as possible.

Part A: Hosts and Cobundle as joint controllers (Art. 26 GDPR)

A1. Scope. Part A covers the collection of buyer data through the embed: from the embed's request for an offer until the buyer's details reach Cobundle after a claim. Your own handling of your customers' data before that, and Cobundle's handling after it, are not covered.

A2. Purpose and legal basis. The purpose is to show buyers an offer from a sponsor and to let them claim it.

  • Asking for an offer is based on the legitimate interest of both sides in showing the offer (Art. 6 (1) (f) GDPR). Only the IP address that every web request carries reaches Cobundle; Cobundle doesn't store it for this purpose.
  • Sending the buyer's details after a claim is based on the buyer's consent (Art. 6 (1) (a) GDPR), given by clicking Claim next to a line that names the sponsor, the details shared and the purpose. The consent covers both sides.

A3. Cobundle's duties. Cobundle:

  • builds the embed so that nothing about the buyer leaves the page before Claim, and stores nothing in the buyer's browser;
  • shows the consent line, the "Sponsored · via Cobundle" label and a link to the privacy notice for buyers, and keeps hosts from changing them;
  • informs buyers under Art. 13 and 14 GDPR through that notice, which also sets out the essence of this arrangement (Art. 26 (2) GDPR);
  • records each consent with its exact text, version and time;
  • is the contact point for buyers and answers their requests, including for your part; and
  • secures the embed and the interface it uses.

A4. Your duties. You:

  • may place the buyer's details into the embed only if you are allowed to use them for this, and only for your own customers;
  • follow the placement rules in section 3.3 of the host terms;
  • mention Cobundle in your privacy policy (A6);
  • forward buyers' requests about the embed to Cobundle within five business days; and
  • tell Cobundle without undue delay if you notice misuse of the embed on your pages.

A5. Buyers' rights. Buyers can use their rights against you or Cobundle (Art. 26 (3) GDPR). Between the two sides, each is responsible for its own duties under A3 and A4 (Art. 82 (5) GDPR).

A6. Paragraph for your privacy policy. You can use this text and adapt it to your pages:

Partner offers through Cobundle. On our upgrade and billing pages we may show you an offer of free months from a partner (the "sponsor"), provided by Cobundle, a service of Beslic Labs (Gabriel Beslic), Frankfurt am Main, Germany. To show the offer, your browser asks Cobundle for it, which reveals your IP address to Cobundle as with any web request. Your other details stay on our page. Only if you click "Claim" are your email address, and the other details named next to the button, sent to Cobundle and shared with the sponsor named in the offer, so the sponsor can contact you to set up the free months. We and Cobundle are jointly responsible for this collection (Art. 26 GDPR); Cobundle informs you and answers your requests. Legal basis: our legitimate interest in showing the offer (Art. 6 (1) (f) GDPR) and, for the claim, your consent (Art. 6 (1) (a) GDPR). Details: https://cobundle.io/legal/buyer-privacy/1.0

Part B: Sponsors as independent controllers

B1. The disclosure. When a buyer claims your offer, Cobundle discloses the lead to you as a separate controller. The purpose is to let you contact the buyer and give them the free months they claimed. The legal basis is the buyer's consent (Art. 6 (1) (a) GDPR). Cobundle discloses only the details named in the consent line the buyer saw.

B2. Your duties. You:

  • use the lead only for the purpose in B1 (sponsor terms, section 8.2);
  • inform the buyer under Art. 14 GDPR in your first message, with who you are, where their details came from and a link to your privacy policy;
  • don't sell, rent or pass on the lead, except to your own processors under Art. 28 GDPR;
  • stop contacting a buyer who withdrew, and delete the details you received for the claim within 30 days of Cobundle's notice, unless the buyer has become your customer or the law requires you to keep them;
  • delete the lead once you no longer need it for the purpose;
  • answer buyers' requests about your processing; and
  • protect the lead with measures at least equal to those in Annex 3.

B3. Cobundle's duties. Cobundle collects the consent with your name in it, keeps proof of each consent for 3 years from the claim, gives you a copy of that proof if you need it to answer a buyer or an authority, and tells you when a buyer withdraws.

B4. Sponsors outside the EEA. If you are established in a country without an adequacy decision of the European Commission, making the lead available to you is a transfer of personal data to a third country.

  • If you are certified under the EU-US Data Privacy Framework and the lead is within your certification, the transfer relies on that adequacy decision. You tell Cobundle at once if your certification lapses.
  • Otherwise, the standard contractual clauses in Commission Implementing Decision (EU) 2021/914, Module One (controller to controller), apply and are incorporated into these terms. Cobundle is the data exporter and you are the data importer. The docking clause (Clause 7) applies. The optional wording in Clause 11 doesn't apply. Under Clause 13, the competent supervisory authority is the one named in Annex 1. Under Clause 17, the clauses are governed by German law. Under Clause 18, the courts of Frankfurt am Main, Germany, have jurisdiction. Annex 1 is Annex I of the clauses, and Annex 3 is Annex II.
  • Accepting these terms has the effect of signing the clauses. If the clauses conflict with these terms, the clauses prevail.

4. Term

These terms apply as long as the host terms or the sponsor terms do. Your duties for data you received continue as long as you hold it.

Annex 1: Description of the disclosure (Annex I of the standard contractual clauses)

A. Parties

  • Data exporter: Gabriel Beslic, trading as Beslic Labs (Cobundle), Homburger Landstrasse 455, 60433 Frankfurt am Main, Germany, info@cobundle.io. Role: controller. Activities: running the Cobundle platform.
  • Data importer: the sponsor, with the name, address and contact person in its Cobundle account. Role: controller. Activities: providing free months of its product to buyers who claimed them.
  • Signature and date: acceptance of these terms in the Cobundle dashboard, recorded with the person and the time.

B. Description

  • Data subjects: buyers who clicked Claim on the sponsor's offer.
  • Personal data: email address; name, company and plan if the host passed them; the host and placement; the offer; the time of the claim.
  • Sensitive data: none.
  • Frequency: continuous, one disclosure per claim.
  • Nature: the lead is shown in the sponsor's dashboard.
  • Purpose: contacting the buyer to set up and give the free months they claimed.
  • Retention by the importer: as long as needed for the purpose, or under the importer's customer relationship if the buyer becomes its customer. After a withdrawal: deleted within 30 days.
  • Onward transfers: only to the importer's own processors.

C. Competent supervisory authority

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Wilhelmstraße 7, 65185 Wiesbaden, Germany.

Annex 2: Cobundle's security measures

  • Location. The database, sign-in and file storage run in Frankfurt, Germany (Supabase, region eu-central-1). Server code runs in Frankfurt (Vercel, region fra1).
  • Encryption. All connections use TLS. The database provider encrypts stored data.
  • Access. Each company sees only its own data, enforced by row-level security in the database. Sign-in uses one-time codes or links, without passwords, behind a bot check and rate limits. The administrator signs in with a second factor. Only Gabriel Beslic has administrator access.
  • Data minimisation. The embed sends no buyer details before a claim and stores nothing in the browser. Views are counted per day without personal data. Hosts never see buyer details. Sponsors stop seeing a buyer's details when the buyer withdraws. Cobundle stores which host and placement a lead came from, never the page address.
  • Proof and traceability. Each lead stores the exact consent text and its version. Administrator actions are logged.
  • Availability. The database provider keeps backups.
  • Deletion. Leads are deleted automatically 3 years after the claim. Sign-in records are deleted after 90 days without use, and sign-in rate-limit records after one day. The email provider deletes its copies of emails after 30 days.

Annex 3: Minimum measures for sponsors (Annex II of the standard contractual clauses)

  • Access to leads only for people who need it to set up the free months, each bound to confidentiality.
  • Accounts with access to leads protected by a strong password and a second factor where available.
  • Encryption of leads in transit, and at rest where your systems support it.
  • Deletion of leads under B2, and of copies in your own tools.
  • A process to detect, contain and report personal data breaches, and to answer buyers' requests.