Roles
For platform account data (users, logins, audit logs) markst acts as a data controller. For content you upload to Verus (deal documents, financials, assumption sets) markst acts as a data processor, processing personal data strictly on your documented instructions.
Data Protection Lead
markst is below the UK GDPR Article 37 threshold that would require the appointment of a statutory Data Protection Officer — we are not a public authority, our core activities do not involve large-scale regular systematic monitoring of data subjects, and we do not process special-category or criminal-offence data on a large scale. The person responsible for data-protection compliance within markst therefore carries the title Data Protection Lead.
The Data Protection Lead is the single point of contact for any data-protection question, DSAR, breach report, or regulator correspondence. Contact: dpo@markst.com (the dpo@ alias is retained as the role mailbox to avoid URL/link churn on prior disclosures and external references). We review the designation annually; if processing activity changes in a way that triggers the Article 37 threshold, we will appoint a formal DPO and update this page.
Your rights
Data subjects have the following rights in relation to personal data we hold about them:
- Access — obtain a copy of personal data we hold.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion, subject to statutory retention.
- Restriction — limit how we process the data.
- Portability — receive structured, commonly-used data formats.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, without affecting processing already carried out.
To exercise a right, email dpo@markst.com. We respond within one month of receiving a verifiable request.
Lawful bases
We rely on contract, legitimate interests, legal obligation, and consent, depending on the processing activity. Our Privacy Notice describes the basis applicable to each category of data.
International transfers
Where personal data leaves the UK/EEA, we rely on adequacy decisions or the ICO-approved International Data Transfer Agreement (IDTA) / EU Standard Contractual Clauses, together with supplementary technical and organisational measures where required.
Sub-processors
The canonical sub-processor register (cloud hosting, edge / CDN, error monitoring, language-model providers engaged when AI extraction is enabled, email delivery, payment processing) is published at /legal/subprocessors. Material changes are notified to customer contacts at least 30 days before they take effect; subscribe through your customer contact or dpo@markst.com.
Security
- Encryption in transit (TLS 1.2+) and at rest.
- Role-based access controls, least privilege, audit logging of privileged actions.
- Separate environments for development, staging, and production.
- Regular dependency and vulnerability scanning.
- Incident response with documented notification timelines.
Breach notification
If we become aware of a personal-data breach affecting your data, we will notify you without undue delay and, where required, within 72 hours of becoming aware, together with the information needed for you to meet your own notification obligations.
Supervisory authority
In the UK, the Information Commissioner's Office (ICO) is the supervisory authority. You have the right to lodge a complaint at ico.org.uk. In the EU, you may contact your local supervisory authority.
Contact
Data protection queries: dpo@markst.com.