This page explains where your data lives, who's responsible for what, and how EmailOctopus helps you meet your obligations under the GDPR. It isn't legal advice, so if you're unsure what the law requires of your business, it's worth speaking to a lawyer.

Where is EmailOctopus based, and where are your data centres?

EmailOctopus is a UK company. We're Three Hearts Digital Ltd, based in London. We follow the UK GDPR and, because many of our customers and their contacts are in the European Union, the EU GDPR too.

Your data is stored and sent from the EU. Your contact lists and content are stored with Amazon Web Services in the European Union, primarily in Ireland. Your emails are also sent from servers in the EU.

Like any company, we use a number of additional services to help provide the product. Our Sub-processors page lists every provider that handles your data, what they do and where they're based.

Who's responsible for what

When you upload contacts and send emails with EmailOctopus, you're the controller of that data. You decide who's on your lists and what you send them. We're your processor: we store and send on your instructions, and we don't use your contacts' data for our own purposes.

For your own account, billing and support details, we're the controller. Our Privacy and Cookie Policy explains how we use that data.

Our data processing agreement

The GDPR requires a written contract between a controller and its processor. Ours is built into our Terms of Use as Schedule 2, so it applies automatically to every account. There's nothing to sign or request.

It covers what we process and why, how we keep it secure, how we help you with requests from your contacts, what happens if there's a data breach, and what happens to your data when you leave.

Our EU representative

Because we're based in the UK, we've appointed a representative in the EU under Article 27 of the EU GDPR: BizLegal Ltd, trading as EU Rep (company number 635921), 27 Cork Road, Midleton, Co. Cork, Ireland. People in the EU and EU data protection authorities can contact them using the form at eurep.ie.

How EmailOctopus helps you comply

Double opt-in asks new subscribers to confirm their email address, so you have a clear record that they signed up.
Consent checkboxes on your forms let you ask for specific permission and keep a record of it.
Unsubscribe links let your contacts withdraw consent at any time.
Export and delete your contacts whenever you need to, for example to answer a request from a contact or to clear out lists you no longer use.

Your responsibilities as a sender

As the controller, it's up to you to make sure you're allowed to email the people on your lists. In practice, that means:

having a lawful basis for each contact, which for marketing emails is usually consent;
telling people who you are and how you'll use their data when they sign up;
never using bought, rented or scraped lists;
honouring unsubscribe requests promptly; and
responding when your contacts ask to see, correct or delete their data.

Our Acceptable Use Policy sets out the full rules for sending with EmailOctopus.

Requests from your contacts

Your contacts can ask what data you hold about them, ask you to correct or delete it, and object to marketing. As the controller, you handle these requests, and you can usually do it from your account by exporting, editing or deleting the contact. If one of your contacts gets in touch with us directly, we'll pass the request on to you and help where we reasonably can.

Data breaches

If a personal data breach affects your contact data, we'll tell you without undue delay, and within 48 hours of becoming aware of it, with the information you need to respond. That gives you time to meet your own obligations: as a controller, you usually need to report a breach to your data protection authority within 72 hours, and tell the people affected if there's a high risk to them.

Questions

If you have a question about how we handle data, email privacy@emailoctopus.com. For general guidance on your own obligations, the UK Information Commissioner's Office has a guide to the UK GDPR.