GDPR Compliance

1. GDPR Overview

The General Data Protection Regulation (GDPR — Regulation EU 2016/679) is a comprehensive data protection law that came into effect on 25 May 2018. It applies to any organisation that processes personal data of individuals in the European Economic Area (EEA), regardless of where the organisation is based. The UK GDPR and Swiss FADP are closely aligned equivalents that apply in those jurisdictions.

Sendbound is committed to supporting our customers' compliance with the GDPR. This page explains how the GDPR applies to your use of Sendbound, what we do as your processor, and what tools and mechanisms we provide to help you meet your obligations as a data controller.

2. Our Role as Data Processor

Under the GDPR, each party involved in the processing of personal data has a defined role. Understanding these roles is essential for compliance.

You are the Data Controller

When you use Sendbound to send emails to your contacts, you (the customer) are the Data Controller. You determine the purposes and means of processing — i.e., why you are sending emails, to whom, and what data you are including. As a Controller, you are responsible for:

• Collecting personal data from your contacts lawfully (e.g., with consent, under contract, or another lawful basis)
• Providing data subjects with a privacy notice that includes information about your use of Sendbound as a processor
• Handling data subject requests from your own contacts (access, deletion, portability, etc.)
• Ensuring your instructions to Sendbound comply with applicable data protection law

Sendbound is your Data Processor

Sendbound acts as a Data Processor on your behalf. We only process personal data according to your documented instructions (as set out in our Terms of Service and DPA). We do not sell, share, or use your contacts' personal data for our own purposes. We maintain appropriate technical and organisational measures to protect personal data and assist you in meeting your obligations.

Sendbound as Controller for our own data

Sendbound also acts as a Data Controller for personal data we collect about our own users (account holders, billing contacts) for the purpose of operating and improving our services. This is described in our Privacy Policy.

3. Lawful Basis for Processing

You must have a lawful basis under Article 6 GDPR to process your contacts' personal data using Sendbound. Common lawful bases for email marketing and transactional email include:

Consent (Art. 6(1)(a))

The contact has given clear, freely given, specific, informed, and unambiguous consent to receive communications from you. For marketing emails, this is often the most appropriate basis. Consent must be documented and easy for the data subject to withdraw.

Contract (Art. 6(1)(b))

Processing is necessary to perform a contract with the data subject, or to take steps at their request before entering into a contract. Transactional emails (order confirmations, receipts, account notifications) typically rely on this basis.

Legitimate Interests (Art. 6(1)(f))

Processing is necessary for your legitimate interests, provided those interests are not overridden by the interests or fundamental rights of the data subject. This can apply to B2B email marketing to existing customers, subject to a legitimate interests assessment (LIA). Sendbound provides LIA templates to Enterprise customers on request.

You are responsible for determining and documenting your lawful basis before using Sendbound to contact individuals. Sendbound provides tools to help you manage consent records, suppression lists, and unsubscribes — but the legal determination is yours to make.

4. Data Subject Rights

Under the GDPR, individuals have the following rights regarding their personal data. As a controller, you are responsible for responding to these requests. Sendbound provides tools and APIs to help you comply:

Right of Access (Art. 15)

Individuals can request a copy of the personal data you hold about them. Sendbound provides contact export via the API and dashboard, allowing you to retrieve all stored data for a specific contact in machine-readable format.

Right to Rectification (Art. 16)

Individuals can request correction of inaccurate personal data. You can update contact records via the Sendbound dashboard or API at any time.

Right to Erasure (Art. 17)

Individuals can request deletion of their personal data ("right to be forgotten"). Sendbound provides a contact deletion endpoint in the API that removes all stored personal data for that contact, including send history and custom attributes. Deleted contacts are added to a suppression list to prevent re-import.

Right to Restriction of Processing (Art. 18)

Individuals can request that processing be restricted while a dispute is resolved. You can use Sendbound's suppression list to prevent any further communications to a specific contact without permanently deleting their record.

Right to Data Portability (Art. 20)

Individuals can request their personal data in a structured, commonly used, machine-readable format. Sendbound supports CSV and JSON export of all contact data and campaign history via the API.

Right to Object (Art. 21)

Individuals can object to processing based on legitimate interests or for direct marketing purposes. Sendbound's unsubscribe mechanism and suppression lists support the right to object to marketing. Once a contact unsubscribes, they are permanently suppressed from future campaigns.

Rights Related to Automated Decision-Making (Art. 22)

Sendbound does not make automated decisions that produce legal or similarly significant effects on data subjects. Our send-time optimisation and A/B testing features operate on aggregate behaviour, not individual profiling for decision-making purposes.

5. International Data Transfers

Sendbound is headquartered in the United States, which does not have an EU adequacy decision for data transfers from the EEA. To ensure lawful transfer of personal data from the EEA, UK, and Switzerland, Sendbound relies on the following mechanisms:

Standard Contractual Clauses (SCCs)

We use the 2021 EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) — specifically Module 2 (Controller to Processor) — for transfers of personal data from the EEA to the United States. These are incorporated into our DPA.

UK International Data Transfer Addendum

For transfers from the United Kingdom, we use the UK ICO's International Data Transfer Addendum (IDTA) appended to the EU SCCs.

Swiss Standard Contractual Clauses

For transfers from Switzerland, we rely on the Swiss Federal Data Protection Commissioner's approved standard contractual clauses.

Transfer Impact Assessments

We have conducted a Transfer Impact Assessment (TIA) for transfers to the United States, taking into account US government access to data and the protections available. We have implemented supplementary technical and contractual measures, including encryption and strict access controls, to address identified risks. TIA documentation is available to Enterprise customers under NDA.

Subprocessor Transfers

All our subprocessors that process EEA personal data are required to have adequate transfer mechanisms in place. Details are included in the DPA.

6. Data Processing Addendum

Our Data Processing Addendum (DPA) is a legally binding contract between you (the Controller) and Sendbound (the Processor) that governs the processing of personal data in accordance with GDPR Article 28.

Our DPA covers: processing instructions, confidentiality obligations, security measures, subprocessor management, Data Subject rights assistance, breach notification, international transfer mechanisms (SCCs), audit rights, and data deletion.

The DPA is incorporated into our Terms of Service by reference and applies automatically. Enterprise customers who require a countersigned copy for procurement or compliance purposes can request one by emailing privacy@sendbound.com.

Read the full DPA at sendbound.com/legal/dpa.

7. Sub-processors

Under GDPR Article 28(4), Sendbound may engage sub-processors to assist in providing the Services. We impose equivalent data protection obligations on all sub-processors via written agreements. Key sub-processors include:

• Amazon Web Services (AWS) — Cloud hosting and infrastructure (EU-based data residency available)
• Stripe, Inc. — Payment processing
• PostHog — Product analytics
• Intercom — Customer support
• Cloudflare — Network and DDoS protection

We notify customers at least 14 days in advance of any change to our sub-processors. You may object to a new sub-processor and, if we cannot accommodate your objection, you may terminate the Services without penalty. The full sub-processor list is maintained at sendbound.com/legal/subprocessors.

EU Data Residency

Enterprise customers can request that their data be stored and processed exclusively within the EU (AWS eu-west-1). Contact sales@sendbound.com to enable EU-only data residency.

8. Data Retention & Deletion

Sendbound retains customer data for the duration of the account relationship plus a 30-day grace period following termination (to allow for account recovery). After this period, all customer data is permanently deleted from production systems within 90 days.

Within the platform, you have full control over your data:

• Delete individual contacts via dashboard or API at any time
• Export all data before account termination
• Configure email content retention periods (0–365 days) on Enterprise plans
• Request full account deletion at any time by emailing privacy@sendbound.com

Backups are retained for 30 days. Deleted data is removed from backups within that window. We will certify deletion in writing upon request.

9. Security Measures (Art. 32)

Sendbound implements technical and organisational measures appropriate to the risk, as required by GDPR Article 32. These include:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Pseudonymisation of analytics data
• Continuous monitoring and threat detection
• Annual penetration testing by an independent third party
• SOC 2 Type II certification
• Role-based access control and least-privilege principles
• Business continuity and disaster recovery planning

Full details are on our Security page.

10. Breach Notification

In the event of a personal data breach, Sendbound will notify you without undue delay and within 72 hours of becoming aware of the breach, as required by our DPA and GDPR Article 33.

Our notification will include the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed. We will cooperate fully with your investigation and any regulatory notifications you need to make.

You are responsible for notifying the relevant supervisory authority and, where required, affected data subjects. Sendbound will provide all reasonable assistance to help you do so within the required timeframes.

11. Data Protection Officer

Sendbound has appointed a Data Protection Officer (DPO) responsible for overseeing our GDPR compliance programme. You can contact our DPO at:

• Email: dpo@sendbound.com
• Mail: Sendbound, Inc., Attn: Data Protection Officer, 123 Market Street, San Francisco, CA 94105

Sendbound also maintains an EU Representative as required by GDPR Article 27, reachable at eu-rep@sendbound.com.

12. Supervisory Authority

If you believe Sendbound has not handled personal data in accordance with the GDPR, you have the right to lodge a complaint with the relevant supervisory authority in your EU member state (or the ICO in the UK). We encourage you to contact us first so we can resolve any concerns directly.

A list of EU data protection authorities is available at edpb.europa.eu. The UK ICO can be contacted at ico.org.uk.

13. Contact

For all GDPR-related enquiries, DPA requests, or data subject rights assistance:

• General privacy: privacy@sendbound.com
• DPO: dpo@sendbound.com
• EU Representative: eu-rep@sendbound.com
• Security incidents: security@sendbound.com