Skip to content

GDPR Compliance

Last updated: 10 October 2026

Two roles

SplashSend is operated by a company registered in England and Wales and is subject to the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. For customers, and the people on their lists, in the European Union, the EU GDPR also applies. Under both there are two roles in every email you send through us:

  • You are the controller of your list. You decide who is on it, why they are on it and what they receive, and you owe them a privacy notice and their rights.
  • We are your processor. We hold and use their details only to do what you tell the product to do, under our Data Processing Agreement. For the details we hold about you as our customer, we are the controller, and our Privacy Policy covers that.

This page explains what the product does to help you meet your side, and what it does not do for you.

Consent, and the records we keep

For marketing email in the UK and EU the usual lawful basis is consent, and the record of it is what protects you. When someone joins through a SplashSend form we record when they joined, how, and the address the sign-up came from. Through the API we record the same, with the address of the system that sent them, and through a Shopify sync we record the time Shopify gives for their consent and that it came from your store. Every later change of status is written to a log that is kept even after they unsubscribe, because the unsubscribe is itself the record that matters. Confirm by email first (double opt-in) is a switch on every form, off by default: turn it on and nobody is subscribed until they click the link we email them. Someone you add by hand or import from a file has a record that says exactly that, and no consent evidence beyond it; holding that evidence is yours to do.

The rights, and how each is served

  • Access. Everything we hold about a person is on their page in People, and you can export it.
  • Rectification. You edit a person's details in People. A person on your list can change what they receive in the preference centre linked from every email; to change their name or address they ask you.
  • Erasure. Delete a person from People, or close your account, and their record goes. Their form answers stay, without their name or email address, so delete those in Collect → Answers first if they should go too. Where a connected Shopify store sends a deletion request we anonymise the person and keep only the order records the store is required to hold, without the person's details.
  • Portability. Each person's record exports as a structured file that includes their consent history and engagement, and your whole list exports as a spreadsheet.
  • Objection and withdrawal. Every marketing email carries an unsubscribe link and the one-click headers email apps use; both take effect the moment they are used, and the preference centre lets a reader narrow what they receive instead.
  • Restriction. Unsubscribing stops all sending to a person while their record and history stay, which is what most requests want. For a wider restriction, suppress or delete the person, or ask us.

Requests that reach us directly about someone on your list are passed to you within five working days, and we help you answer within the month the law gives you.

What you still have to do

  • tell the people on your list what you do with their details, in your own privacy notice, including that SplashSend processes them for you;
  • only email people you have a lawful basis to email, and never a bought, rented or scraped list;
  • keep the consent evidence for anyone you added by hand or imported;
  • answer their requests within a month, using the tools above;
  • if you install our tracking script on your website, cover it in your own cookie notice. On a Shopify store it follows the store's cookie banner by itself; on any other site, choose “Wait for my cookie banner” when you copy it, so it waits until your visitor agrees.

Data we process for you

  • email address, name and postal address, and the details you add;
  • consent records and the subscription history;
  • engagement: opens, clicks, bounces, complaints;
  • the products someone views on your website, if you use our tracking script;
  • form answers;
  • where Shopify is connected: purchase history, abandoned checkouts, tags, language and the product catalogue, for segmentation, personalisation and attribution, and, if the store provides them, phone numbers and texting consent held for a future SMS feature.

Where it is, who touches it, how long it stays

The application and database are in the EU; the providers we use, what each processes and where, are listed in the DPA, including the AI provider that the writing and design features use. Retention periods, including what happens to a closed or dormant account, are in the Privacy Policy.

If something goes wrong

If we have a breach affecting your data we tell you without undue delay and within 72 hours, with what you need to decide whether to notify the ICO and the people affected.

Contact

Questions, or a request about your own account: hello@splashsend.com. If you are on a customer's list, the sender is the right first contact; write to us if you cannot reach them and we will help. You can complain to the Information Commissioner's Office at ico.org.uk.