The UK GDPR and the EU GDPR protect people's personal details. If your business is in the UK or the EU, or the people on your list are, these laws cover the names, email addresses and other details you keep in SplashSend.

This is general guidance on how SplashSend helps, not legal advice.

Your part and SplashSend's

  • You're the controller. You decide who is on your list and what you send them, and people come to you with questions about their data.
  • SplashSend is your processor. We use their details only to do what you ask the product to do. Our Data Processing Agreement says so and is part of our Terms, so there's nothing to sign. It's linked at the bottom of every page of our website, along with our GDPR page.

Consent, and the record of it

For marketing email the lawful basis is usually consent, and your record of it is what protects you.

  • When someone joins through one of your forms, the API or your Shopify store, SplashSend records when and how they joined, and for forms the internet address they used. Later changes, such as an unsubscribe, stay in their history after they leave.
  • When you add someone by hand or import a file, you tick a box to confirm you have their permission, and SplashSend records that you did. Keep the evidence yourself, such as the sign-up sheet from your market stall.
  • Shopify customers who haven't agreed to email marketing in your store arrive as unsubscribed, so they aren't emailed.
  • With Confirm by email first turned on for a form in Collect, people only join after clicking the link in the email they're sent. See Making a form.
With Confirm by email first on, people join only after clicking the link they're emailed.
With Confirm by email first on, people join only after clicking the link they're emailed.

Keep a copy of your form's wording too, because the record doesn't include it.

When someone asks about their data

You have a month to answer. Find the person in People by typing their address into Search people…, and open them. Exporting and deleting people needs the account owner or an admin.

  • “What do you hold about me?” Click Actions and choose Export profile (GDPR). The file has their details and topics, their consent record and history for email and text messages, and the lists they're on. It also has the emails you've sent them, their drips, their orders and abandoned checkouts, their answers to your forms, and the events your website or the API recorded for them.
  • “Please correct my details.” Click the detail on their page and change it.
  • “Stop emailing me.” Click Unsubscribe on their page and confirm. It takes effect straight away.
  • “Delete my data.” Their form answers are kept apart from the person, so delete those first. Open Collect → Answers, search for their name, or for their email address if they have no name in SplashSend, and delete their answers. Once the person is deleted, their answers show as Anonymous. Then, on the person's page, click Actions, choose Delete person and click Delete.
  • “Stop using my data for now.” Click Actions and choose Stop all emails. Nothing is sent to them until you choose Allow emails again.
Most data requests start from the Actions menu on the person's page.
Most data requests start from the Actions menu on the person's page.

Deleting someone also deletes the record that says not to email them. If all they want is no more emails, unsubscribe them instead, because a later import or your Shopify store could add a deleted person back as someone new.

If a customer asks Shopify to delete their data, Shopify tells SplashSend and we anonymise them automatically. If someone on your list writes to us rather than to you, we pass it on to you within five working days.

What you still need to do

  • Have a privacy notice that says what you do with people's details, including that SplashSend processes them for you.
  • Only email people you have a lawful basis to email, and never a list you bought or copied from the web.
  • If you've added SplashSend's website tracking to your site, cover it in your cookie notice.

In the UK, marketing email is also covered by the Privacy and Electronic Communications Regulations (PECR). The Information Commissioner's Office explains them on its website, including when you can email existing customers.

Where the data is kept

SplashSend's application and database are in the EU. Our Privacy Policy lists every provider we use and where it is, including the AI provider in the US. Your list is never sent to it. The only details about your people it can see are ones you switch on for Cruise yourself, such as a data set of form answers. See also How long SplashSend keeps your data.