Effective date: November 13, 2026
DISCLAIMER: This material is provided for your general information and is not intended to provide legal advice. To understand the full impact of the GDPR on any of your data processing activities please consult with an independent legal and/or privacy professional.
The General Data Protection Regulation (GDPR) was adopted by the European Union in April 2016 and has applied since May 25, 2018. It gives individuals greater control over the collection and use of their personal data. Sendloop is committed to ensuring our customers are able to comply with their requirements under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection (FADP).
Consent and Purpose
What is personal data?
Before digging into more details about the GDPR, let’s understand what personal data is:
“[personal data] means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;”
So, if you are storing data about a person in a usable way and it relates to an identifier (such as a device ID, cookie ID or email address), it is personal data.
The GDPR requires that personal data be processed lawfully, fairly, and in a transparent manner.
For all kinds of data covered by the definition above, you need to justify that you are processing the data lawfully. Consent is a big step towards GDPR compliance, however you need to collect data with explicit, purpose-based consent. This is the highest standard for data collection and use policies.
This means that there is no ambiguity as to the activities consented to or the organization carrying out those activities.
Consent should be clear and unique to the specific organization. It should clearly describe each reason for processing and storing. For each purpose, a separate subscribe form or unchecked consent check boxes are preferred options. No matter what kind of creative method you use to get consent from personal data owner, it is important to ensure that clarity is not lost in the process. The transparency for your reasons for processing data is a requirement for building explicit consent.
Don’t forget that the personal data must be collected for specified, explicit and legitimate purposes. It should be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
Lawful Data Processing
No matter which email marketing application you are using, you will likely rely on consent as the lawful basis for processing your subscribers’ personal data. While consent is not the only way to lawfully process personal data, at least one of the grounds for lawfully processing personal data must apply:
- the data subject has given consent to the processing of his or her personal data for one or more specific purposes
- processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
- processing is necessary for compliance with a legal obligation to which the controller is subject;
- processing is necessary in order to protect the vital interests of the data subject or of another natural person;
- processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
While it’s true that for most marketing activities, the industry tends to rely heavily on consent as the lawful ground for processing, it is up to you to analyze your data processing activities and choose the right justification(s). If you are unsure which of the lawful grounds listed in the GDPR apply to you, please consult with legal counsel to ensure processing activities are properly justified. As always, diligent record keeping is vital to support these justifications.
Security
The GDPR requires protection of personal data using “appropriate technical and organizational measures to ensure a level of security appropriate to the risk” throughout the life cycle of the data.
GDPR Recital 78 indicates that “In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default.”
The GDPR doesn’t require any specific security mechanisms, but rather requires that data controllers and processors take into “account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons” should data be subject to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access.
How Sendloop Meets the GDPR
- Controller and processor roles
For the contacts you upload to Sendloop, you are the controller and Sendloop, operated by 50SAAS LLC, is your processor. For our own website visitors and account holders, 50SAAS LLC is the controller, as described in our Privacy Policy. - Data Processing Agreement
Our Data Processing Agreement sets out how we process personal data on your behalf and only on your instructions. - Hosting and international transfers
Customer data is hosted in data centers in the United States and the European Union. Our staff in Turkey access customer data to provide support and operate the Service. Transfers out of the EEA, including to the United States and Turkey, are covered by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), incorporated by reference into the DPA, with the UK International Data Transfer Addendum for UK data and the Swiss FADP adaptation for Swiss data. - Subprocessors
A list of our subprocessors is available on request at legal@sendloop.com. We notify customers at least 30 days before we add or replace a subprocessor, and customers may object. - Data subject rights
The application lets you find, update, export and delete contact records and unsubscribe contacts, so you can respond when your contacts exercise their right of access, right of rectification, right to object, right to erasure and right to data portability. We assist you with requests you cannot handle yourself. - Security
We protect personal data with technical and organizational measures, including encryption in transit and at rest, access control, staff access limited to those who need it for their work, and logging of access. - Breach notification
We notify affected customers without undue delay after we become aware of a personal data breach, as set out in the DPA.
What do Sendloop Customers need to do?
Please take legal advice about the GDPR and make sure that all your data collection processes comply with the GDPR. Make sure that your Terms of Service and Privacy Policies communicate to your users how you are using Sendloop and any other similar services. The GDPR can heavily penalize you if you haven’t done this clearly.
For any questions, feel free to reach us via legal@sendloop.com. You can contact our Data Protection Officer at dpo@sendloop.com.