Email marketing & the GDPR.

When may you email someone?

There are two valid legal bases. The first is consent: someone has unambiguously signed up for your emails, through a form for instance, and a pre-ticked box does not count. The second is an existing customer relationship: you may email your own customers about similar products or services, provided you said so at the point of purchase and unsubscribing is always possible. In both cases you have to be able to demonstrate where and when someone joined your list.

Xendy automatically records the date, time and source of every sign-up, and supports double opt-in, a confirmation email before someone is definitively on the list, which is the strongest form of demonstrable consent.

Unsubscribing: one click, sorted straight away

Every email from Xendy carries a mandatory unsubscribe link, plus the technical List-Unsubscribe headers that let Gmail and Outlook show their own unsubscribe button. If someone unsubscribes, that is processed immediately: the contact automatically drops out of all lists, segments and running automations. That is logged too, so you can always demonstrate that you respected an opt-out.

Processing agreement & data storage

As soon as you have someone else process personal data, and you do that with any email marketing software, the GDPR requires a data processing agreement. At Xendy it comes as standard with the terms and conditions; you do not have to arrange it separately or pay extra for it. All data sits on servers in the Netherlands and Germany, inside the EU, and you can export your data or have it deleted at any moment.

One important boundary: which data you collect and on what legal basis is something you determine and document yourself as the data controller, in your own privacy statement for example. Xendy gives you the right tools for that; if you are unsure about your situation, ask your question during a demo or onboarding.