What does GDPR require for email marketing specifically?
Three obligations dominate: (1) a lawful basis for processing personal data — for marketing email, that's almost always consent (Article 6(1)(a)); (2) demonstrable consent — you must be able to prove WHEN and HOW each subscriber opted in; (3) the right to withdraw consent — one-click unsubscribe in every email + a preference center. Data minimization (Article 5) and breach notification (Article 33) sit alongside these.
Is double opt-in required by GDPR?
Not explicitly required by GDPR text, but practically essential for proving consent and avoiding regulator scrutiny. Several EU member states (Germany via UWG, Austria) interpret consent strictly enough that single opt-in carries real risk. Best practice for any EU-targeted send: double opt-in for new subscribers + timestamp + source URL stored alongside the contact.
Where can I store EU subscribers' data?
GDPR (Article 44+) restricts personal data transfers outside the EEA unless protected by SCCs (Standard Contractual Clauses) or operator-to-operator agreements. Self-hosting on an EU-region server (Hetzner Germany, OVH France, Scaleway Paris) removes the cross-border transfer question entirely — the data never leaves the EU. SaaS vendors typically offer EU data residency as a paid upgrade. AcelleMail self-hosted in eu-central-1 (AWS) or any EU VPS satisfies this with no extra paperwork.
What is a DPA and do I need one?
A Data Processing Agreement (DPA) is a contract between the data controller (you) and any processor that touches personal data on your behalf. Required by GDPR Article 28 for every processor in the chain. With self-hosted AcelleMail, your processors are: (1) your VPS provider (Hetzner, DigitalOcean, AWS), (2) your sending relay (Amazon SES, SendGrid, Mailgun), (3) any analytics tool. Sign DPAs with each. With SaaS, the ESP itself is also a processor — you sign their DPA.
How long can I keep subscriber data?
GDPR Article 5(1)(e) says only as long as necessary for the purpose. Practically: keep active subscribers as long as the relationship is active; delete or anonymize after a defined inactivity period (typically 24–36 months from last engagement). Document the retention policy in your privacy notice + apply it via a scheduled job. AcelleMail supports automatic suppression and deletion via segment + automation triggers.
Do I need to disclose every email tool I use in my privacy notice?
Yes — Article 13(1)(e) requires you to disclose the recipients (processors) of personal data. List every tool that touches subscriber data: ESP, sending relay, analytics, CRM. Some teams group these under generic categories ("infrastructure providers"); strict-interpretation member states want named processors. When in doubt, name them.
What about ePrivacy / PECR for tracking pixels?
In addition to GDPR, the ePrivacy Directive (UK PECR, EU equivalent) regulates cookies and tracking technologies — including open-tracking pixels. Most regulators treat open-tracking as low-risk if consent for marketing was obtained, but the UK ICO and Germany have flagged aggressive click-tracking as needing separate consent. Plan: disclose pixel use in your privacy notice, allow recipients to opt out of tracking (preference center), and minimize click-tracking on transactional emails.
What's the difference between unsubscribe and erasure under GDPR?
Unsubscribe = end of marketing consent (Article 7(3) — right to withdraw). The contact moves to a suppression list (you keep the email hash to prevent re-mailing). Erasure (Article 17, "right to be forgotten") = delete ALL personal data including the suppression entry. AcelleMail separates these: an unsubscribe sets the subscriber state, a full-erasure GDPR request deletes the row entirely + propagates to your suppression mirror.
