GDPR Compliance

Your data, your rights

SplashSend is fully compliant with the General Data Protection Regulation (EU) 2016/679. We take your privacy seriously and provide transparent, easy-to-understand information about how we handle personal data.

What is the GDPR?

The General Data Protection Regulation (GDPR) is a European Union regulation that protects the personal data and privacy of individuals in the EU and EEA. It gives you control over how your personal information is collected, used, and stored.

Your rights under the GDPR

As a data subject, you have the following rights. SplashSend provides the tools and processes to fulfil every one of them.

Right to Access (Article 15)

You have the right to know what personal data we hold about you and how it is being used. You can request a copy of your data at any time.

Right to Rectification (Article 16)

If any of your personal data is inaccurate or incomplete, you have the right to have it corrected. You can update your details through our preference centre or by contacting us.

Right to Erasure (Article 17)

Also known as the “right to be forgotten,” you can request that we permanently delete all of your personal data. When we delete your data, it is removed completely — including email history, preferences, and any associated records.

Right to Data Portability (Article 20)

You can request a machine-readable copy of all your personal data. We provide this as a structured JSON file that you can take to any other service.

Right to Object (Article 21)

You can object to the processing of your personal data at any time. Every email we send includes a one-click unsubscribe link, and you can manage your email preferences through our preference centre.

Right to Restrict Processing (Article 18)

You can request that we stop processing your data while a concern is being resolved. Unsubscribing immediately stops all email processing for your contact record.

How we collect data

We only process personal data when there is a lawful basis to do so. For marketing emails, the lawful basis is consent (Article 6(1)(a)). We record when and how consent was obtained for every contact.

Data we process

• Email address and name
• Subscription preferences
• Email engagement data (opens and clicks)
• Consent timestamp and method
• Where Shopify is connected: customer purchase history and product catalogue data, used solely for segmentation, personalisation, and revenue attribution

Data retention

We retain your personal data for as long as your account is active or as needed to provide our services. You can request deletion at any time, and all data is permanently removed within 30 days of account closure.

Sub-processors

We use a small number of trusted third-party services to deliver our product. Each has appropriate data protection agreements in place. For the full list, see our Data Processing Agreement.

Data breach notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

UK data protection

SplashSend is based in the UK, so we also follow the UK GDPR and the Data Protection Act 2018 — as updated by the Data (Use and Access) Act 2025. All of the rights above apply to people in the UK in the same way. And under UK marketing rules (PECR), we only send marketing emails to individuals who have given their consent — exactly the approach we take.

Contact us

If you have questions about how we handle your data, or if you’d like to exercise any of your rights, please contact us at hello@splashsend.com.