GDPR compliance
Last updated: October 9, 2026
Roles & responsibilities
For message and audience data, you are the controller and MailOps acts as processor, handling data only on your documented instructions. For operator account data, MailOps is the controller.
A Data Processing Agreement (DPA) incorporating the EU Standard Contractual Clauses is part of every subscription.
Data subject rights
We support the full set of GDPR rights. Requests about recipients in your audience can be handled self-service from the Contacts page (rectify, suppress); machine-readable exports run through the API. For anything else, use the request form below or write to privacy@mailops.eu — the DPO responds within 30 days.
Access & portability — machine-readable export of all data held. Rectification — correct inaccurate data. Erasure — delete data and add the address to the suppression list. Restriction & objection — halt processing while a request is reviewed.
Data subject request
Submit a request on behalf of a data subject, or email privacy@mailops.eu directly.
Transfers, subprocessors & DPO
Account data is hosted in the EU region stated in your service agreement; onward transfers rely on EU Standard Contractual Clauses. Subprocessors: the delivery vendors you connect (SendGrid, AWS SES/SNS, Scaleway TEM, Twilio, and others), the LLM provider for redacted bounce metadata only (DeepSeek by default, Anthropic where enabled), and Stripe for billing. The current list is maintained on this page.
Data Protection Officer: dpo@mailops.eu · Supervisory authority complaints may be lodged with your local EU authority.