GDPR Compliance

Overview of GDPR features in Mailnaptic

GDPR Compliance

The General Data Protection Regulation (GDPR) applies to any organization that processes personal data of individuals in the European Union, regardless of where the organization is based. Mailnaptic provides a comprehensive set of tools and features to help you meet your GDPR obligations as a data controller.

Lawful Basis for Processing

Under GDPR, you need a lawful basis to send marketing emails to EU contacts. The two most common bases for email marketing are:

• Consent: The contact has given clear, affirmative consent to receive emails. Mailnaptic's double opt-in system provides strong evidence of consent.
• Legitimate interest: You have a legitimate business reason to contact the person, and their rights don't override your interest. This basis requires a documented assessment.

Mailnaptic tracks consent timestamps and sources for every contact, giving you a clear audit trail that demonstrates when and how consent was obtained.

Key GDPR Features in Mailnaptic

• Consent tracking: Every contact record includes consent metadata — when consent was given, what method was used (form submission, API, import), and which specific processing purposes were agreed to.
• Right to access (DSAR): Export all data associated with a contact using the data subject access request feature. This generates a comprehensive file containing all stored personal data, email activity, and preference history.
• Right to erasure: The hard delete feature permanently removes all personal data for a contact, including tags, list memberships, site events, frequency cap records, and the contact record itself.
• Data Processing Agreement: Accept Mailnaptic's DPA directly from your organization settings to formalize the data processing relationship.
• Consent per message type: Enable strict consent mode to require explicit consent for each message type (marketing, transactional, etc.) separately, as required under GDPR and CASL.

Data Minimization

GDPR requires that you only collect and store personal data that is necessary for your stated purpose. Review your custom fields and contact data regularly to ensure you're not storing information you don't need. Mailnaptic does not automatically collect any data beyond what you explicitly configure.

Data Retention

Consider implementing a data retention policy. You can create segments that identify inactive contacts beyond a certain age and use those segments to trigger cleanup workflows. Mailnaptic's engagement filters make it easy to find contacts who haven't interacted with your emails in a specified period.

Breach Notification

If you become aware of a data breach involving personal data processed through Mailnaptic, GDPR requires notification to your supervisory authority within 72 hours, and to affected individuals if there is a high risk to their rights. Mailnaptic's audit logs help you investigate the scope and timeline of any security incidents.