Digital Privacy
Digital privacy is an incredibly important topic for any company that operates online. This is why it is crucial to understand regulations surrounding the handling of individuals’ personal data, such as GDPR. This page covers all of the ways that Echobox stays up to date with GDPR and other regulations (such as CCPA and CNIL), as well as how we more generally protect the data privacy of your subscribers.
For full details on how we handle personal data and adhere to digital privacy laws, please refer to our full DPA.
What is GDPR?
GDPR is a set of rules in EU law surrounding data protection and online privacy in the EU and European Economic Area. It is in place to protect and ensure the privacy of individuals, as well as to hold organisations that handle personal data accountable for upholding those rights and treating people’s data with care.
While these regulations apply to individuals within the EU and EEA, they also affect any company that does business in Europe or handles the data of its citizens, regardless of where the company is based.
Other countries have their own laws and regulations for handling online data, such as the UK’s Data Protection Act 2018 (DPA). However, GDPR is widely considered to be the most stringent, which is why it is important to be familiar with these regulations.
Failure to comply with GDPR standards can result in expensive fines as well as reputational damage, so it is important to understand what responsibilities an organisation has surrounding this.
What are the main principles of GDPR?
If you process the data of EU citizens, you must do so according to seven protection and accountability principles outlined by GDPR.
- Lawfulness, fairness and transparency — Processing must be lawful, fair, and transparent to the data subject.
- Purpose limitation — You must process data for the legitimate purposes specified explicitly to the data subject when you collected it.
- Data minimization — You should collect and process only as much data as absolutely necessary for the purposes specified.
- Accuracy — You must keep personal data accurate and up to date.
- Storage limitation — You may only store personally identifying data for as long as necessary for the specified purpose.
- Integrity and confidentiality — Processing must be done in such a way as to ensure appropriate security, integrity, and confidentiality (e.g. by using encryption).
- Accountability — The data controller is responsible for being able to demonstrate GDPR compliance with all of these principles.
Below you will find some key information about the ways in which Echobox maintains these principles and adheres to data protection policies such as GDPR.
What subscriber data does Echobox store?
The only subscriber information we store for more than 30 days is the following:
- Email address
- Subscribed campaigns
- First and last names (optional)
- Any other first-party data fields an individual client has captured
We do not need to use IP addresses to confirm a subscription or a double opt-in.
Does Echobox gather any other data?
Echobox tracks your readers' engagement with your Campaigns, for example opens and clicks. To ensure compliance with GDPR, we ensure any such personally identifiable data is suitably pseudonymised beyond 30 days. This ensures we can still provide you with analytics data beyond 30 days in a way that is GDPR compliant.
Do you have to hold any (extra) data?
No. We store the previously mentioned data on our platform, and you do not need to hold any more than you currently do.
Should you use Double Opt-In?
Double Opt-In adds an additional step to an email subscription opt-in process. It requires a subscriber to verify their email address and confirm interest before they start receiving regular emails.
We have a setting to toggle double opt-in on or off, and we recommend that you use it. This ensures that you follow any regulations in a country that requires double opt-in, as well as that your subscribers come from real and monitored inboxes.
Does Echobox comply with ‘Right to be Forgotten’ requests?
We process all Right to be Forgotten requests that your subscribers make.
Our standard unsubscribe mechanism is completely GDPR compliant. When a specific Right to be Forgotten request is made, we will ensure any data about the subscriber (for example their original subscription/unsubscription requests) is removed from our databases. This can be done in the Unsubscribe box on the Campaign Dashboard screen.
It should be noted that we only recommend this course of action specifically for Right to be Forgotten requests. This is because when we delete all of a subscriber’s data, we also lose a record of when they unsubscribed, meaning there is a small possibility they could accidentally be re-added and sent more editions in future.
Does Echobox use Subprocessors?
We use subprocessors from an approved list, which can be found here. All subprocessors we work with conform to the same data handling principles that we do and are also subject to the same contractual obligations regarding this.
What is CNIL in France?
The CNIL (Commission Nationale de l'Informatique et des Libertés) is France's independent national data protection authority responsible for enforcing privacy laws and the GDPR. It regulates how personal data is collected, used, and protected across digital services, with the power to issue guidance, conduct audits, and levy fines for non-compliance.
Under CNIL rules, email newsletters sent to individuals (B2C) require prior opt-in consent via an unchecked box. Every email must clearly identify the sender and include a one-click unsubscribe link. Furthermore, CNIL requires prior consent for tracking pixels and click-tracking, treating them as terminal storage/access under ePrivacy laws rather than standard operational data.
If you're based in France and haven't yet sought prior opt-in consent from your subscribers for Echobox's tracking, you should contact Echobox Support (support@echobox.com) and ask that we suppress all email tracking.