GDPR at Spreeflo

There is no official GDPR certification, so no vendor can hold one — GDPR is a regulation, not a certificate. What Spreeflo can point to is concrete: a Data Processing Agreement in force for every customer that meets Article 28, the EU Standard Contractual Clauses and the UK International Data Transfer Addendum built into it, a published sub-processor list with 30 days’ notice of changes, and documented security measures that form part of the contract rather than sitting on a marketing page.

No. The DPA is incorporated into the Terms of Service and takes effect automatically when you accept the Agreement or use the Services, on every plan including Free. No signature is required for it to bind. If your internal procedures need a countersigned copy for your records, email privacy@spreeflo.com and we will provide an executed version — it does not change the terms.

Spreeflo Ltd is established in the United Kingdom, and customer personal data is stored and processed in the United States. Transfers from the EEA to the UK rely on the European Commission’s adequacy decision for the United Kingdom, adopted on 19 December 2025. Spreeflo does not currently offer an EEA storage region.

They are already in place. Accepting the Agreement has the same effect as signing the EU SCCs and the UK Addendum, so no separate signature is needed. Onward transfers to providers outside the UK and EEA are covered by the EU SCCs together with the UK Addendum, and by the EU-US Data Privacy Framework where the provider is certified under it.

Amazon Web Services for hosting, database storage and backups, and for outbound email delivery through Amazon SES. Cloudflare, which proxies the branded link domains used in your email and briefly processes a recipient’s IP address when a link is clicked. Fireworks.ai for the in-app AI assistant. Stripe handles billing and payment data, in respect of which Spreeflo is a controller — it does not process the contact data you store in Spreeflo and is not a sub-processor under the DPA.

Yes — at least 30 days before a new sub-processor begins processing customer personal data. We update the sub-processor page and email subscribers to the change notification list, which anyone can join from that page without a Spreeflo account. If you object on reasonable data protection grounds within the notice period, we discuss it in good faith, and if it cannot be resolved you may terminate the affected Services with a pro-rata refund of prepaid fees.

No. AI features are optional, and with them disabled no customer data reaches any AI provider. The in-app AI assistant runs on Fireworks.ai, which is contractually prohibited from using your data to train or fine-tune any model and does not retain prompts or outputs beyond the request. Personalised message generation runs on an API key you supply, so that request goes to your provider under your own agreement with them.

The AI Act’s transparency obligations carry no certification scheme, so no vendor can hold a certificate for them and Spreeflo does not claim one. What Spreeflo can point to: the in-app assistant is labelled as an AI assistant wherever it appears and is never presented as a person; it stages its work as proposals that someone in your workspace approves before anything is created, changed or sent; every asset it creates is on the application audit trail; and AI features are optional, with no customer data used to train or fine-tune any model. Where you use AI to generate content and then send it, you are the deployer of that content and responsible for the disclosures your own use requires.

You can export customer personal data through the Services at any time during the term and for 30 days after termination. After that, Spreeflo deletes it from live production systems within 30 days, and from encrypted backups within 90 days in line with the backup rotation cycle. Data still held in backups stays subject to the confidentiality and security obligations until it is deleted.

Spreeflo gives you the tooling to do it yourself: access, export, rectify, restrict, delete and suppress contact data from the dashboard and the API. Use that in the first instance. Where more is needed, we assist you insofar as possible, and if a data subject contacts us directly about your data we point them to you and tell you without undue delay.

Yes. In the first instance we make available our current security documentation, the DPA, our Article 30(2) record of processing activities and any third-party audit reports or certifications we hold. Where that is not enough to demonstrate compliance, you may request an audit — once in any twelve-month period, on 30 days’ written notice, during normal business hours, subject to the conditions in Clause 11.

Spreeflo notifies you without undue delay after becoming aware of a personal data breach affecting your customer personal data, with the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken and a contact point. Where the full picture is not available at once, it comes in phases. We also assist with your own obligations under Articles 33 and 34.