Email Marketing

GDPR-Compliant Privacy Notice for Websites with Email Marketing

Information: This Model Notice is for businesses that send newsletters or promotional emails. It specifically addresses the collection of personal data for marketing purposes, highlighting the need for explicit consent and a clear opt-out mechanism. This policy is designed to be used in conjunction with a Consent Management Platform (CMP) - see our note at the end of this page.

Last Updated: September 28, 2025

1. Summary: Core Principles

We process personal data on this website for email marketing purposes. We will only send you marketing communications if you have actively and explicitly given us your consent to do so. You have the right to withdraw this consent at any time, which you can do easily by unsubscribing from our mailing list.

2. Types of Personal Data We Collect

When you subscribe to our newsletter or other mailing lists, we collect and process the following personal data:

• Contact Data: Your email address and name.

• Consent Records: The time, date, and method of your consent.

• Usage Data: Information about how you interact with our emails, such as open rates and click-through rates.

3. Purposes and Legal Basis for Processing

We process your personal data for the following purposes:

• To send you our newsletters, updates, and promotional content about our products and services. The legal basis for this processing is your explicit consent.

• To manage and track our email marketing campaigns to improve their effectiveness and relevance. The legal basis for this is our legitimate interest in understanding and optimizing our marketing efforts.

The provision of your email address is a requirement for us to send you our marketing communications.

4. Consent and Your Right to Opt-Out

By providing your email address and ticking the consent box (or another clear affirmative action), you give us your explicit consent to use your email address for the purposes of sending you marketing communications.

You have the right to withdraw your consent at any time. You can easily exercise this right by clicking the "unsubscribe" link located at the bottom of every email we send you. Once you have unsubscribed, we will stop sending you marketing emails.

5. Recipients of Your Personal Data

We may share your personal data with a third-party service provider that manages our email marketing campaigns on our behalf. These providers act as data processors and are bound by contractual obligations to keep your data secure and to only process it according to our instructions.

If we transfer your data to a country outside of the EU/EEA, we will ensure it is done using appropriate data protection safeguards, such as Standard Contractual Clauses (SCCs), to guarantee an adequate level of data protection.

6. Data Retention

We will retain your personal data for email marketing purposes for as long as you remain a subscriber to our email list. If you unsubscribe, we will remove your personal data from our active marketing list within a reasonable period, unless there is a legal requirement for us to retain it.

7. Your Rights

Under the GDPR, you have the right to:

• Access your personal data.

• Rectify inaccurate data.

• Erase your data (the "right to be forgotten").

• Restrict or object to processing.

We do not use any automated decision-making, including profiling, that produces a legal or similarly significant effect on you. To exercise these rights, please contact us using the details provided below.

8. Changes and updates to this policy

This GDPR-compliant Model Privacy Policy Notice is regularly reviewed. Only the latest version, which is currently applicable, is published on the SME Privacy website (www.smeprivacy.org).

9. Contact Information and Supervisory Authority

For any questions or concerns regarding this Notice or our data processing activities, you can contact us at the email address provided in our Data Protection Clause. You also have the right to lodge a complaint with a Data Protection Authority. A list of European Data Protection Authorities can be found on the European Data Protection Board's website (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en).

—

SME Privacy’s Recommended Data Protection Clause to be Embedded on your Website:

"Data Protection: we use a Privacy Policy for Websites with Email Marketing developed by SME Privacy. You can read it at https://www.smeprivacy.org/notice/email-marketing. This policy, along with the details below, explains how we process your personal data.

Specifics of Processing: We collect and process your email address for the purpose of sending you newsletters and marketing updates. Our legal basis is your consent. We use [Email Service Provider, e.g., MailChimp] as our third-party email service provider.

Data Retention: We will retain your data for as long as you are subscribed to our mailing list. If you unsubscribe, your data will be deleted within a reasonable time, in accordance with our data retention policy.

Controller: For all enquiries regarding your personal data, please contact [FULL NAME (sole proprietor) or COMPANY NAME (registered company)] at [EMAIL ADDRESS]."

Optional Clauses to be Included as Applicable:

• EU Representative: If you are based outside of the EU/EEA, please also mention the identity and contact details of the controller's EU Representative.

• Data Protection Officer: Where applicable, please also mention the identity and contact details of the controller's Data Protection Officer.

—

Note: A Word on Consent Management

For websites that use analytics, advertising, or social media plugins, having a privacy notice alone isn't enough. The GDPR requires you to prove you have a user's explicit consent before processing their data for these purposes. This is where a Consent Management Platform (CMP) comes in. A CMP is a tool that allows you to easily display a cookie banner, collect valid consent, and give users a simple way to change their mind at any time. We highly recommend implementing a reputable CMP to ensure you are fully compliant and to protect your business.