What’s the Main Takeaway?
ActiveCampaign customers can continue to confidently use our platform in the knowledge that we have rolled out a new Data Processing Addendum (the “DPA”) to the ActiveCampaign Terms of Service that takes the invalidation of the Privacy Shield framework by the Court of Justice for the European Union (the “CJEU”) into account.
In addition, ActiveCampaign’s DPA now uses the new Standard Contractual Clauses (the “New SCCs”). The New SCCs are approved for international data transfers by the European Commission under the GDPR.
[NEW] We are pleased to offer the new International Data Transfer Addendum issued by the UK Information Commissioner (the “UK Addendum”) to our customers who need it. Customers can access and sign ActiveCampaign’s DPA which incorporates the New SCCs and the UK Addendum by following the links within the settings of their ActiveCampaign accounts.
What Happened to Privacy Shield?
On July 16, 2020, Europe’s highest court, the CJEU, invalidated the EU-US Privacy Shield as an appropriate mechanism for transferring EU personal data to the United States, which ActiveCampaign had previously been relying on.
Like all other companies impacted by this decision, we are monitoring the situation closely as the United States and European authorities work to negotiate a successor regime for transcontinental transfers and as European authorities consider practical guidance to companies previously relying on the Privacy Shield framework. We may update this page if additional guidance is offered.For the time being, ActiveCampaign will also continue to protect EEA, UK, and Swiss data in compliance with the Privacy Shield Principles to which it continues to self-certify compliance.
What Steps Has ActiveCampaign Taken?
Although the CJEU’s decision creates great uncertainty regarding the transfer of EU personal data through any data transfer mechanism to the United States, in an effort to provide customers with an alternative mechanism to transfer EU personal data to the United States, ActiveCampaign has updated its Data Processing Addendum (the “DPA”) and has made available to customers the Standard Contractual Clauses (the “SCCs”), which were generally upheld by the CJEU, for execution. We have also included some “supplemental measures” to the SCCs following the guidance provided by the CJEU opinion.
What are the New SCCs?
On June 4, 2021, the European Commission adopted a new set of SCCs for international data transfers (the “New SCCs”). The New SCCs will replace the SCCs which were adopted under the GDPR’s predecessor, the Data Protection Directive (the “Old SCCs”) and are intended to align with the new requirements in the GDPR and the CJEU’s decision, as discussed above.
EU customers who have already executed the Old SCCs with ActiveCampaign will have 18 months to migrate to the New SCCs and can accordingly continue to use the Old SCCs until December 27, 2022.
What is the UK Addendum?
On March 21, 2022, the UK’s new International Data Transfer Addendum came into force (the “UK Addendum”). This document, issued by the UK Information Commissioner, is an additional data transfer mechanism that organizations can use to provide appropriate safeguards required under the UK GDPR for personal data when it is transferred from the UK to the United States. The UK Addendum is designed to be used in conjunction with the New SCCs approved by the European Commission (see above), in other words an “add-on” to the New SCCs.
Accordingly, if the UK Addendum is required, customers must execute both the UK Addendum and the New SCCs. UK customers who have already executed the Old SCCs with ActiveCampaign will have until March 21, 2024 to switch to the UK Addendum.
How Can Customers Access the New Documents?
Customers can access and sign the updated DPA and, as applicable, the New SCCs and the UK Addendum by following the links within the settings of their ActiveCampaign accounts.
If you executed a DPA with ActiveCampaign prior to the CJEU’s decision or the adoption of the New SCCs or the UK Addendum, you can execute the new DPA which will supersede and replace the prior DPA, effective as of the date of execution, as noted in the DPA.
If your business is unaffected by the CJEU’s determination, or if you do not need a DPA, the New SCCs or the UK Addendum, then you do not need to take additional action.
Please note, if you are an ActiveCampaign reseller, affiliate, or agency partner, please contact ActiveCampaign support for a partner specific DPA.
Legal Disclaimer Language
ActiveCampaign’s services are used by thousands of customers, in hundreds of industries all over the world, and we recognize that each customer’s legal considerations will be unique. As a result, only your lawyer can provide tailored legal advice to you, and if you require special interpretation of these regulatory changes for your own business, we recommend that you consult with your legal counsel. Similarly, we are not in a position to know whether the DPA, SCCs and UK Addendum will meet your specific legal requirements, but we encourage you to discuss the form documents with your legal counsel. Please note that this page contains legal and regulatory information, but it is not legal advice.