The General Data Protection Regulation took effect on May 25, 2018. Here’s what you need to know.
Disclaimer: The contents of this web page do not constitute legal advice. This page is for informational purposes only, and we strongly encourage you to seek independent legal counsel to understand how your organization needs to comply with the GDPR.
What’s the Main Takeaway?
ActiveCampaign customers can continue to confidently use our platform in the knowledge that we have rolled out a new Data Privacy Addendum (DPA) to the ActiveCampaign Terms of Service that takes the invalidation of the Privacy Shield framework by the Court of Justice for the European Union (CJEU) into account.
What Happened to Privacy Shield?
On July 16, 2020, Europe's highest court (the CJEU) invalidated the EU-US Privacy Shield as an appropriate mechanism for transferring EU personal data to the United States, which ActiveCampaign had previously been relying on.
Like all other companies impacted by this decision, we are monitoring the situation closely as the United States and European authorities work to negotiate a successor regime for transcontinental transfers and as European authorities consider practical guidance to companies previously relying on the Privacy Shield framework. We may update this page if additional guidance is offered. For the time being, ActiveCampaign will also continue to protect EEA, UK, and Swiss data in compliance with the Privacy Shield Principles to which it continues to self-certify compliance.
What Steps Has ActiveCampaign Taken?
Although the CJEU’s decision creates great uncertainty regarding the transfer of EU personal data through any data transfer mechanism to the United States, in an effort to provide customers with an alternative mechanism to transfer EU personal data to the United States, ActiveCampaign has updated its Data Processing Addendum (the "DPA") and has made available to customers the EU Standard Contractual Clauses (the "SCCs"), which were generally upheld by the CJEU, for execution. We have also included some "supplemental measures" to the SCCs following the guidance provided by the CJEU opinion.
How Can Customers Access the New Documents?
Customers can access and sign the updated DPA and SCCs by following the links within the Privacy settings of their ActiveCampaign accounts. If you executed a DPA with ActiveCampaign prior to the CJEU's decision, you can execute the new DPA which will supersede and replace the prior DPA, effective as of the date of execution, as noted in the DPA.
If your business is unaffected by the CEJU's determination, if you do not need a DPA, or, if you have an existing DPA with ActiveCampaign and wish to leave the terms of that agreement unmodified, then you do not need to take additional action.
Please note, if you are an ActiveCampaign reseller, affiliate, or agency partner, please contact ActiveCampaign support for a partner specific DPA.
UPDATE June 4, 2021: What are the New SCCs?
On June 4, 2021, the European Commission adopted a new set of SCCs for international data transfers (the "New SCCs"). The New SCCs will replace the existing SCCs (which were adopted under the GDPR's predecessor, the Data Protection Directive) and are intended to align with the new requirements in the GDPR and the CJEU's decision (as discussed above).
ActiveCampaign is closely reviewing the New SCCs and will offer them to our customers well within the prescribed transitional period. Customers who have already executed the existing SCCs with ActiveCampaign will have 18 months to migrate to the New SCCs and can continue to use the existing SCCs during this period. We will keep you apprised of any relevant developments by posting on our website.
Legal Disclaimer Language
ActiveCampaign's services are used by thousands of customers, in hundreds of industries all over the world, and we recognize that each customer's legal considerations will be unique. As a result, only your lawyer can provide tailored legal advice to you, and if you require special interpretation of these regulatory changes for your own business, we recommend that you consult with your legal counsel. Similarly, we are not in a position to know whether the new DPA and SCCs will meet your specific legal requirements, but we encourage you to discuss the form documents with your legal counsel. Please note that this page contains legal and regulatory information, but it is not legal advice.