GDPR Compliance

Last updated: July 4, 2026

TriSend is committed to protecting the privacy and rights of individuals in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). This page explains our role, the data we process, and how we fulfill our obligations under GDPR.

1. Our Role

Under GDPR, the merchant (you) is the data controller — you determine the purposes and means of processing your customers' personal data. TriSend acts as a data processor, processing personal data on your behalf to deliver marketing services.

This means you are responsible for ensuring you have a lawful basis (e.g., consent, legitimate interest) for collecting and processing your customers' data. TriSend processes this data strictly according to your instructions through the App.

2. Data Processing Agreement

By using TriSend, a Data Processing Agreement (DPA) is established between you (controller) and TriSend (processor) in accordance with Article 28 of the GDPR. Key provisions include:

We process personal data only on your documented instructions.
We ensure that persons authorized to process data are bound by confidentiality obligations.
We implement appropriate technical and organizational security measures.
We assist you in responding to data subject requests.
We delete or return all personal data upon termination of service.
We make available all information necessary to demonstrate compliance.

3. Lawful Basis for Processing

As the data controller, you must ensure an appropriate lawful basis exists for processing. Common bases for marketing communications include:

Lawful Basis	When Applicable
Consent (Art. 6(1)(a))	Customer explicitly opts in to receive marketing emails, SMS, or WhatsApp messages.
Legitimate Interest (Art. 6(1)(f))	Existing customers who may reasonably expect to receive related product marketing.
Contract (Art. 6(1)(b))	Transactional messages related to an existing order or service.

4. Personal Data We Process

On behalf of merchants, TriSend processes the following categories of personal data:

Category	Data Types	Purpose
Contact data	Name, email, phone number	Sending marketing messages, audience segmentation
Order data	Order history, revenue, products purchased	Revenue attribution, product recommendations
Engagement data	Opens, clicks, conversions	Campaign analytics, automation triggers
Consent records	Opt-in timestamps, consent source, channel preferences	Compliance tracking, preference management

5. Data Subject Rights

Under GDPR, data subjects (your customers) have the following rights. TriSend assists you in fulfilling these rights through Shopify's mandatory webhooks and in-app tools:

Right of Access (Art. 15): Customers can request a copy of their personal data. TriSend compiles and exports all stored data via the customers/data_request webhook.
Right to Rectification (Art. 16): Customers can request correction of inaccurate data. Contact data syncs from Shopify and can be updated there.
Right to Erasure (Art. 17): Customers can request deletion of their data. TriSend processes erasure via the customers/redact webhook, removing all personal data associated with the customer.
Right to Restriction (Art. 18): Customers can request restricted processing. Merchants can mark contacts as suppressed in TriSend.
Right to Data Portability (Art. 20): Customers can request their data in a machine-readable format. TriSend provides data export in JSON/CSV format.
Right to Object (Art. 21): Customers can object to direct marketing. Every marketing message includes an unsubscribe mechanism.

6. Shopify Mandatory Webhooks

TriSend fully implements all three of Shopify's mandatory GDPR compliance webhooks:

customers/data_request

When a customer requests their stored data, Shopify sends this webhook. TriSend compiles all personal data associated with the customer (contact info, engagement history, consent records) and makes it available for export.

customers/redact

When a customer requests deletion of their data, Shopify sends this webhook. TriSend permanently deletes all personal data associated with the customer, including contact records, engagement history, and consent records. Anonymized aggregate analytics data may be retained.

shop/redact

When a merchant uninstalls TriSend, Shopify sends this webhook 48 hours after uninstallation. TriSend deletes all shop data, customer records, campaigns, templates, automations, and analytics within 30 days of receiving this webhook.

7. Data Storage & Transfers

TriSend stores data on infrastructure located in the European Union:

Primary database (PostgreSQL): Hosted on Hetzner servers in Germany (EU).
Analytics database (ClickHouse Cloud): EU region.
Email delivery (AWS SES): Messages are transmitted via AWS infrastructure. AWS maintains GDPR compliance through their Data Processing Addendum.
SMS delivery (Twilio): Twilio maintains GDPR compliance through their Data Processing Addendum and Binding Corporate Rules.

Where data is transferred outside the EU (e.g., via AWS or Twilio for message delivery), appropriate safeguards are in place including Standard Contractual Clauses (SCCs) and the providers' GDPR compliance certifications.

8. Security Measures

TriSend implements technical and organizational measures to protect personal data, including:

Encryption in transit (TLS 1.2+ for all connections).
Encryption at rest for database backups.
Access controls with role-based permissions.
Regular security updates and patch management.
Automated daily database backups with 30-day retention.
Container-based isolation for application services.
Health monitoring and automated alerting.

9. Data Retention

Active accounts: Data is retained while the App is installed and in use.
Campaign analytics: Retained for 24 months for reporting, then automatically purged.
After uninstallation: All data deleted within 30 days via the shop/redact webhook.
Customer erasure requests: Processed within 30 days of receiving the customers/redact webhook.

10. Data Breach Notification

In the event of a personal data breach, TriSend will notify affected merchants without undue delay and no later than 72 hours after becoming aware of the breach, in accordance with Article 33 of the GDPR. The notification will include the nature of the breach, categories of data affected, and measures taken to address the breach.

11. Contact Our Data Protection Team

For GDPR-related inquiries, data subject access requests, or to exercise any of your rights, contact us at privacy@trisend.app.

For general questions about our data practices, see our Privacy Policy.