Trisend is committed to protecting the privacy and rights of individuals in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). This page explains our role, the data we process, and how we fulfill our obligations under GDPR.
1. Our Role
Under GDPR, the merchant (you) is the data controller — you determine the purposes and means of processing your customers' personal data. Trisend acts as a data processor, processing personal data on your behalf to deliver marketing services.
This means you are responsible for ensuring you have a lawful basis (e.g., consent, legitimate interest) for collecting and processing your customers' data. Trisend processes this data strictly according to your instructions through the App.
2. Data Processing Agreement
By using Trisend, a Data Processing Agreement (DPA) is established between you (controller) and Trisend (processor) in accordance with Article 28 of the GDPR. Key provisions include:
- We process personal data only on your documented instructions.
- We ensure that persons authorized to process data are bound by confidentiality obligations.
- We implement appropriate technical and organizational security measures.
- We assist you in responding to data subject requests.
- We delete or return all personal data upon termination of service.
- We make available all information necessary to demonstrate compliance.
3. Lawful Basis for Processing
As the data controller, you must ensure an appropriate lawful basis exists for processing. Common bases for marketing communications include:
| Lawful Basis | When Applicable |
|---|---|
| Consent (Art. 6(1)(a)) | Customer explicitly opts in to receive marketing emails, SMS, or WhatsApp messages. |
| Legitimate Interest (Art. 6(1)(f)) | Existing customers who may reasonably expect to receive related product marketing. |
| Contract (Art. 6(1)(b)) | Transactional messages related to an existing order or service. |
4. Personal Data We Process
On behalf of merchants, Trisend processes the following categories of personal data:
| Category | Data Types | Purpose |
|---|---|---|
| Contact data | Name, email, phone number | Sending marketing messages, audience segmentation |
| Order data | Order history, revenue, products purchased | Revenue attribution, product recommendations |
| Engagement data | Opens, clicks, conversions | Campaign analytics, automation triggers |
| Consent records | Opt-in timestamps, consent source, channel preferences | Compliance tracking, preference management |
5. Data Subject Rights
Under GDPR, data subjects (your customers) have the following rights. Trisend assists you in fulfilling these rights through Shopify's mandatory webhooks and in-app tools:
- Right of Access (Art. 15): Customers can request a copy of their personal data. Trisend compiles and exports all stored data via the
customers/data_requestwebhook. - Right to Rectification (Art. 16): Customers can request correction of inaccurate data. Contact data syncs from Shopify and can be updated there.
- Right to Erasure (Art. 17): Customers can request deletion of their data. Trisend processes erasure via the
customers/redactwebhook, removing all personal data associated with the customer. - Right to Restriction (Art. 18): Customers can request restricted processing. Merchants can mark contacts as suppressed in Trisend.
- Right to Data Portability (Art. 20): Customers can request their data in a machine-readable format. Trisend provides data export in JSON/CSV format.
- Right to Object (Art. 21): Customers can object to direct marketing. Every marketing message includes an unsubscribe mechanism.
6. Shopify Mandatory Webhooks
Trisend fully implements all three of Shopify's mandatory GDPR compliance webhooks:
customers/data_request
When a customer requests their stored data, Shopify sends this webhook. Trisend compiles all personal data associated with the customer (contact info, engagement history, consent records) and makes it available for export.
customers/redact
When a customer requests deletion of their data, Shopify sends this webhook. Trisend permanently deletes all personal data associated with the customer, including contact records, engagement history, and consent records. Anonymized aggregate analytics data may be retained.
shop/redact
When a merchant uninstalls Trisend, Shopify sends this webhook 48 hours after uninstallation. Trisend deletes all shop data, customer records, campaigns, templates, automations, and analytics within 30 days of receiving this webhook.
7. Data Storage & Transfers
Trisend stores data on infrastructure located in the European Union:
- Primary database (PostgreSQL): Hosted on Hetzner servers in Helsinki, Finland (EU).
- Analytics database (ClickHouse): Self-hosted on the same EU servers.
- Email delivery (AWS SES): Messages are transmitted via AWS infrastructure. AWS maintains GDPR compliance through their Data Processing Addendum.
- SMS delivery (Twilio): Twilio maintains GDPR compliance through their Data Processing Addendum and Binding Corporate Rules.
Where data is transferred outside the EU (e.g., via AWS or Twilio for message delivery), appropriate safeguards are in place including Standard Contractual Clauses (SCCs) and the providers' GDPR compliance certifications.
8. Security Measures
Trisend implements technical and organizational measures to protect personal data, including:
- Encryption in transit (TLS 1.2+ for all connections).
- Encryption at rest for database backups.
- Access controls with role-based permissions.
- Regular security updates and patch management.
- Automated daily database backups with 30-day retention.
- Container-based isolation for application services.
- Health monitoring and automated alerting.
9. Data Retention
- Active accounts: Data is retained while the App is installed and in use.
- Campaign analytics: Retained for 24 months for reporting, then automatically purged.
- After uninstallation: All data deleted within 30 days via the
shop/redactwebhook. - Customer erasure requests: Processed within 30 days of receiving the
customers/redactwebhook.
10. Data Breach Notification
In the event of a personal data breach, Trisend will notify affected merchants without undue delay and no later than 72 hours after becoming aware of the breach, in accordance with Article 33 of the GDPR. The notification will include the nature of the breach, categories of data affected, and measures taken to address the breach.
11. Contact Our Data Protection Team
For GDPR-related inquiries, data subject access requests, or to exercise any of your rights, contact us at privacy@trisend.app.
Trisend, 6/A, Road-4, Plot-2, Mirpur, Dhaka-1216, Bangladesh. See also our Contact page.
For general questions about our data practices, see our Privacy Policy.