1

If I use MailChimp to send out newsletters and on my website I link to the registration form hosted on the MailChimp server, but don't embed it, do I need a MailChimp section in the privacy policy of my website to comply with the GDPR?

2

The question is who is the Data Controller, and who is the Processor.

  • If whatever MailChimp does is unrelated to you, then both you and MailChimp are Controllers. You are not responsible for MailChimp's compliance.

  • If MailChimp processes personal data on your behalf, you are the Controller and they are a Processor. Users do not have a direct legal relationship with the Processor. It is the Controller's obligation to ensure the Processor's compliance (e.g. by signing a data processing agreement) and to inform users.

Here, you clearly use MailChimp as a processor to handle newsletters on your behalf. How you implement this technically (embedding vs linking) is not relevant for the GDPR compliance aspect.

Also note that from the perspective of the user they would be signing up for your newsletter, not for a MailChimp account. A related but much more difficult example would be if you use a social media platform for sending your updates, e.g. a Facebook group or Medium page. There, the platform would be both Controller regarding the user accounts but might also be a Processor regarding your group or page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.