Privacy Policy

Last updated: September 26, 2026

EASYMAILING CLOUD SERVICES, S.L. (hereinafter, "EASYMAILING"), with registered office at Población de Campos, 2, 28050 Madrid (Spain) and tax ID number (NIF) B-01996396, informs users, through this Privacy Policy, about the processing of personal data collected in the course of its activities, in compliance with the GDPR (Regulation (EU) 2016/679) and Spanish Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

This Policy describes the categories of data processed, the purposes and legal bases for processing, the retention periods, the recipients of the information, any international transfers that may take place, and the rights available to data subjects.

1. Data Controller

Your personal data will be processed by:

• Company name: EASYMAILING CLOUD SERVICES, S.L. (hereinafter, "EASYMAILING")

• NIF: B-01996396

• Registered office: Población de Campos, 2, 28050 Madrid, Spain

• Website: https://easymailing.com

• Contact email: hola@easymailing.com

• Data protection contact: dpo@easymailing.com

2. Scope of Application

This Privacy Policy applies to all personal data processed by EASYMAILING in the context of:

• Use of our public website https://easymailing.com.

• Registration and use of the EASYMAILING email marketing platform (hereinafter, the "Platform").

• The voluntary connection of Google accounts (Gmail and Google Calendar) to the Platform, under the terms of section 10.

• The contracting of our services.

• Commercial and informational communications we send.

• Technical support and customer service.

This policy does not cover the processing of data that you, as an EASYMAILING customer, carry out through the Platform in relation to your own subscribers or recipients. In that case, EASYMAILING acts as data processor and you act as controller; that relationship is governed by our Terms and Conditions of Use (Clause Eleven — Data Protection).

3. Categories of Data We Process

Depending on your relationship with us, we may process the following categories of data:

3.1. Website Visitor Data

• Browsing data collected through cookies (see Cookie Policy).

• IP address, browser type, device, operating system, and pages visited.

• Data you voluntarily provide through contact forms, demo requests, or resource downloads.

3.2. Registered Customer Data

• Identification data: first and last name, company, job title.

• Contact data: email address, telephone, postal address, web domain.

• Account data: username, encrypted password, preferences (time zone, language, industry, currency).

• Billing data: company name, tax identification number (CIF/NIF), billing address, payment method. Bank card data is never stored by EASYMAILING; it is handled directly by our payment provider (Stripe) under the PCI-DSS standard.

• Usage data: aggregated Platform statistics, campaigns sent, templates used.

• Technical and security data: access IP, logs, audit records.

• Connected Google account data: if you voluntarily connect a Google account, the emails and meetings described in section 10, which may include data of third parties you communicate with.

3.3. Data We Do NOT Process

EASYMAILING does not voluntarily request or process special categories of data under Article 9 of the GDPR (health, religion, sexual orientation, biometric data, political opinions, trade union membership, etc.). We ask that you do not enter this type of data into the Platform or in communications with our team.

3.4. Source of Data

The data we process comes directly from you or from the third-party accounts you choose to connect to the Platform, such as your Google account (section 10). We do not acquire data from third parties or public sources for commercial purposes.

4. Purposes of Processing and Legal Bases

We process your data for the following purposes and on the following legal grounds:

5. Retention Periods

We retain your data for the minimum time necessary to fulfil the purposes for which it was collected:

Once these periods have elapsed, data is irreversibly deleted or anonymised.

6. Recipients of Your Data

6.1. Sub-processors

To provide our services, we engage technology providers who act as data processors (sub-processors) under a data processing agreement pursuant to Article 28 of the GDPR. These providers process data solely in accordance with our instructions and only to the extent strictly necessary to provide the services:

This list is updated when a sub-processor is added or replaced. Changes are published on this same page at least 30 calendar days before the effective date of the change. During that period, data subjects may object to the change by contacting dpo@easymailing.com.

6.2. Other Recipients

In addition to sub-processors, your data may be disclosed to:

• Public authorities where required by a legal obligation (Spanish Tax Agency (AEAT), Social Security, judicial authorities).

• Banking institutions for payment and invoicing management.

• Professional advisors (legal, tax, accounting) under a duty of confidentiality, when strictly necessary.

EASYMAILING does not sell, rent, or transfer your data to third parties for commercial purposes.

7. International Data Transfers

Most processing takes place within the European Economic Area (EEA). In some specific cases, certain sub-processors (Sentry, OpenAI, Stripe operational copies) may transfer data to the United States or the United Kingdom.

These international transfers are carried out with the following safeguards pursuant to Article 46 of the GDPR:

• Standard Contractual Clauses (SCCs) approved by the European Commission — Implementing Decision (EU) 2021/914 of June 4, 2021, Modules 2 (Controller-to-Processor) and 3 (Processor-to-Sub-Processor) as applicable.

• UK International Data Transfer Addendum (IDTA) for recipients in the United Kingdom.

• EU-US Data Privacy Framework (adequacy decision of July 10, 2023) where the provider is certified.

You may request a copy of these safeguards by writing to dpo@easymailing.com.

8. Data Subject Rights

Pursuant to Articles 15 to 22 of the GDPR and Articles 12 to 18 of the LOPDGDD, you have the right to:

• Access your personal data.

• Rectification of inaccurate or incomplete data.

• Erasure ("right to be forgotten") when data is no longer necessary.

• Restriction of processing in the legally provided circumstances.

• Object to processing, including objecting to commercial communications (which you may exercise at any time by clicking the "Unsubscribe" link in our emails).

• Data portability in a structured, commonly used, and machine-readable format.

• Not to be subject to automated individual decisions with significant legal effects.

• Withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

How to Exercise Your Rights

You may exercise any right by sending an email to dpo@easymailing.com stating:

• Your first and last name.

• The right you wish to exercise.

• Sufficient information to verify your identity (we may request a copy of your national ID or other document if necessary).

We will respond within a maximum period of one month, extendable by a further two months if the request is particularly complex.

Complaints to the Supervisory Authority

If you consider that the processing of your data infringes the GDPR or the LOPDGDD, or if you are not satisfied with the response received when exercising your rights, you may lodge a complaint with:

Agencia Española de Protección de Datos (AEPD) (Spanish Data Protection Agency)
C/ Jorge Juan, 6 — 28001 Madrid
Electronic office: https://sedeagpd.gob.es

9. Use of Artificial Intelligence (AI)

The EASYMAILING Platform incorporates features assisted by generative artificial intelligence models that help customers perform certain tasks within the service environment. These features are optional and may be used, among other things, for:

• Assistance in creating email marketing campaigns.

• Generation and optimisation of copy (subject lines, email bodies, calls to action, descriptions).

• Creation and suggestion of email templates.

• Configuration of automation workflows.

• Drafting and summarising results reports.

• Summarising emails synced from connected Google accounts, under the terms of section 10.5.

• Other auxiliary productivity tasks within the administration panel.

9.1. Provider

These features are provided through OpenAI Ireland Ltd. (and, where applicable, its affiliates), with whom EASYMAILING has signed a Data Processing Agreement (DPA) incorporating Standard Contractual Clauses (SCCs) 2021/914 (Modules 2 and 3) and the UK International Data Transfer Addendum.

9.2. Usage Principles

• Voluntary activation: AI features are always optional. Data is only transmitted to the provider when the customer performs an explicit action that requires it.

• Minimisation: only the information strictly necessary to perform the task requested by the customer is transmitted to the provider.

• No use for training: in accordance with the OpenAI API usage policies, data transmitted via the API is not used to train or improve the artificial intelligence models.

• Limited retention: the provider retains requests for a reduced maximum period, exclusively for abuse prevention and security purposes, after which they are deleted.

• Human oversight: AI-generated content is indicative in nature and must be reviewed and validated by the customer before use or sending. Final responsibility for published or sent content lies with the customer.

• No automated decisions with legal effects: AI features do not produce automated individual decisions that have significant legal effects on data subjects within the meaning of Article 22 of the GDPR.

9.3. Prohibition on Entering Sensitive Data in Requests

The customer undertakes not to enter or send, through the AI features, data falling within the special categories set out in Article 9 of the GDPR (health, religion, sexual orientation, biometric data, political opinions, trade union membership, etc.), as well as data from identification documents (national ID, passport, social security number), third-party financial data, or any other particularly sensitive information. Failure to comply with this obligation shall be the exclusive responsibility of the customer.

9.4. Information for End Recipients of Communications

If you are a recipient of communications sent through the EASYMAILING Platform by one of its customers, please note that:

• The data controller for your data is the sender of the communication, not EASYMAILING.

• To exercise your rights or resolve queries about the processing of your data, you must contact the sender directly, whose contact details appear in every commercial communication sent from the Platform.

• EASYMAILING acts in that context solely as data processor and, where legally required or authorised by the sender, will cooperate by providing the necessary information to the recipient.

10. Connected Google Accounts (Gmail and Google Calendar)

The Platform allows you to voluntarily connect a Google account to see, in the CRM module, the emails and meetings related to your contacts, companies and deals, and to send emails and create meetings from the Platform. This section describes how EASYMAILING accesses, uses, stores and shares Google data when you use this feature.

10.1. Voluntary Nature and Role of EASYMAILING

The connection is optional, initiated by you, and can be removed at any time. EASYMAILING only requests the permissions for the features you turn on: email, calendar, or both. We never request access to Google Drive or your Google contacts.

With regard to the data of individuals who appear in synced emails and meetings, EASYMAILING acts as a data processor on behalf of the customer holding the account on the Platform, who is the data controller, under the terms of Clause Eleven of the Terms and Conditions of Use.

10.2. Data We Access

Email (Gmail):

• Messages in your mailbox within the history period you choose, and those you send or receive afterwards: sender, recipients, date, subject, body, technical headers and identifiers.

• The name, type and size of attachments. Attachment content is not stored: it is retrieved from Google when an authorised person opens it.

• Drafts and messages that are in Spam or Trash at the time of synchronisation are not retrieved.

• For messages identified as advertising or bulk mailings, only the sender, date, identifiers and the reason for exclusion are kept, without subject or body.

• The Gmail send permission, to send the emails that you or your team initiate from the Platform.

Calendar (Google Calendar):

• The list of your calendars, so you can choose which ones to sync.

• From the chosen calendars: title, description, dates, time zone, location, video conference link, organiser, attendees and their responses, and recurrence data.

• The permission to create and modify the meetings you manage from the Platform.

10.3. Purposes

Google data is used exclusively to provide visible features of the Platform:

• Showing emails and meetings on contact, company and deal records and in their activity history.

• Creating or linking contacts and companies according to your account settings, for example from emails sent by your team or meetings it organises or accepts.

• Calculating the date of each contact's last email interaction.

• Generating email summaries using artificial intelligence, if your account has this feature enabled (section 10.5).

• Sending emails and creating meetings initiated by you or your team.

• Maintaining the operation, security and technical diagnostics of the service.

Google data is not added to email marketing audiences, is not used for advertising purposes, and is not sold or transferred to third parties.

10.4. Who Can Access It

• You, as the holder of the connected Google account, have access to all of its content.

• Other users of your account on the Platform can access your emails according to the visibility level of your connection. By default they see participants, date and subject, which you are informed of when connecting the account, and you can change it at any time to participants and date only, or to full content. You can also grant full access to specific people or teams, for the whole mailbox, for the emails of a record, or for a specific message, and revoke it whenever you wish. Anyone receiving such access cannot share it further. In any case, no one can access an email without also having access to the CRM record where it appears.

• Meetings follow the visibility level and permissions you set for each calendar.

• EASYMAILING staff do not access the content of your emails or meetings, unless you expressly authorise it for a specific message or item (for example, in a support case), where necessary for security reasons (investigating a bug or abuse), or where required by law.

10.5. Artificial Intelligence

If your account has AI summaries enabled, the body of an email is sent to OpenAI, through its API, solely to generate the summary you see, and only when the user requesting it has full access to that email. Attachments are not analysed. In accordance with section 9, OpenAI does not use data received through its API to train or improve its models and retains it for a maximum of 30 days for the sole purpose of preventing abuse. EASYMAILING does not use Google data to create, train or improve artificial intelligence models either.

10.6. Retention and Deletion

• While the connection is active, synced emails and meetings are kept on the Platform.

• If you permanently delete an email in Gmail or a meeting in Google Calendar, we delete its content from the Platform, unless another connected account in your organisation also holds it. The activity history only keeps a reference ("Email deleted" or "Meeting deleted") with the date and the related record, without access to the content. Moving an email to Spam or Trash does not remove it from the Platform; permanently deleting it does, including the automatic emptying of Trash.

• If you disable email or calendar without removing the connection, the content is kept hidden until you re-enable it.

• If you remove the connection, we delete the emails and meetings that came solely from that account. The activity history keeps a minimal reference ("Email unavailable" or "Meeting unavailable") with the date and the related record, without subject, content or participants. Contacts, companies, notes and tasks created on the Platform are kept.

• If your account administrator deactivates the user who holds the connection, they choose at that moment whether to keep or delete the synced emails and meetings. In both cases, EASYMAILING stops accessing the Google account.

• Deleted data disappears from backups within a maximum of 30 days.

10.7. Removing Access and Your Rights

• You can remove the connection from the email and calendar settings of the Platform, or revoke access from the security settings of your Google account (https://myaccount.google.com/permissions). Revoking it from Google stops synchronisation, but does not delete data already synced until you remove the connection on the Platform.

• You can request from dpo@easymailing.com a copy, in a standard format, of the emails and meetings synced from your Google account. Only the data of your own connected account will be provided.

• If you are a person whose data appears in emails or meetings synced by an EASYMAILING customer, you can exercise your rights before that customer, who is the data controller. If you contact dpo@easymailing.com, we will forward your request to the customer without delay and provide the necessary assistance.

• Other rights are exercised in accordance with section 8.

10.8. Security

Google access credentials are stored encrypted, are never sent to the browser, and are only used by our servers for the features described. Data is encrypted in transit and at rest, and every access is authorised on our servers according to each user's permissions.

10.9. Compliance with the Google User Data Policy

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

11. Automated Decisions

EASYMAILING does not carry out automated individual decisions that produce significant legal effects on you, nor does it carry out profiling with such effects, except where:

• It is necessary for the conclusion or performance of the contract between you and EASYMAILING.

• It is authorised by applicable legislation.

• It is based on your explicit consent.

In such cases, we will guarantee your right to obtain human intervention, express your point of view, and contest the decision.

12. Minors

EASYMAILING's Services are directed exclusively at persons aged 18 and over and at entities with legal capacity to contract. EASYMAILING does not knowingly collect data from minors. If you become aware that a minor has provided data through our Services, please notify us at dpo@easymailing.com so that we may proceed with its deletion without undue delay.

13. Data Security

EASYMAILING applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).

• Role-based access control and the principle of least privilege.

• Multi-factor authentication for administrative access.

• Audit logs.

• Regular backups and disaster recovery procedures.

• Ongoing data protection training for staff.

• Periodic security assessments and incident response.

In the event of a security breach affecting your personal data and posing a risk to your rights and freedoms, EASYMAILING will notify the AEPD within a maximum of 72 hours of becoming aware of it and, where appropriate, will notify you without undue delay.

14. Cookies

The use of cookies and similar technologies is governed by our Cookie Policy, which forms an integral part of this Privacy Policy.

15. Links to Third-Party Sites

Our website may contain links to third-party websites whose privacy policies are independent of EASYMAILING. We recommend that you review their policies before providing your data on those sites. EASYMAILING is not responsible for the processing carried out by such third parties.

16. Changes to This Policy

EASYMAILING may update this Privacy Policy to reflect legal, technical, or service feature changes. Any material changes will be communicated with reasonable prior notice through the Platform itself, by email, or through a prominent notice on the website. The date of the last update always appears at the beginning of this document.

17. Acceptance

Use of the website and the Platform implies acceptance of this Privacy Policy on the terms set out herein.