Frequently asked questions about GDPR

You will learn

Learn how GDPR relates to consent, customer data requests, and the tools you use in Klaviyo.

GDPR stands for the General Data Protection Regulation, an EU regulation adopted in 2016 that went into effect on May 25, 2018. It governs the processing of personal data by businesses established in the EU, as well as businesses outside the EU that offer goods or services to people in the EU or monitor their behavior there. For more information on GDPR, check out our blog series.

Is it legal for me to transfer data from my European customers to Klaviyo?

GDPR recognizes several legal mechanisms for transferring personal data out of the EU. Klaviyo is self-certified under the Data Privacy Framework and uses it for transfers while it is recognized as a valid transfer mechanism in the relevant region. Standard Contractual Clauses apply as a fallback, as described in our Data Processing Agreement, which is incorporated into our Terms of Service. We recommend consulting your legal team to determine the appropriate transfer mechanism for any transfers of data your organization may make.

If we can't prove explicit opt-in for legacy profiles, is there a way to confirm consent via email?

Prior to GDPR going into effect (May 25, 2018), we did recommend sending a repermissioning campaign to any of your subscribers in the EU. However, now that GDPR is in effect, we no longer recommend this practice. Before contacting any of your existing customers or subscribers for whom you cannot prove explicit opt-in, please consult your legal team.

How do we prove consent, including the day a subscriber opted in?

Klaviyo recommends double opt-in for email subscriptions. To demonstrate consent, retain the language presented to the subscriber in the form, email, or webpage where they provided consent, along with the date and time they consented and exactly what they agreed to. Consult your legal team about any country-specific opt-in requirements.

For our email fields on our websites, do we need to add more checkboxes for the customers to tick before submitting their details?

Klaviyo provides GDPR-compliant forms with multiple checkboxes, allowing for granular consent (i.e., separate consent for email marketing and Facebook marketing).

When creating a popup, flyout, embedded, or full-page sign-up form from scratch, turn on Enable data protection fields. Customize the language and checkboxes for your marketing program, and have your legal team review them before publishing the form. If you gather personal information about EU consumers through other platforms, you’ll need to make changes on those platforms as well.

If you use a custom checkbox to collect email consent, use its profile property to create a segment of subscribers who selected it. Assign the checkbox its own custom property instead of $consent. Klaviyo adds email to $consent automatically when someone subscribes, so that value alone does not show a choice. Send marketing to that segment, and add a matching filter to your marketing flows. A custom checkbox’s saved value does not control whether submitting the form subscribes someone to email marketing.

What types of personal data do you process, where is it hosted, who is it shared with, and how long is it retained?

Information about the data that we process and the measures we take to protect it can be found in our Data Processing Agreement (DPA). Schedule 1 describes the categories of data and the purposes of processing. Security measures are outlined in Schedule 2. You can also read our entire Terms of Service.

Should we be updating the fine print when we capture emails that include any information about how their data is being stored in Klaviyo?

Yes, your fine print should be updated to reflect the following guidance for EU prospects and customers:

• Use clear, plain language that is easy to understand
• Specify why you want the data and what you’re going to do with it
• Name your organization and any third party processors you will be using
• Tell individuals they can withdraw their consent

Do I need to provide opt-in emails in the local language to comply with GDPR?

Not necessarily. The specific requirements may vary country to country, so we recommend consulting your legal team about country-specific requirements, but Klaviyo provides default opt-in language in several languages.

Am I required to get consent on all personal data from consumers?

For personal data that is not in a special category, there are several possible lawful bases for processing, including consent. GDPR lists several exceptions to its general prohibition on processing special-category data, including explicit consent. However, Klaviyo’s Acceptable Use Policy prohibits collecting, storing, or processing special-category data, such as health information, in Klaviyo, even if you have consent.

Other lawful bases for processing personal data that is not in a special category include:

• The processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering a contract
• The processing is necessary for compliance with a legal obligation
• The processing is necessary to protect the vital interests of the data subject or another person
• The processing is necessary for the legitimate interests of the business and such interests are not outweighed by the interests or fundamental rights of the data subject
• The processing is necessary for a task performed in the public interest or to fulfill the responsibilities for a public official

We recommend consulting your legal team to determine the appropriate lawful basis for the processing of data by your organization.

Can you anonymize my data so that I can view a profile but not see the personally identifiable information?

Klaviyo does not provide a way to view an anonymized version of an existing profile. When you delete a profile, identifying information in its event history is redacted, while event data (e.g., Placed Order events) remains in the account to preserve the accuracy of performance metrics. Exported data can be anonymized outside Klaviyo; exporting it does not anonymize the profile in your account.

Profile deletion is permanent. You can delete a profile and record the data privacy request. In the deletion dialog, select Delete profile in compliance with data privacy request before confirming deletion. You can also export all the data on a given profile if requested by any of your contacts.

Is an Abandoned Cart email GDPR compliant?

The answer to this one is not entirely clear; however, many organizations take the view that you can still send abandoned cart emails without explicit consent for marketing communications under the basis of legitimate interest. You may be able to consider an abandoned cart email as a communication relevant to the explicit intent to complete a transaction with your business. Other triggered emails, like browse abandonment and winbacks, on the other hand, may not be permissible unless customers have previously consented to receive marketing emails from you in a GDPR compliant fashion.

That said, the applicability of legitimate interests or any other legal basis will depend on the particular circumstances, including, for example, the number and frequency of emails and the amount of time that has elapsed since the cart was abandoned. We strongly recommend you consult with your legal team about your email campaigns to confirm they are compliant with applicable law.

Is using Google Fonts GDPR compliant?

Using Google Fonts can cause GDPR compliance issues as Google’s server needs the receiver’s IP address to deliver fonts. According to the GDPR, an IP address qualifies as personal information, which can be used to identify the user. Note that by including Google Fonts in your font library, you are deemed to be using Google Fonts.

As an alternative to Google Fonts, Klaviyo provides a selection of fonts hosted in Klaviyo for use in your sign-up forms, consent pages, and emails. Loading these fonts does not send the visitor’s or recipient’s IP address to Google. If you switch to Klaviyo-hosted fonts, update the fonts in your existing content and remove Google Fonts from your font library as well.

Additional Resources