GDPR Overview

GDPR

General Data Protection Regulation (GDPR) is a complex of rules for using and protecting EU and UK residents’ personal data.

According to GDPR, two parties are responsible for compliance with the law: Controller and Processor.

Data controller determines the goals and means of personal data processing (your organization as a customer).
Data processor’s function is to process personal data on Controller's behalf or provide tools for this purpose (area of responsibility).

As the data processor, we provide you with the full range of technical and organizational measures to protect the data subject's rights according to GDPR.

📘
Note
GDPR became the basis of some other personal data regulations, such as California Consumer Privacy Act (CCPA) or Brazilian General Data Protection Law (LGPD). However, due to the common basis of these laws, our data protection measures allow you to meet all their requirements.

See below how to solve main regulation tasks and remain compliant with data protection laws.

Right to awareness

Provide users with information in a transparent, accessible way about the data you collect and how you plan to use it. Make this information available every time you plan to gather new information — from downloading your app to subscribing to new communication channels. A user should be aware of how exactly you are planning to process the data.

Data processing permission

Permission to use personal data must be free, specific, informed, and unambiguous. It must be active — do not use default permission checkmarks.

We help you to receive communication permission for every channel:

Email — as DOI email subscription completely meets the GDPR requirements, we provide you with ready-made DOI templates, workflows, and web forms: everything you need to grow your contact list effectively.
Mobile push, In-app, App inbox — we recognize iOS and Android users and send them notifications according to App Store and Google Play rules respectively.
Web push — we provide you single and double opt (DOI) in mechanics to collect user web tokens.

📘
Note
If your site uses a Cookie Consent banner or Consent Management Platform (CMP) to meet EEA/UK/Switzerland requirements, the widget platform doesn't dictate or enforce a single consent category. In your CMP's own configuration, you can assign the widget's script and cookies to whichever category fits your setup — for example, "marketing" or "site functionality/necessary."

Right to be forgotten

Users have the right to be forgotten, so you must exclude them from all marketing campaigns and delete all their data upon request.

To do that, use the Delete contact API method.

📘
Note
By default (erase=false), Delete contact removes the contact from active use, but some identifiers — such as email and externalCustomerId — remain stored. For full GDPR erasure of the profile, activity, and web/mobile tracking data, call the method with erase=true. This action is permanent and can't be undone.
Example: DELETE /api/v1/contact?externalCustomerId=AB12770&erase=true

📘
Note
The Delete contact API method is rate-limited to approximately 100 requests per hour. If you need to erase a large volume of contacts at once, batch your requests within this limit and add delays between them rather than sending them all at once; contact support if you have a bulk-erasure need that this limit does not accommodate.

📘
Note
For a contact who subscribed through Double Opt-In, the contact's creation date in Yespo is generally close to their actual subscription date, since the confirmed contact record is typically created around the time of confirmation. Without DOI, there isn't a reliable way to determine when a contact actually subscribed.

Data access and portability

Users have the right to demand a copy of all their personal data you store. You must provide it within 30 days.

To get data on tracked user’s activity, use the Get token activity API method.

Right to edit personal data

Users have the right to request that you make changes to their personal data if they consider it inaccurate or incomplete.

Use the Update contact API method to make changes to a user profile in our platform.

📘
Note
For bulk field updates across very large contact bases (1M+ contacts), the team recommends going through the v1/contacts API rather than a workflow, since running an update of that scale through a workflow can end up competing for resources with your other active workflows.

Additional support

We will kindly help you develop all the processes you need. If you have some questions, suggestions, or wishes, feel free to contact our support service.

If you have questions regarding the legal side, we advise you to contact your lawyer.