DPA / SCCs

ActiveCampaign customers can continue to confidently use our platform in the knowledge that we have rolled out a new Data Privacy Addendum (DPA) to the ActiveCampaign Terms of Service that takes the invalidation of the Privacy Shield framework by the Court of Justice for the European Union (CJEU) into account.

What Happened to Privacy Shield?

On July 16, 2020, Europe's highest court (the CJEU) invalidated the EU-US Privacy Shield as an appropriate mechanism for transferring EU personal data to the United States, which ActiveCampaign had previously been relying on. However, for the time being, the Swiss-US Privacy Shield remains a valid data transfer mechanism, and ActiveCampaign will continue to protect EEA, UK, and Swiss data in compliance with the Privacy Shield Principles to which it continues to self-certify compliance. 

Like all other companies impacted by this decision, we are monitoring the situation closely as the United States and European authorities work to negotiate a successor regime for transcontinental transfers and as European authorities consider practical guidance to companies previously relying on the Privacy Shield framework. We may update this page if additional guidance is offered.  

What Steps Has ActiveCampaign Taken?

Although the CJEU’s decision creates great uncertainty regarding the transfer of EU personal data through any data transfer mechanism to the United States, in an effort to provide customers with an alternative mechanism to transfer EU personal data to the United States, ActiveCampaign has updated its Data Processing Addendum (the "DPA") and has made available to customers the EU Standard Contract Clauses (the "SCCs"), which were generally upheld by the CJEU, for execution. We have also included some "supplemental measures" to the SCCs following the guidance provided by the CJEU opinion.

How Can Customers Access the New Documents?

Customers can access and sign the updated DPA and SCCs by following the links within the Privacy settings of their ActiveCampaign accounts. If you executed a DPA with ActiveCampaign prior to the CJEU's decision, you can execute the new DPA which will supersede and replace the prior DPA, effective as of the date of execution, as noted in the DPA.

If your business is unaffected by the CEJU's determination, if you do not need a DPA, or, if you have an existing DPA with ActiveCampaign and wish to leave the terms of that agreement unmodified, then you do not need to take additional action. 

If you are a current or prospective customer and wish to review the terms of the DPA or SCCs, you can view templates of each document here: DPA, SCCs

Note while signing:

DATA EXPORTER (are you)

DATA IMPORTER (are we)

Legal Disclaimer Language

ActiveCampaign's services are used by thousands of customers, in hundreds of industries all over the world, and we recognize that each customer's legal considerations will be unique. As a result, only your lawyer can provide tailored legal advice to you, and if you require special interpretation of these regulatory changes for your own business, we recommend that you consult with your legal counsel. Similarly, we are not in a position to know whether the new DPA and SCCs will meet your specific legal requirements, but we encourage you to discuss the form documents with your legal counsel. Please note that this page contains legal and regulatory information, but it is not legal advice.