Sendblue procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “v. Right to Data Portability: You can ask for the transfer of your personal data to another party. ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “iii. Right to Non-Discrimination: Exercising your CCPA rights will not result in discriminatory treatment. ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ii. Right to Deletion: You can request the deletion of your PI from our records and direct our service providers to do the same.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ii. Right to Rectification: You have the right to have inaccurate personal data corrected. ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Exercising Your Rights. To exercise any of your rights, or if you have any questions regarding our processing of your personal data, please contact our data protection office via email at support@sendblue.com. We are committed to addressing your concerns and will respond to your request promptly. Complaints. If you believe that your data protection rights have been breached by Sendblue and/or one of our Business Users, you have the right to lodge a complaint with the relevant supervisory authority in your country or contact us as support@sendblue.com ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “vi. Right to Object: You have the right to object to the processing of your personal data, particularly for marketing purposes.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ d. Data Subject Rights. You must provide mechanisms for individuals to exercise their rights over their personal data, such as accessing, correcting, deleting, or transferring their data, as provided under applicable privacy laws.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “To make a CCPA request, contact us via email at support@sendblue.com , or send postal mail to our designated address. Requests will be processed within the timeframe required by law.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you have any inquiries about this Privacy Policy or if you need to exercise any rights concerning your personal data, please reach out to us at: support@sendblue.com ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ b. California Consumer Privacy Act (CCPA). The CCPA provides California residents with specific rights regarding their personal information and mandates transparency about data practices. Under the CCPA, California residents have rights to access, correct, and request the deletion of their PI. We also provide mechanisms to opt-out of the sale or sharing of PI. Specific rights include: ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ a. General Data Protection Regulation (GDPR). As established by the European Union, the GDPR sets guidelines for the collection, processing, and free movement of personal data of individuals within the EU. Sendblue adheres to these regulations to ensure that the privacy rights of EU residents are respected and protected. As a resident of the UK or EU, you have specific rights regarding your personal data: ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “iv. Right to Restrict Processing: You have the right to request the restriction of processing your personal data under certain conditions. ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “i. Right of Access: You can request access to the personal data we hold about you. ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “i. Right to Know and Access: You can ask about the PI we have collected, used, and disclosed over the past 12 months.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “iii. Right to Erasure: You can request the deletion of your personal data when it is no longer necessary for the purposes collected. ” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “If you are a parent or guardian and discover that your child has provided us with personal information, we urge you to contact us immediately. Upon learning that we have collected personal information from a child under 13 without parental consent verification, we will promptly take necessary actions to eliminate such data from our servers. Privacy Policy Modifications. Sendblue reserves the right to amend this Privacy Policy at any interval. Any updates will be communicated by publishing the revised policy on our website. You can determine the recency of changes by referring to the modification date indicated at the top of this Privacy Policy. Amendments to this Privacy Policy take effect upon their posting on our website.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Legal and Compliance Notice. In addition to the above, we may collect and retain information as required by law or for legitimate business purposes. We participate in compliance and regulatory oversight, ensuring that all data handling adheres to legal standards and industry best practices.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “All categories of information described in this Privacy Policy exclude text messaging originator opt-in data and consent. This information will not be shared with any third parties except as described in this section.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Sendblue is headquartered in the United States, with operations, entities, and service providers in the U.S. and globally. As a result, we and our service providers may transfer, store, or process your information in jurisdictions that may not provide equivalent levels of data protection as your home jurisdiction.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Vendors and Service Providers. We disclose information to third-party vendors, service providers, contractors, and consultants who require this information to perform services on our behalf. This includes but is not limited to providers assisting with web hosting, payment processing, data analysis, customer support, and marketing efforts. Professional Advisors. Information may be shared with our legal and financial advisors to obtain professional advice and protect our business interests. Legal and Regulatory Authorities. We may disclose information where required by law or to respond to legal processes; this includes complying with national security or law enforcement requirements, and protecting the rights, property, or safety of Sendblue, our users, and the public. Corporate Transactions. In the event of a merger, acquisition, reorganization, bankruptcy, or other similar events, customer information may be part of the transferred assets. Affiliates and Subsidiaries. Information may be shared within our family of companies, including parents, corporate affiliates, subsidiaries, business units and other companies that share common ownership for internal administration purposes. User Consent. We may share information with additional third parties when we have the user's explicit consent or under the direction of the user. Transfer of Information. We may also disclose aggregated, anonymized, or de-identified information, which cannot reasonably be used to identify individuals, for various business purposes, including product and service development and enhancement. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ 6. Disclosure of Information and Transfer. Sendblue may share the categories of information described below for business operations, service improvement, and in compliance with legal requirements:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. We may share your Personal Data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages. These service providers are contractually obligated to use such information solely for the purpose of facilitating the messaging services and are prohibited from using it for their own marketing or promotional purposes.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Your mobile information, including your phone number, opt-in status, and any data collected as part of the SMS opt-in process, will not be sold, rented, or shared with any third parties or affiliates for their own promotional or marketing purposes.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ h. Integration with Third-Party Services. Our platform allows integrations with various third-party services to enhance its functionality. We collect information related to these integrations to ensure seamless service delivery. The use of third-party services through Sendblue platforms is governed by their respective privacy policies and terms.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.