What’s the Main Takeaway?

ActiveCampaign customers can continue to confidently use our platform in the knowledge that we have rolled out a new Data Processing Addendum (the “DPA”) to the ActiveCampaign Terms of Service that takes the invalidation of the Privacy Shield by the Court of Justice of the European Union (the “CJEU”) into account.

In addition, ActiveCampaign’s DPA now uses the new Standard Contractual Clauses (the “New SCCs”). The New SCCs are approved for international data transfers by the European Commission under the GDPR. We are pleased to also offer the new International Data Transfer Addendum issued by the UK Information Commissioner (the “UK Addendum”) to our customers who need it. Customers can access and sign ActiveCampaign’s DPA which incorporates the New SCCs and the UK Addendum by following the links within the settings of their ActiveCampaign accounts.

[NEW] On July 10, 2023, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework. More details about ActiveCampaign’s response are set out below.    

What Happened to the EU-US Privacy Shield and What is the EU-US Data Privacy Framework?

On July 16, 2020, Europe’s highest court, the CJEU, invalidated the EU-US Privacy Shield as an appropriate mechanism for transferring EU personal data to the United States, which ActiveCampaign had previously been relying on.

On July 10, 2023, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework, which enters into force on July 11, 2023. This adequacy decision concludes that the United States ensures an adequate level of protection for personal data transferred from the EU to US companies participating in the EU-US Data Privacy Framework. The EU-US Data Privacy Framework effectively replaces the EU-US Privacy Shield. 

What Steps Has ActiveCampaign Taken?

In an effort to provide customers with an alternative mechanism to transfer EU personal data to the United States, ActiveCampaign has updated its Data Processing Addendum (the “DPA”) and has made available to customers the Standard Contractual Clauses (the “SCCs”), which were generally upheld by the CJEU, for execution. We have also included some “supplemental measures” to the SCCs following the guidance provided by the CJEU opinion.

Furthermore, following the launch of the EU-US Data Privacy Framework, ActiveCampaign has certified its compliance with the EU-US Data Privacy Framework Principles (see our Privacy Policy). The European Commission’s adoption of the adequacy decision for the EU-US Data Privacy Framework means that personal data can be transferred from the EU to ActiveCampaign without any other data transfer mechanisms (such as the SCCs).

What are the New SCCs?

On June 4, 2021, the European Commission adopted a new set of SCCs for international data transfers (the “New SCCs”). The New SCCs will replace the SCCs which were adopted under the GDPR’s predecessor, the Data Protection Directive (the “Old SCCs”) and are intended to align with the new requirements in the GDPR and the CJEU’s decision, as discussed above.

EU customers who have already executed the Old SCCs with ActiveCampaign will have 18 months to migrate to the New SCCs and can accordingly continue to use the Old SCCs until December 27, 2022.

What is the UK Addendum? 

On March 21, 2022, the UK’s new International Data Transfer Addendum came into force (the “UK Addendum”). This document, issued by the UK Information Commissioner, is an additional data transfer mechanism that organizations can use to provide appropriate safeguards required under the UK GDPR for personal data when it is transferred from the UK to the United States. The UK Addendum is designed to be used in conjunction with the New SCCs approved by the European Commission (see above), in other words an “add-on” to the New SCCs. 

Accordingly, if the UK Addendum is required, customers must execute both the UK Addendum and the New SCCs. UK customers who have already executed the Old SCCs with ActiveCampaign will have until March 21, 2024 to switch to the UK Addendum.   

How Can Customers Access the New Documents?

Customers can access and sign the updated DPA and, as applicable, the New SCCs and the UK Addendum by following the links within the settings of their ActiveCampaign accounts.

If you executed a DPA with ActiveCampaign prior to the CJEU’s decision or the adoption of the New SCCs or the UK Addendum, you can execute the new DPA which will supersede and replace the prior DPA, effective as of the date of execution, as noted in the DPA.

If your business is unaffected by the CJEU’s determination, or if you do not need a DPA, the New SCCs or the UK Addendum, then you do not need to take additional action.

If you are a current or prospective customer and wish to review the terms of the DPA, the New SCCs or the UK Addendum, you can view templates of each document here: DPA, New SCCs and UK Addendum.

Please note, if you are an ActiveCampaign reseller, affiliate, or agency partner, please contact ActiveCampaign support for a partner specific DPA.

Legal Disclaimer Language

ActiveCampaign’s services are used by thousands of customers, in hundreds of industries all over the world, and we recognize that each customer’s legal considerations will be unique. As a result, only your lawyer can provide tailored legal advice to you, and if you require special interpretation of these regulatory changes for your own business, we recommend that you consult with your legal counsel. Similarly, we are not in a position to know whether the DPA, SCCs and UK Addendum will meet your specific legal requirements, but we encourage you to discuss the form documents with your legal counsel. Please note that this page contains legal and regulatory information, but it is not legal advice.