GDPR Compliance

When does GDPR apply to you?

GDPR applies to your Pitch2Retail outreach if any of the following is true:

• You're sending to recipients located in the EU or UK
• Your brand offers goods or services to EU/UK customers
• You "monitor" the behavior of EU/UK individuals (e.g. open / click tracking)

GDPR penalties: up to €20M or 4% of global annual turnover, whichever is higher.

If you're a Canadian or US brand pitching to North American buyers only, GDPR doesn't directly apply — but PIPEDA (Canada) and CASL still do.

Data controller vs. processor

This means: you decide WHAT to do with the data; we provide the tools to DO it. Both have GDPR obligations.

Lawful basis under Art. 6

For B2B outreach, the most common GDPR lawful bases are:

• Art. 6(1)(b) — Contract performance: when the recipient is your existing customer or actively engaged buyer
• Art. 6(1)(f) — Legitimate interest: for cold outreach to business email addresses where the recipient's interests are clearly aligned (e.g. a category buyer for a relevant product)
• Art. 6(1)(a) — Consent: for general marketing newsletters (rarely the right basis for cold outreach)

Pitch2Retail's audience builder and templates are designed to support legitimate interest processing. To rely on this:

1. Conduct a Legitimate Interest Assessment (LIA) documenting the balancing test
2. Inform recipients in your privacy policy that you contact business buyers under legitimate interest
3. Honor opt-outs immediately (we enforce this automatically via the suppression list)
4. Don't use legitimate interest for special-category data (Art. 9 — health, religion, etc.)

Need help with a Legitimate Interest Assessment template? Email hello@pitch2retail.com — we provide one for Growth+ customers.

Data subject rights (Arts. 12-22)

Recipients (data subjects) have these rights under GDPR. We support all of them within Pitch2Retail and pass requests directly to you when received:

Our sub-processors

Pitch2Retail engages the following sub-processors. All are SOC 2 Type II certified and have appropriate transfer mechanisms (Standard Contractual Clauses) for any data leaving the EU.

We notify customers via email at least 14 days before adding a new sub-processor. Customers may object in writing within 14 days; if we can't accommodate, you may terminate the affected service.

International transfers

Customer-uploaded data is stored in Canada (DigitalOcean Toronto). Canada has an EU adequacy decision under PIPEDA — meaning EU personal data can be transferred to Canada without additional safeguards beyond our DPA.

For sub-processors in the US (Anthropic, Resend, Apollo, Stripe), transfers rely on:

• Standard Contractual Clauses (EU 2021/914) for the EU
• UK Addendum to the SCCs for UK transfers
• Each sub-processor's published Transfer Impact Assessment

Breach notification (Arts. 33-34)

If we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will:

• Notify affected customers (controllers) without undue delay, generally within 72 hours of becoming aware
• Provide details: nature of the breach, categories and approximate number of data subjects, likely consequences, measures taken to address it
• Cooperate with your supervisory authority notification (Art. 33) and data subject notification (Art. 34) obligations

Data Processing Agreement (DPA)

For Growth+ tier customers, we provide a counter-signed DPA covering all the requirements of GDPR Art. 28 (controller-processor agreements). Key terms:

• We process data only on your documented instructions
• Personnel are bound by confidentiality
• Sub-processors only with general written authorization
• Standard Contractual Clauses for international transfers
• We assist with data subject requests, breach notifications, DPIAs as needed
• Data deletion or return at end of services
• Audit rights with reasonable notice

Read the full template at /dpa.html or request a counter-signed PDF version at hello@pitch2retail.com.