Email Marketing Built for GDPR from Day One
Most email platforms add compliance as an afterthought. NexusProMail is operated by a Finnish company under EU law, with consent management, suppression lists, DSAR tools and GDPR infrastructure built into every plan.
This page covers NexusProMail’s GDPR-specific features. For a broader reference covering CAN-SPAM, CASL and DPA obligations across all regulations, see the email compliance guide →
Quick Answer
GDPR-compliant email marketing requires a lawful basis for every send, valid opt-in consent, suppression list enforcement, support for data subject rights (access, rectification, erasure) and a Data Processing Agreement with your email platform. NexusProMail is operated by Infotech Pioneers Oy, a Finnish company subject to EU law, with all of these built into every account.
Key Takeaways
- GDPR applies to any business emailing EU residents — regardless of where the sender is based
- Consent must be freely given, specific, informed and unambiguous — pre-ticked boxes are invalid
- Every commercial email must include a working unsubscribe link; opt-outs must be honoured promptly
- Data subjects have the right to erasure (Article 17) — you need a process to respond within 30 days
- A Data Processing Agreement with your email platform is mandatory under GDPR Article 28
What GDPR Actually Requires from Email Senders
GDPR places specific obligations on any business sending email to EU residents — regardless of where the sender is based.
Lawful basis for sending
You need a valid legal basis to email someone — usually consent or legitimate interest. Consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes do not count.
Right to unsubscribe
Every commercial email must include a working unsubscribe link. Opt-out requests must be honoured within 30 days, and you cannot email a suppressed contact again.
Data minimisation
You should only collect and process the contact data you actually need for sending. Storing unused fields on contacts increases your compliance exposure.
Right to erasure
Contacts can request deletion of all data you hold about them. You need a process to locate, export and delete that data within 30 days (Article 17 GDPR).
Data Processing Agreement
If you use any third-party tool that processes personal data on your behalf — including an email platform — you need a DPA with that provider.
Breach notification
If personal data is compromised, you must notify your supervisory authority within 72 hours. Structured logging and audit trails help you respond quickly.
How NexusProMail Covers Each Requirement
Consent & opt-out management
Every contact has a consent state. Suppression lists are enforced at the API level before each send — not just a checkbox in the UI. Hard bounces and spam complaints are added automatically. You cannot send to a suppressed address.
Per-recipient signed unsubscribes
Each unsubscribe link is HMAC-signed and brand-scoped. A contact unsubscribing from one of your brands does not suppress them across all brands unless you configure global suppression. Fail-closed by default — invalid tokens block the send.
DSAR support
The admin panel includes DSAR tooling. You can search for a contact by email, export all data held about them, or delete them permanently from the system. Erasure tombstones prevent reimport.
Audit trail
All sends, bounces, complaints, suppressions and unsubscribes are logged with timestamps. The full audit trail is available via the analytics dashboard and API.
Data Processing Agreement
A DPA is available to all business customers on request. Infotech Pioneers Oy acts as your data processor under Article 28 GDPR. Contact support@nexuspromail.com.
EU-oriented data governance
NexusProMail is operated by Infotech Pioneers Oy, a Finnish company subject to EU law. Infrastructure migration to eu-west-1 (Ireland) is planned for Q3 2026. A DPA is available covering current arrangements.
Everything You Need for GDPR-Compliant Email
Frequently Asked Questions
Is NexusProMail GDPR-compliant?
Where is email data stored?
Can I manage email consent inside NexusProMail?
Does NexusProMail support the right to erasure?
Is a Data Processing Agreement available?
What happens to bounced or complained addresses?
Start sending GDPR-compliant email today
Free plan available. No credit card required. DPA on request.
Also read: Email deliverability guide · Email marketing blog