GetResponse

GDPR overview

GDPR implementation is concrete and documented. GetResponse S.A. is established in Gdansk, Poland, so the regulation applies directly and no Article 27 representative is required or appointed. The security page states: “We are fully compliant with the GDPR.” A Data Protection Officer is named, Marianna Kozlicka, reachable through the privacy support form or by post to the registered office. A Data Processing Agreement is published and forms part of the terms: Annex 2 details technical and organisational measures, Annex 3 names every subprocessor with address, purpose, scope and processing location. Transfers outside the EEA rely on adequacy decisions or on published Standard Contractual Clauses, Brazilian SCCs included; Google LLC is covered by the Data Privacy Framework and SCCs. All data subject rights are listed and exercised free of charge. The supervisory authority is the President of Poland’s Personal Data Protection Office. Privacy policy effective 19 June 2026.

Who owns the data?

Section VII of the terms states that GetResponse claims no ownership of customer Content, including Creator's Content: the customer, or the page visitor or course participant where applicable, retains all right, title and interest. Materials GetResponse supplies, such as Multimedia Studio assets and templates, are excluded. The publisher acts as controller for its own users and as processor for the contact data entrusted to it. Uploaded files are stored on its servers and, per the privacy policy, not used for its own purposes nor shared with any third party. Customers do accept that their landing pages may be reused in GetResponse marketing materials and case studies. At contract end, the DPA offers deletion or return of the personal data.

Reuse rights

Customers keep free use of the content and contact data they bring in: nothing in the terms requires permission to export, reuse or delete it, and the DPA lets the customer choose deletion or return at contract end. On its own side, GetResponse processes data as controller for account, service, marketing and contact purposes, citing contract performance (Art. 6.1(b)), legitimate interest (Art. 6.1(f)), consent (Art. 6.1(a)) and legal obligation (Art. 6.1(c)), and as processor for the contacts a customer entrusts to it. Recipient categories cover hosting, webinars, support, security, diagnostics, marketing analytics (Google), recruitment, payment, law firms, debt collection and analytics or AI vendors. The publisher states it neither sells nor rents personal data, and that passwords are stored encrypted and beyond its own reach. Feedback is analysed automatically by AI and machine learning tools to detect issues, topics and trends. Anything typed into the AI features is sent to third-party providers — OpenAI, and Azure OpenAI for the course creator — and the terms ask customers not to enter personal or confidential data there. Data obtained through Google Workspace APIs is not used to develop, improve or train generalised AI models.

Data retention & training

Hosting summary

No hosting country or region is announced for the platform itself. The privacy policy only states that recipients of transferred data are based mainly in the European Economic Area (EEA), which describes recipients rather than hosting. Annex 3 of the DPA is more precise, subprocessor by subprocessor: ClickMeeting Sp. z o.o. (Gdansk) for webinars, processing in France, Germany and Poland; Google Cloud Poland sp. z o.o. (Warsaw) for chats, processing in the United States, Belgium, the Netherlands and Finland; Microsoft Ireland Operations Limited (Dublin) for the course creator AI, processing within the EEA; Vonage Business Inc. (Holmdel, New Jersey) for SMS, processing in the EU, Singapore, Australia and the United States. Transfers outside the EEA rely on an adequacy decision or on the Standard Contractual Clauses published by GetResponse. Google LLC (USA) is named as a recipient for marketing and analytics, covered by the Data Privacy Framework and SCCs. GetResponse states it runs its own sending infrastructure, and the site's public IP is announced by AS46469 GETRESPONSE. Security measures include TLS 1.2+ in transit, AES-256 at rest, centrally managed and rotated keys, and segregated production and corporate environments.