Trust Center
Transparent. Secure. Reliable.
Transparent about security, privacy and legal safeguards. This is how organisations assess MailCamp.
Security
This section explains how MailCamp organises information security. The focus is on the measures that matter, such as certification, access security, hosting, logging, vulnerability management and incident response.
Is MailCamp ISO 27001 certified?
Yes. MailCamp falls within the group's ISO 27001 certification via Northbeam B.V. / Endeavour. MailCamp was included in scope in the recent audit and recertification. View the certificate.
Where is data hosted?
MailCamp is hosted in the Netherlands. All data also stays on Dutch soil. Our hosting partner is DuoCast B.V.
Which security measures does MailCamp apply?
MailCamp applies, among other things, role-based access control, logging, encryption in transit, patch management, DTAP environments, backups, technical vulnerability management and physical and logical access security.
Does MailCamp support SSO and MFA?
Yes. MailCamp supports Single Sign-On, including SAML/EntraID, depending on the chosen configuration. Multi-Factor Authentication is also supported and is available as an additional security measure.
How does MailCamp deal with vulnerabilities, penetration tests and incidents?
Vulnerabilities are monitored periodically and followed up through patch management and security management processes. Penetration tests are carried out. MailCamp does not, in principle, publish detailed reports, but can share a high-level summary or overall score on request. A fixed incident and notification procedure applies to security incidents and data breaches.
Privacy
This section describes how MailCamp processes personal data and which safeguards apply. In its standard service MailCamp acts as a processor and supports customers in using the platform in a GDPR-compliant way.
What is MailCamp's role under the GDPR?
In its standard service MailCamp acts as a processor. The customer is the controller and determines the purpose, legal basis and means of the processing.
Which personal data does MailCamp process by default?
By default MailCamp processes regular personal data such as name, email address, phone number, IP address and technical metadata. Depending on usage, additional fields added by the customer may be processed. MailCamp is not set up to structurally process special categories of personal data.
What are the purpose and legal basis of the processing?
The primary purpose is to facilitate email communication, such as newsletters and mailings. The legal basis is determined by the customer and usually consists of performance of a contract and/or consent.
How does MailCamp support consent, data subject rights and privacy by design?
MailCamp supports opt-in forms and the registration of subscriptions. The platform supports processes for access, rectification, erasure and restriction. Privacy by design and by default are applied through minimal data processing, role-based access, logging and deletion options.
Does data stay within the EEA and how long is it retained?
The core processing takes place within the EEA, with hosting in the Netherlands. Retention periods are in principle determined by the customer as controller, with technical support from MailCamp. After the service ends, arrangements apply for return, retention periods and destruction.
Legal
This section describes how MailCamp has set up the legal basis of its services. It covers contract documents, sub-processors, audits, applicable law and sector-specific requirements such as the GDPR and BIO.
Which contract documents are available?
MailCamp works with general terms and conditions, a data processing agreement and, where necessary, additional contractual arrangements such as security or privacy annexes and SLA agreements.
Can MailCamp work with the customer's data processing agreement?
Yes. By default MailCamp uses its own data processing agreement, but on request the customer's data processing agreement can also be reviewed and, where possible, accepted.
Which sub-processors does MailCamp use?
MailCamp works with DuoCast for hosting, Zendesk for support processes and Postmastery for deliverability and monitoring, among others. The current list of sub-processors and the associated safeguards are set out in the data processing agreement. Also see the overview of sub-processors.
How does MailCamp support audits and evidence of compliance?
MailCamp can share relevant evidence, such as certifications, contract documentation and, where appropriate, audit or pentest summaries. Detailed information is not shared publicly where this would harm security or confidentiality.
Does MailCamp support public and regulated organisations?
Yes. MailCamp has experience with public and regulated organisations and can provide additional answers to GDPR, BIO and procurement questions, among others, as far as appropriate to the nature of the service.
04 · Documents
Documents
In this section you can consult or request relevant documents and evidence. Not all documents are suitable for public release; some are only shared on request or under NDA.
Sub-processors
Who we work with
Below you will find our sub-processors. We have concluded separate processing agreements with them.
Duocast
We use the services of our hosting provider Duocast for our data storage. Duocast is based in the Netherlands and only processes the data in the Netherlands. Duocast is ISO 27001 and NEN 7510 certified.
DigitalOcean
Hosting of the mailing software and storage of data within the EEA. DigitalOcean is SOC 2 and SOC 3 Type II certified. DigitalOcean is GDPR compliant.
TransIP
Redundant storage of backups from DigitalOcean. TransIP is ISO 27001, NEN 7510 and ISO 9001 certified.
HubSpot
For our customer service, managing support tickets, providing our help centre functionality and organising marketing and sales activities, we use the services of HubSpot Inc. (United States). Our HubSpot account is hosted in HubSpot's data centre in Frankfurt (Germany), within the EEA. HubSpot processes personal data on our behalf and acts as a processor.
Within HubSpot we store and manage, among other things, contact details, communication via support tickets, interactions with our website, and information about potential leads, prospects and customers. We use this data to provide support, improve our services and send relevant information to interested parties and existing customers.
HubSpot processes data in accordance with its own security standards and, where necessary, uses transfer mechanisms such as Standard Contractual Clauses (SCCs) to ensure an appropriate level of protection when data is transferred to the United States. You can find more information in HubSpot's Privacy Policy.
Zendesk
We use Zendesk's helpdesk software to handle support questions. Although this company is based in the US, it stores our data in Ireland. We have of course concluded a data processing agreement with them in which they guarantee compliance with the GDPR.
Postmastery
We work with Postmastery to monitor our MTA server and carry out periodic assessments of our deliverability. Postmastery is based in the Netherlands and has been active in the email marketing industry for almost 25 years.
Website
Other technologies on MailCamp.nl
These technologies are used on the MailCamp.nl website.
Leadinfo
We use the lead generation service of Leadinfo B.V., Rotterdam, the Netherlands. The tool recognises company visits to our website based on IP addresses and shows us publicly available information, such as company names or addresses. In addition, Leadinfo places two first-party cookies to evaluate user behaviour on our website and processes domains from form entries (e.g. "Leadinfo.com") to correlate IP addresses with companies and improve services.
More information is available at www.leadinfo.com. You can opt out via Leadinfo's opt-out page; your data will then no longer be recorded by Leadinfo.
Hotjar
We use the analytics tool Hotjar. Hotjar helps us understand visitor behaviour on our website, for example through heatmaps, session recordings and feedback forms. Hotjar records, among other things:
- Pages visited
- Click behaviour and mouse movements
- Browser and device used
- Operating system
- Screen resolution
- (Truncated) IP address, anonymised and therefore not traceable to an individual
We use this information solely to improve the user experience on our website. Personally identifiable data (such as name, email address or phone number) is not collected or stored by Hotjar. Hotjar stores data within the European Union and complies with the GDPR. Read more in Hotjar's privacy policy or object to the use of Hotjar.
Google Analytics
Google Analytics helps us optimise the MailCamp website, so that we have better insight into which pages are popular and can better map out the need for information.
Questions about security or privacy?
Would you like to know more about our information security policy? Get in touch, we are happy to help.