ManyChat, beehiiv, Klaviyo, Mailchimp, Make: the tools come from the US, the rules come from Brussels. We set up the stack you already use so that double opt-in, proof of consent and data processing agreements hold - and so your emails actually arrive instead of landing in spam.
Sign-up form, confirmation email and a log of timestamp, IP address and form version. Article 7(1) GDPR does not just require that you obtained consent, it requires that you can demonstrate it. That is where most self-built sign-up flows fall apart.
Sender authentication on your own domain plus a separate tracking subdomain. Since Google and Yahoo tightened their bulk sender requirements in February 2024 this is no longer optional: without a valid signature and a DMARC record you are filtered out before anyone reads your subject line.
A data processing agreement under Article 28 GDPR with every provider you use, a check of US transfers under the EU-US Data Privacy Framework, and a clean entry in your record of processing activities under Article 30. Including the wording for your privacy policy.
Moving from one tool to the next almost always drags along contacts nobody can produce a consent record for. We split your list into three groups: documented and coming with you, needs a re-opt-in, and should be deleted.
Ninety minutes through what you run today: which tools, where the contacts came from, what is documented. You end up with a written list of what is missing - and you keep that list even if you do not continue with us.
DNS and authentication, sign-up and confirmation flow, consent logging, agreements collected, list cleaned and imported. Every step is documented in writing so your lawyer or data protection officer can follow it.
One call in which you operate the system yourself, plus a page of documentation and a test send. After that the setup is yours, with all accounts in your name. If you would rather not send it yourself, the newsletter retainer picks up from there.
We send our own newsletters and run our own automations, including the mistakes you make once: DKIM records pointed at the wrong host, tracking domains that break the signature, imported lists with no proof behind them. This page is not legal advice and we are not a law firm. We are the people who set it up correctly afterwards.
In the US it is, in Austria and Germany it is not. Section 174 of the Austrian Telecommunications Act 2021 prohibits marketing email without prior consent, and Article 7(1) GDPR requires you to be able to demonstrate that consent. A single opt-in produces no usable proof, because nothing shows the address actually belongs to the person who typed it in. That is why double opt-in is the practical standard here, even though neither law uses the word.
Yes, under conditions. Since the European Commission adopted its adequacy decision on the EU-US Data Privacy Framework in July 2023, transfers to US providers certified under that framework are permitted. You still need a processing agreement, an entry in your record of processing activities and an honest paragraph in your privacy policy. We check each of your tools for a valid certification and collect the agreements.
Correct, and we do not present ourselves as lawyers. We do the technical implementation: forms, confirmation flow, consent logging, DNS, collecting agreements, cleaning the list. The legal assessment of your specific case belongs with your lawyer or data protection officer. If you have one, we work to their requirements. If you do not, we tell you where you genuinely need one and where you do not.
The setup is € 890 once, whichever tools you use. After that you only pay your own tool licences. If you want to hand over the ongoing sending, the newsletter retainer starts at € 750 per month, but it is optional: the setup works just as well if you carry on alone.
Tell us which tools you run and where your contacts came from. In the first call we will tell you whether € 890 covers it or whether more is wrong than that - honestly, either way.
Request the setupRather read first? Get the guide
