GetResponse Email Marketing and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No: the terms state the AI solutions chosen ensure the model does not learn from content the customer provides.

Vendor's wording: “The AI solutions we have selected ensure that the model does not learn from the content provided by the Customer.”

Source: getresponse.comTerms of Service, 10. Artificial intelligence (AI)Checked on 19 October 2026

DPA on request.

Yes, part of the terms: accepting the Terms of Service incorporates the Data Processing Agreement as an integral part; no separate signing.

Vendor's wording: “Accepting these Terms of Service you engage GetResponse in processing of the personal data necessary to provide you with the Service on terms and conditions stipulated in Data Processing Agreement”

Source: getresponse.comTerms of Service, data processing sectionChecked on 19 October 2026

Published.

Yes, listed in Annex 3 of the DPA (https://www.getresponse.com/legal/data-processing-agreement): 4 entries (ClickMeeting, Google Cloud Poland, Microsoft Ireland, Vonage). Only AI provider listed: Microsoft Ireland (Azure OpenAI course-creator AI); terms also name OpenAI.

Vendor's wording: “the Client in particular agrees to the sub-processors listed in Annex 3.”

Source: getresponse.comAnnex 3 - List of GetResponse's sub-processorsChecked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, GetResponse S.A., Gdansk, Poland)

Vendor's wording: “Our contact details: GetResponse S.A. (Polish joint-stock company), Grunwaldzka 413, 80-309 Gdansk, Poland.”

Source: getresponse.comController identificationChecked on 19 October 2026

Paid account: data kept 120 days after deactivation for reactivation, then deleted from the main database and kept encrypted in backups for another 120 days. DPA allows copying data up to 60 days after deactivation. AI prompt retention not stated.

Vendor's wording: “When you deactivate your Free Account, we’ll store your Data for 30 days and when you deactivate your Paid Account, we’ll store your Data for 120 days”

Source: getresponse.comPrivacy policy, how long we store dataChecked on 19 October 2026

PCI DSS (payment data) is the only certification named; no ISO 27001 or SOC 2 named in the page text.

Vendor's wording: “GetResponse is PCI DSS certified, demonstrating that we meet stringent requirements for protecting payment data and maintaining secure systems and processes.”

Source: getresponse.comPCI DSS CertificationChecked on 19 October 2026

€44.28 / mo.

€44.28 per month when billed annually (€54 per month billed monthly); prices shown are net amounts, local taxes may apply. Depends on the plan's contact list size.

Vendor's wording: “Paid annually, save up to €117 a year”

Source: getresponse.comMarketer plan cardChecked on 19 October 2026