How Do I Sign Gleam's Data Processing Agreement?

Sign our standard Data Processing Agreement (DPA) online. Go to gleam.io/privacy/dpa/sign in your browser, which opens an e-signature page.

The DPA sets out how we handle personal data for you under GDPR. When you run a campaign, you're the data controller for your entrants' data and Gleam is your data processor. The DPA includes the Standard Contractual Clauses, which cover transfers of EEA and Swiss personal data to subprocessors outside those regions. Our Privacy Policy lists the subprocessors.

You need to accept the DPA as it is. We don't offer amendments or custom versions, so your legal team can review it but can't send back a marked-up copy.

The DPA covers how we process data. Collecting consent is still your job as the controller. To ask entrants for marketing consent, turn on the Opt-in Checkbox in your Gleam Subscriber action and choose whether it shows to everyone or only to entrants in Europe.

How Do I Get Gleam's SOC 2 Type II Report?

Email security@gleam.io and agree not to share the report outside your company. We'll then send our SOC 2 Type II report and pen test letter.

How Safe Is My Data?

We run on reputable cloud infrastructure, don't show entrant IP addresses to campaign owners and hold a SOC 2 Type II report. Sign our DPA online.