Quanda and GDPR: how we protect and manage personal data

Quanda is a Czech platform for email campaigns, online surveys, forms and marketing automation. Quanda and GDPR in a nutshell: you are responsible for the contacts in your database as the controller of personal data, and Quanda is the processor that stores them and sends them emails on your instructions. The relationship is governed by the data processing agreement, which is part of the terms of service. The data is stored in data centres within the EU, backed up once a day and access to it is protected. For every contact, Quanda records the legal basis, purpose and validity of processing, double opt-in verification and the record of the submitted form. Your campaign then goes only to the people you may email. Here you will find, in one place, how Quanda records, manages and secures personal data, with links to all the guides, articles and courses on personal data protection.

Key takeaways

1. Quanda will notify you of a personal data breach within 48 hours at the latest and will delete your data within 30 days after the service ends.
2. The data is stored in a data centre in Frankfurt am Main, backed up once a day, and the application is accessed only over an encrypted connection.
3. For every contact, Quanda records the legal basis, purpose, validity, email status and double opt-in verification.
4. A form with consent saves the legal basis, purpose and validity to the contact by itself, and you will find the wording of the consent in Completed forms.
5. Quanda automatically removes unsubscribed contacts and contacts whose consent has expired from campaign recipients.
6. You handle a person's request about their data by exporting, correcting or deleting the contact. Quanda does not store the IP addresses of survey respondents.

In short: who is responsible for what and where the data is

• Who is the controller: you. You decide whom you email and why, and you must have a legal basis for every contact.
• Who is the processor: Quanda. It stores and sends data only on your instructions and under the data processing agreement.
• Where the data is: in data centres within the European Union, with hosting in Frankfurt am Main.
• What you need to do: obtain consent or another legal basis, record it for the contact and handle people's requests about their data.

What has changed since publication: The article was published in April 2018, a month before the GDPR took effect, as an overview of the new features Quanda had prepared because of the regulation. In October 2026 we rewrote it as a summary of everything Quanda does for personal data protection today: we added data security and location, sub-processors under the current terms of service, the new form editor, content categories on the unsubscribe page, deleting contacts, user roles and two-factor authentication.

Controller and processor: who is who in Quanda under the GDPR

The GDPR is the European Union regulation on the protection of personal data, which has applied since 25 May 2018. It distinguishes two roles, and what you are responsible for depends on which one you have.

• The controller determines why and how personal data is processed. With respect to your contacts in Quanda, that is you: you decide whom to add to the database, what to send them and on what basis.
• The processor processes data for the controller and on the controller's instructions. That is Quanda: it stores contacts, sends them your emails and evaluates your campaigns.

A data processing agreement is the contract between the controller and the processor that Article 28 of the GDPR requires. It is often called a DPA. You do not have to sign it with Quanda separately. It is concluded automatically the moment you start using Quanda, and it forms Article 10 of the terms of service. Among other things, the agreement sets out:

• What data Quanda processes. For example name, email, phone, address, contact source, survey answers and information about how the recipient handled the email.
• For what purpose. Quanda processes the data only to provide the service, not for itself. It does not combine data obtained for different purposes.
• How it protects the data. The technical and organisational measures are described in the next section.
• Who it may make the data available to. The list of sub-processors is in the table below.
• What happens in an incident. Quanda notifies you of a security breach within 48 hours at the latest.
• What happens at the end. Quanda disposes of the data within 30 days of the end of the agreement.
• Audits. You have the right to information and to an audit, announced at least 30 days in advance, no more than once a year.

If you have concluded your own written amendment to the data processing agreement with Quanda, it takes precedence over the terms of service. How Quanda handles the personal data of its own customers and website visitors is described in the Privacy policy and the Cookie policy.

Where Quanda stores personal data and how it protects it

Personal data in Quanda is stored in data centres within the European Union, and data security rests on the measures Quanda has committed to in the data processing agreement. Hosting is provided by the Linode service of Akamai Technologies, and the data is stored in a data centre in Frankfurt am Main, Germany. Quanda has been developed by Quanda International in Prague since 2012.

In the data processing agreement, Quanda commits in particular to these measures to protect the data:

• Encrypted connection. The application is accessed only over HTTPS (TLS).
• Daily backups. The data is backed up once a day.
• Restricted access. Only a limited group of people who take care of operations, development and customer support have access to customer accounts. They are bound by confidentiality and trained regularly.
• Two-factor authentication for staff. These people log in to the application administration with two-factor authentication.
• No extra copies. Quanda does not make copies of your database without your consent unless it is necessary to provide the service.
• Confidentiality. About personal data and about security measures, even after the agreement ends.

A sub-processor is another company that provides part of the service for Quanda and may have access to personal data while doing so. Under the terms of service as of 15 October 2026, they are:

Source: Terms of service, Articles 10.17 and 10.28, version effective from 15 October 2026.

Some sub-processors have their registered office or parent company outside the European Economic Area. If this means that data is transferred to a third country, it happens only under the conditions of the GDPR, that is on the basis of an adequacy decision or standard contractual clauses. If you want to be sure that your emails are sent only through European data centres, ask our support. Quanda will set up your account this way if the chosen sending service technically allows it. Quanda informs you in advance about every new sub-processor, and you have three working days to object.

Tip: You are responsible for the content of your database. Before you start a major edit of your contacts or a bulk import, make an export of your contacts. You will have your own backup of the state before the change.

What Quanda records for every contact

Processing records are an overview of on what basis, for what purpose and for how long you process a contact's personal data. Quanda keeps them directly in the contact detail, in the Sending settings section, and one contact can have several records at once, for example consent to receive news and, at the same time, legitimate interest as a customer.

• Legal basis. The legal basis is the reason under the GDPR that entitles you to process the data. In Quanda the field is called Legal title, and there are six of them: Administrator's legitimate interest, Compliance with legal obligations, Performance of a contract or negotiation of its conclusion, Consent to the processing of personal data, Public interest and Vital interest.
• Purpose of processing. The purpose of processing is the reason why you process the data, for example Sending business and advertising messages or Sending news. There are 19 purposes to choose from, including the default Not set (default), and you will find the full list with the numbers for import in the article GDPR in email marketing.
• Validity. The date until which you process the data for the given purpose. After it passes, the contact does not receive campaigns for that purpose.
• Email status. Tells you whether you may send emails to the contact.
• Double opt-in verification. A contact who confirmed their address by clicking the verification link has the Verified flag in the contact list, and in the contact history you can see when and through which form the verification happened.
• Address validation. Every new address from a form, an import, manual entry or the API is checked and gets the result Valid, Risky or Invalid. Invalid addresses never get among campaign recipients.
• Content categories. Which content categories the contact is subscribed to and which they have unsubscribed from.

The email status has four values. You use the numbers in imports and in the API:

The legal basis, purpose and validity are available in all Quanda plans. For new contacts, the form fills them in. For your existing database, you set them in bulk with an import following the guide How to import legal basis, purpose and validity of contacts into Quanda.

Caution: Until you set anything for your contacts, they have the default purpose Not set (default), with no legal basis or validity. Put your records in order before you start sending. For a large database, do it in bulk with an import.

How Quanda stores consent from forms

Consent to the processing of personal data is a freely given, specific and informed indication of wishes by which a person allows you to process their data for a given purpose. The person must give it themselves by ticking an empty checkbox, and you must be able to prove it. Quanda forms are ready for this:

1. You add a consent checkbox that is not pre-ticked to the form, together with a link to the full wording of the consent.
2. In the form automation, you choose the trigger Form was submitted with consent and the action Set GDPR details. In it, you select the legal title, the purpose of processing and the length of processing, from one day to 20 years.
3. When a person submits the form with the consent ticked, the legal basis, purpose and validity are saved to the contact together with the date and time, the source and the name of the form.
4. The whole submitted form, including the wording of the ticked consent, stays in Completed forms. This lets you prove the consent at any time.

You will find a detailed description of the triggers and actions in the help article Automation in a form and in the article Form automation. How to put a form together so that it brings in new contacts is described in the article How to create a signup form.

Double opt-in is email address verification in which a new contact confirms the subscription by clicking a link in a verification email. You turn it on in the form settings on the Double opt-in tab, and it works like this:

• The data from the form is saved and a verification email is sent.
• Until confirmation, you will not see the contact in Contacts, you cannot send it anything and it does not count towards your contact limit. The record exists only in Completed forms.
• The verification link is valid for 7 days. After the click, the contact appears in Contacts with the Verified flag.
• For anyone who does not confirm within 7 days, Quanda deletes the email and the other personal data from the form. The record in Completed forms remains, but without personal data.

Double opt-in is available in all plans and also protects your form against spam. More in the article Double opt-in: what it is and how it works and in the help article Double opt-in.

Tip: Downloading an ebook does not in itself entitle you to send a newsletter. If you also want to send people other emails, add a separate unticked consent checkbox to the form.

How Quanda controls who receives your campaign

Personal data protection in email marketing mainly means not sending an email to someone you may not email. Quanda checks this on the Recipients page for every campaign:

• Purpose of processing. In the Advanced Filter, you select the purpose the campaign relates to. Quanda keeps only the contacts that have this purpose set and valid among the recipients.
• Content categories. When you select a content category in the campaign settings, Quanda removes those who have unsubscribed from it by itself.
• Unsubscribed contacts. They never appear among the recipients, whatever tags they have.
• Expired consent. A contact whose validity has passed gets the status Do not send (consent expired) and is not included in campaigns for that purpose.
• Invalid and undeliverable addresses. Quanda removes invalid addresses and addresses blacklisted because of repeated non-delivery from the recipients by itself.

The full procedure for selecting recipients by purpose is described in the article GDPR in email marketing. How unsubscribed and blacklisted contacts work is explained in the help articles Unsubscribed contacts and Blacklisted contacts.

Unsubscribing and content categories

An unsubscribe link must be included in every commercial message. When the recipient clicks it, the unsubscribe page opens:

• Content categories. If you have created content categories in Settings, the recipient unsubscribes only from the topics that do not interest them and keeps receiving the others.
• Pause. They can take a three month break, after which they automatically return to the subscribed contacts.
• Unsubscribing from everything. Cancelling all emails is always available on the page.

After unsubscribing completely, the contact gets the status Do not send (unsubscribe) and no longer appears among campaign recipients. Unsubscribed contacts do not count towards your plan limit, and you should not delete them: after deletion, Quanda would forget that they do not want your emails, and you could add them again by mistake in your next import. More in the help article Unsubscribed contacts.

Tip: When someone replies to a bulk email saying they want to be unsubscribed, you do not have to look them up in your contacts. Just click the unsubscribe link in the quoted email in their reply.

Surveys and respondents' personal data

Online surveys in Quanda collect only what you ask for. Quanda neither collects nor stores the IP addresses of respondents.

• A survey sent in a Quanda campaign recognises the respondent. In Completed surveys you can see who answered what, and you can trigger automations based on the answers.
• A link shared outside Quanda campaigns (on your website, on social media, in an ordinary email or through a QR code) is anonymous unless you ask for contact details in the survey.
• Answers are not saved to the contact. They stay with the survey.

That is why you should send an employee satisfaction survey outside Quanda campaigns, so that it is truly anonymous. How to build a survey is described in the article 6 steps how to create a survey.

How to handle a GDPR data subject request in Quanda

Under the GDPR, every person in your database has rights they can exercise with you as the controller. In Quanda, you handle them like this:

In Quanda you can delete any single contact, even an unsubscribed one or one that has already received a campaign. The restriction applies only to bulk deletion: in bulk, you can delete blacklisted contacts and contacts for which Quanda records no links. The reasons are explained in the help article Why can't I delete all the selected contacts?

Caution: Assess every erasure request. Unsubscribing and erasure are not the same thing: if someone just does not want your emails, unsubscribing them is enough, and Quanda will remember it. Another law may also require you to keep some data, for example for accounting.

All recipients' rights and how to handle them step by step are covered in the lesson Recipient rights and how to handle them of the free online course.

Users, roles and account security

You decide who in your company works with personal data in Quanda through user roles. A user role is a set of permissions that determines what a user can see and do in Quanda.

Source: help article User roles. You set who owns a contact following the guide Contact owner.

Two-factor authentication is a login in which, besides your password, you also enter a code from an authenticator app on your phone. Even if your password fell into the wrong hands, nobody gets into your account without the code. You turn it on in your profile under Security, and the procedure is in the help article How to set up two-factor authentication. We recommend turning it on for all users who have access to contacts.

API access follows the user's permissions and your plan, and you manage the API key in Quanda, see API documentation and API key. Deleting contacts through the API is turned off by default and can be enabled by our support. If you connect Quanda to an AI assistant through the Quanda MCP server, recipients' email addresses and identifiers never leave the server.

How long Quanda keeps your data

The retention period is the time during which your data is available in Quanda. Under the terms of service:

Source: Terms of service, Articles 6.7 and 10.19.

Data kept by sub-processors, for example email delivery records, is removed according to their own retention rules.

Why Quanda checks where your contacts come from

All Quanda customers share one sending environment. When someone sends a campaign to a purchased or scraped database, it damages the reputation and deliverability of everyone. That is why Quanda:

• Approves every new registration manually.
• Discusses the source of email addresses with every new customer, including the legal aspects of personal data processing.
• Does not accept purchased, shared or machine scraped databases.
• Regularly evaluates deliverability and spam complaints for every account. The goal is deliverability above 95 % and complaints below 0.3 %. If the numbers stay worse over a longer period, Quanda suspends sending and works out the cause with the customer.

The results show in the numbers: spam complaints for campaigns sent from Quanda have stayed below 0.03 % over the last 36 months (October 2023 to September 2026), ten times below the 0.3 % limit that Google requires.

Why a purchased database does not pay off either legally or commercially is explained in the article Buying an email list.

Contact records in Quanda vs. a spreadsheet or CRM

You can also keep your email marketing contacts in a spreadsheet or in a CRM that does not record the purpose and validity of processing. The difference is in what you then have to keep track of yourself:

Where to find more about GDPR in Quanda

Everything on the Quanda website about personal data protection, in one place.

Articles

• GDPR in email marketing: consent, legal basis and contact import: when you need consent, when legitimate interest is enough and how to import legal basis, purpose and validity.
• Double opt-in: what it is and how it works: address verification and its effect on open rates.
• Form automation: consent and GDPR details in a form automation.
• Trade fair leads: how to get consent from people you meet in person.
• Buying an email list: why not to use one and what to use instead.

Free online courses

• GDPR and email marketing in practice: five lessons, from the roles under the GDPR through consent and legitimate interest, double opt-in and legal aspects of importing contacts to recipient rights.
• Collecting contacts: forms and lead magnets, lesson Double opt-in and legal compliance.
• Contact database: import, hygiene, and segmentation, lesson Contact statuses: unsubscribes and the blacklist.

Help

• Export of contacts and preparation for their import
• Double opt-in, Completed forms and Automation in a form
• Unsubscribed contacts and Blacklisted contacts
• Why can't I delete all the selected contacts?
• User roles and How to set up two-factor authentication

Documents

• Terms of service, Article 10 is the data processing agreement.
• Privacy policy and Cookie policy.

Checklist: GDPR in Quanda

Before you start sending with Quanda, check these points.

• You have read Article 10 of the terms of service, that is the data processing agreement.
• Every contact has a legal basis, purpose and validity, and none is left with the purpose Not set (default).
• Your forms have an unticked consent checkbox and the Set GDPR details automation.
• New contacts confirm their address through double opt-in.
• You select campaign recipients by the purpose of processing.
• You have set up content categories so that people do not have to unsubscribe from everything.
• You do not delete unsubscribed contacts, only those who ask for erasure.
• Users have roles matching what they need, and two-factor authentication turned on.

Recording the legal basis, purpose and validity, double opt-in, content categories and the automatic exclusion of unsubscribed contacts are part of every Quanda plan, none of them is an add-on. Forms and surveys are separate modules. The pricing page calculates the price for your database size and the modules you choose.

Conclusion

The GDPR asks you to know whose data you hold, why, on what basis and for how long, and to be able to prove it. Quanda stores the data securely in the EU for you, records everything you need for every contact and makes sure your campaign goes only to the people you may email. The decision about whom you email and why, however, remains yours.

You can go through the whole topic step by step in the free online course GDPR and email marketing in practice. This article is not legal advice, so have the wording of your consent and privacy policy checked by a lawyer. If you need help setting up your account, write to us at support@onquanda.com, call +420 605 163 892 or book a free consultation.