Lawful basis and transparency
Determine whether you rely on consent, contract performance or legitimate interest. Keep privacy notices and preference centers up to date.
Promotional use often hinges on consent; transactional flows may rely on contract necessity.
Retention and minimization
Set retention for logs and message bodies; pseudonymize where feasible and enforce least-privilege access.
International transfers
Ensure appropriate safeguards (SCCs, adequacy decisions) if subprocessors process data outside the EEA.
Vendor responsibilities
Review the vendor privacy policy and DPA to understand processor obligations and your duties as controller.