GDPR Mailjet
In an indie stack, Mailjet is used for Transactional emails and campaigns. Entity cited: The policy presents itself as Sinch Email (brands Mailgun, Mailgun Optimize, Mailjet and Email on Acid) and states that processing may be carried out by Sinch Email or other controllers in the group. The Sinch sub-processor list names Mailjet SAS, 43 rue de Dunkerque, 75010 Paris, for Mailjet support and operations. The published DPA is concluded with the Sinch entity of the contract.. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 5, 2026. Verified on October 5, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Mailjet
Yes. The Mailjet help center states that the agreement is part of the terms of service. The public text consulted is the Sinch DPA (version 8, 29 October 2025), which provides for standard contractual clauses for restricted transfers.
Stated role
The policy characterizes Sinch Email as controller for the data of customers and of site visitors. The Sinch DPA (version 8, 29 October 2025) says in §4 that the customer is controller and Sinch is processor, or sub-processor if the customer already is. §3(a)(iv) also says that, for communication services including email, Sinch acts as an independent controller, in particular against spam and fraud, and for network security and compliance.
Personal data
The policy cites name, company, email, postal address, other contact details, domain name, card information, login identifiers, subject and body of emails sent, and recipient contacts. The Sinch DPA cites name, email, phone, IP address, and other personal data in contact lists and message content. Data subjects according to the DPA: senders and recipients.
Sub-processors of Mailjet
Public Sinch list, filterable by service. For Mailjet, it names in particular Google Cloud France SARL (data centers, EU Germany and Belgium), Mailjet SAS (France), Mailgun Technologies, Inc. (United States), Stripe Payments Europe, Limited, Atlassian Corporation, and Zendesk, Inc. The group's full table is not copied here.
Transfers outside the EU
Hosting / location
The policy indicates hosting at Google Cloud Platform, AWS, MacStadium, and Rackspace, in the United States or in Europe depending on the deployment location chosen, with no transfer between those distinct data centers. The security page indicates Google Cloud storage in Frankfurt and in Saint-Ghislain. The Sinch list places, for Mailjet, Google Cloud France SARL in the EU (Germany and Belgium).
EU–United States Data Privacy Framework
Mailgun Technologies, Inc., a US company of the group cited by the Mailjet policy, is registered. EU-U.S. Data Privacy Framework status: Active (non-HR data). United Kingdom extension: Active. The Swiss-U.S. DPF is not indicated on that entry. The registration covers that US entity, not Mailjet SAS.
Cookies
The policy describes cookies, web beacons, and similar technologies for login, preferences, usage tracking, and audience measurement, and refers to an information page. Names: not disclosed.
Typical use, written by StackLégal and not by the vendor: Transactional emails and campaigns.
History
Last update: October 5, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 5, 2026.
Frequently asked questions
Is Mailjet a processor within the meaning of the GDPR?
The policy characterizes Sinch Email as controller for the data of customers and of site visitors. The Sinch DPA (version 8, 29 October 2025) says in §4 that the customer is controller and Sinch is processor, or sub-processor if the customer already is. §3(a)(iv) also says that, for communication services including email, Sinch acts as an independent controller, in particular against spam and fraud, and for network security and compliance.
What DPA does Mailjet publish?
Yes. The Mailjet help center states that the agreement is part of the terms of service. The public text consulted is the Sinch DPA (version 8, 29 October 2025), which provides for standard contractual clauses for restricted transfers. https://sinch.com/legal/terms-and-conditions/other-sinch-terms-conditions/data-processing-agreement/
Which further sub-processors does Mailjet publish?
Public Sinch list, filterable by service. For Mailjet, it names in particular Google Cloud France SARL (data centers, EU Germany and Belgium), Mailjet SAS (France), Mailgun Technologies, Inc. (United States), Stripe Payments Europe, Limited, Atlassian Corporation, and Zendesk, Inc. The group's full table is not copied here. https://sinch.com/legal/data-protection-agreement-sub-processors/
Where does Mailjet state that it processes data, including outside the EU?
The policy indicates hosting at Google Cloud Platform, AWS, MacStadium, and Rackspace, in the United States or in Europe depending on the deployment location chosen, with no transfer between those distinct data centers. The security page indicates Google Cloud storage in Frankfurt and in Saint-Ghislain. The Sinch list places, for Mailjet, Google Cloud France SARL in the EU (Germany and Belgium).
Is Mailjet registered under the EU–United States Data Privacy Framework?
Mailgun Technologies, Inc., a US company of the group cited by the Mailjet policy, is registered. EU-U.S. Data Privacy Framework status: Active (non-HR data). United Kingdom extension: Active. The Swiss-U.S. DPF is not indicated on that entry. The registration covers that US entity, not Mailjet SAS. https://www.dataprivacyframework.gov/participant/1738
Which personal data does Mailjet mention?
The policy cites name, company, email, postal address, other contact details, domain name, card information, login identifiers, subject and body of emails sent, and recipient contacts. The Sinch DPA cites name, email, phone, IP address, and other personal data in contact lists and message content. Data subjects according to the DPA: senders and recipients.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.