Security & data protection
What happens to participant data and who is accountable for it
This page is for the legal, IT, and procurement teams who have to sign off on a campaign. We state only what we can support — no certifications we don't hold.
Definition
Who is the controller and who is the processor?
In a campaign run on Recefly, the campaign organizer — the brand, or the agency where that is how the campaign is structured — is the data controller. Recefly generally acts as a processor and handles participant data only on the instructions set out in the contract and the Data Processing Agreement (DPA). The exact roles are agreed in the contract, per campaign.
What we can confirm
Where the data lives
- Campaign data is hosted on EU-based cloud services.
- The subprocessor list is available on request, during contracting.
- Each campaign runs separately, with its own data and access.
How it is protected
- Encryption in transit and at rest.
- Exports containing personal data are delivered as AES-256 encrypted ZIP archives.
- Role-based access in the platform, separated by organization and by campaign.
What documentation exists
- A Data Processing Agreement (DPA), signed before the first campaign.
- An internal security policy.
- A retention policy: campaign data is kept for the period set in the contract and the campaign rules.
Continuity
- Backups and a restore procedure for campaign data.
- Platform monitoring while campaigns are live.
- Notification of the organizer in the event of a security incident, per the DPA.
What we don't claim
We avoid claims we can't evidence. As of this page:
- We do not hold ISO 27001, SOC 2, or equivalent certifications.
- We do not publish penetration test results.
- We don't describe any platform as 100% secure, including ours.
- We don't offer legal guarantees about your campaign's compliance — that stays with the organizer and their legal counsel.
Frequently asked questions
What teams ask before their first campaign on Recefly.
On EU-based cloud services. The exact region and the subprocessor list are shared during contracting, together with the DPA.
Generally a processor. The controller is the campaign organizer — the brand or the agency, depending on how the campaign is structured. Roles are set out explicitly in the contract.
For the period set in the contract and the campaign rules. There is a retention policy, and at the end of that period data is deleted or returned, on the organizer's instructions.
The request goes to the controller, i.e. the campaign organizer. Recefly provides the tools to find, export, and delete a participant's data, and supports the controller in meeting the legal deadlines.
No — we do not currently hold ISO 27001, SOC 2, or similar certifications, and we don't claim to. We do have internal security and retention policies, encryption in transit and at rest, backups, and role-based access, and we make the documentation available during evaluation.
Need the DPA, the subprocessor list, or a security questionnaire completed?
Get in touch and we'll send them through your evaluation process, along with what your legal or IT team needs.