GDPR in practice: how to handle data requests and document consent in Flexmail

When someone asks you for a copy of their data, or submits a request to be forgotten, it can feel overwhelming, especially if you use multiple tools. This article explains exactly what your responsibilities are as a Flexmail customer, what Flexmail stores about your contacts, and how you can find and use that information to respond to common GDPR requests.

Understanding your role

Under the GDPR, you are the data controller. That means you are responsible for deciding why and how the personal data of your contacts is processed. Flexmail is your processor: we process data on your behalf and on your instructions, as set out in our Data Processing Agreement (DPA).

In practice, this means that when one of your contacts submits a GDPR request to you, you are the one who must respond. Flexmail provides you with the tools to do this.

What data does Flexmail store about a contact?

Before you can respond to a request, it helps to know what information Flexmail actually stores. For each contact in your account, Flexmail can store the following:

Email address and any contact fields you have set up (name, phone number, company, custom fields, and so on)
The source or sources through which the contact was added to your database. If they subscribed through a Flexmail opt-in form, Flexmail automatically records which form was used. If you imported them manually, you can add a source label yourself.
Interests and segments the contact belongs to
Campaign history: which emails a contact received and clicked. Flexmail tracks opens for contacts who did not explicitly say "No" and, if the open tracking consent policy is active, only for contacts with consent set to "Yes".
Unsubscribe events: whether they clicked an unsubscribe link and when

This data is stored in your Flexmail account for as long as your account is active.

Pulling a full data report for one contact

If a contact submits a right of access request (they want to know what data you hold about them), here is how to find everything Flexmail has on that person.

Go to Contacts in the main navigation.
Look up the contact by email address.
Open the contact's profile. Here you will see all contact fields, sources, and interests linked to this person.
For campaign history, go to Contacts → Contact reports → Start a new search, enter the email address, tick all items, and choose a time frame. This generates a contact report with:

- Date of import or subscription

- Opt-in form used (if applicable)

- Campaigns sent to this contact

- Opens and clicks

- Unsubscribe link clicks

You can use this report as the basis for your response to the data subject. Keep in mind that you may also need to gather data from other tools you use alongside Flexmail, such as your CRM, webshop, or analytics platform.

How consent is documented in Flexmail

Documenting consent is one of the most common questions we receive. Here is how Flexmail helps you with this.

When a contact subscribes through a Flexmail opt-in form, Flexmail automatically records the name of the form as a source in the contact's profile. This tells you where and how the contact entered your database. The form itself serves as the moment of consent: the contact actively completed and submitted your form.

When you import contacts manually, you are responsible for documenting consent outside of Flexmail (for example, a signed paper form, a checkbox on your own website, or a record in your CRM). When importing, add a meaningful source label, such as 'Trade Fair Brussels – May 2024' or 'Webshop checkout opt-in – Q1 2025'. This makes tracing consent much easier later on.

The consent log on the contact record shows the timestamp (UTC), the new value, the source of the choice, and a remark for each change to the open tracking consent. Use it to prove when and how a contact made their choice. If you import consent or send it through the API, you are responsible for its validity yourself.

Support tip Add a source every time you add contacts to Flexmail, whether through a form, an import, or an API connection. A contact can have multiple sources if they signed up more than once through different channels. The more accurate your source labels, the easier it becomes to demonstrate when and how you obtained consent.

Why deleting contacts is almost always the wrong choice

It can be tempting to delete contacts from Flexmail to restructure your database and start fresh, to stay within your current contact limit, or simply because someone unsubscribed and you feel there is no reason to keep them. In almost every case, deleting a contact causes more problems than it solves.

You lose all historical data permanently.

When you delete a contact, everything Flexmail collected about them disappears: the sources, the campaign history, which emails they received, which links they clicked, and when they unsubscribed. If you re-import that contact's email address later, Flexmail treats them as a completely new contact with no history. There is no way to link them back to their previous record.

Previously sent emails no longer work correctly for that person.

The tracked links in campaigns you already sent continue to work as regular links, so the recipient can still click through to your website. However, Flexmail can no longer log those clicks against a contact profile, because the profile no longer exists. More importantly, if that person clicks an unsubscribe link in an older email, the unsubscription has nowhere to go. They will not be added to your blacklist, which means they could receive emails again in a future send or import. This is precisely the outcome the blacklist exists to prevent.

You lose your opt-out protection.

When a contact unsubscribes through a Flexmail email, they are added to your blacklist. The blacklist is what prevents you from accidentally contacting them again, even if their email address appears in a future import or CRM sync. If you delete a contact instead of letting the blacklist do its job, that protection disappears completely.

What you can do instead.

If a contact has unsubscribed, leave them on the blacklist. If you are approaching the contact limit, remember that a growing audience is a good thing. Email marketing has the highest ROI of all marketing channels, and your contact list is one of the most valuable business assets you own. The goal is to send strong campaigns and consistently bring people back to your website and products. If you genuinely need to reduce your contact count, focus on deleting hard bounces and addresses that were never engaged. You can also contact our support team to discuss the right approach for your situation.

Caution The only situation where deleting a contact is appropriate is when you receive a verified right to erasure under the GDPR. Even then, make sure you export the contact report first and keep a record in your own administration that the deletion was completed.

How to handle a right to erasure ('right to be forgotten')

If a contact asks you to delete all their data, this is the recommended approach in Flexmail:

Look up the contact in your Contacts overview.
Before deleting, export the contact report (see above) and save it in your own records. You may need to demonstrate that you processed the deletion request.
Delete the contact from Flexmail.

Warning deleting a contact removes their data from your active database, but it also removes the opt-out history. If there is a chance this person ends up in a future import, keep a note in your own administration that this email address must not be contacted again. Your DPA with Flexmail does not automatically cover data kept in other systems, so make sure you also delete or anonymise the contact in your CRM, webshop, and any other tools you use.

Many Flexmail customers use Flexmail alongside other tools. Here is a simple checklist to work through when you receive a GDPR request:

Export the contact report from Flexmail
Check your CRM for data linked to this person
Check your webshop or booking system
Check any other integrations (Zapier, API connections, analytics tools)
Document that you completed the request and the date on which you responded

Under the GDPR, you have one month to respond to a request from a data subject.

What Flexmail's DPA covers

When you use Flexmail, you automatically agree to our Data Processing Agreement. This agreement confirms that:

Flexmail processes your contacts' data solely on your instructions
All processing takes place within the European Union or in countries with an adequate level of protection
Flexmail will assist you if a data subject contacts Flexmail directly about their data
You remain responsible for the lawfulness of the data you provide to Flexmail, including whether you have valid consent

If a data subject or a supervisory authority ever asks you to demonstrate that your email marketing complies with the GDPR, your DPA with Flexmail is one of the documents you will want to have on hand.

Next steps

Now that you understand how consent is recorded and how to handle data requests, a good next step is to review your current opt-in forms in Flexmail and verify that each form has a clear, descriptive source label. You can also check your import history to ensure past imports have meaningful source labels.

If you have questions about a specific GDPR scenario or need help pulling a contact report, our support team is happy to help.