GetResponse
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Gdańsk-headquartered Polish email marketing and automation platform with webinars, landing pages, and a 350k+ customer base.
GetResponse offers EU hosting in Poland, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Email marketing.
Assessment notes
Polish S.A. headquartered in Gdańsk that publishes a self-serve DPA with a named sub-processor annex, sends from its own IP ranges rather than a third-party deliverability vendor, and relies on SCC for transfers outside the EEA; but the annex carries three US-owned sub-processors (Google Cloud Poland for chats, with processing locations including the USA; Microsoft Ireland for the AI course creator; Vonage Business Inc. for SMS), the group includes a US entity, and GetResponse still does not disclose where it hosts primary subscriber data. EU-owned with a public DPA and named sub-processors, but an undisclosed hosting location and three US-owned sub-processors keep exposure material.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About GetResponse
GetResponse is a Polish email marketing and automation platform headquartered in Gdańsk, founded in 1998 and operating as the joint-stock company GetResponse S.A. (KRS 0000942075, ul. Grunwaldzka 413, 80-309 Gdańsk) with VAT ID 9581468984. The company converted to a joint-stock structure in 2022 and is held by founders, employees (via ESOP), and earlier investors rather than publicly traded on the Warsaw Stock Exchange. With more than 350,000 customers worldwide, GetResponse is one of the largest EU-headquartered email marketing platforms.
The product spans email marketing, marketing automation, landing pages, conversion funnels, paid ads, push notifications, and webinars, making it a broader Mailchimp/ConvertKit alternative for SMB and mid-market customers who also want webinar functionality. Security disclosures on the trust page cite PCI-DSS certification, GDPR compliance, TLS 1.2+ in transit, AES-256 at rest, role-based access control, MFA enforcement, and 24/7 SOC monitoring; ISO 27001, SOC 2, EUCS, and C5 are not advertised on the public security page. The privacy policy (effective 17 Mar 2026) refers to processing "mainly in the European Economic Area" and still does not name the underlying hosting provider, but the DPA is publicly readable and its Annex 3 is a named sub-processor table: ClickMeeting Sp. z o.o. (Gdańsk, webinars), Google Cloud Poland (chats, with processing locations including the USA), Microsoft Ireland Operations Limited (the AI course creator) and Vonage Business Inc. (New Jersey, SMS). Three of the four are US-owned by ultimate parent. No hyperscaler appears as GetResponse's own storage sub-processor, and the sending domain's SPF record resolves to GetResponse's own IP allocations rather than to any third-party deliverability vendor, both consistent with the long-standing claim that it runs its own infrastructure.
Pricing in EUR is straightforward: Starter at €16/month billed monthly or €13.12/month billed annually at the 1,000-contact rung, with Marketer and Creator above it on the same ladder. Entry access is now presented on the pricing page as a 14-day trial with no credit card required, and the restricted always-free plan is no longer surfaced there, so buyers counting on it should confirm with the vendor that it still exists. The product UI supports nine languages including PL, EN, DE, FR, ES, IT, PT, plus VN and RU. Best fit: SMB and mid-market marketers in Central and Eastern Europe wanting a Polish-headquartered all-in-one platform with strong language coverage. The DPA and its named sub-processor annex are both publicly readable, so the remaining transparency gap is narrower than it looks: GetResponse still does not disclose where it hosts primary subscriber data, and that is the question to put to the vendor before signing.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of GetResponse
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
France · €8/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €15/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
United Kingdom · €0/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Brevo
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€8/mo |
CleverReach
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€15/mo |
EmailOctopus
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€0/mo |