Loading the page...

Make a data request

Submit Request  →

Data Processing Agreement (DPA)

View and Sign DPA  →

Compliance Checklist

Data Security
Status Task Description
Completed Take data protection into account at all times
Completed Create an internal security policy for your team members, and build awareness about data protection.
Completed Ensure Access to Backups is Restricted
Completed Ensure Backups are Stored in on Encrypted File Storage
Completed Uses SSL (TLS) for secure communications
Accountability and Governance
Status Task Description
Completed Designate someone responsible for ensuring GDPR compliance across your organization.
Completed Briefed all Staff on GDPR Impact to the organization
Completed Informed all Employees and Contractors about GDPR Compliance
Privacy Rights
Status Task Description
Completed It's easy for your customers to request and receive all the information you have about them.
Completed It's easy for your customers to correct or update inaccurate or incomplete information.
Completed It's easy for your customers to request to have their personal data deleted.
Completed It's easy for your customers to receive a copy of their personal data in a format that can be easily transferred to another company.
Status Task Description
Completed Offer a way to easily sign a Data Processing Agreement with Encharge


In order to provide its services, Encharge LTD may engage third parties or other members of the Encharge LTD corporate group (affiliates) to carry out data-processing activities that involve access to customer data. These organizations, called “subprocessors,” are identified below with their locations and the types of services they provide to Encharge LTD.

Name Country Description Type of Service Mandatory
Amazon Web Services EMEA SARL Encharge uses an AWS data center in Ireland to host all of our app's data. Required
Any explicitly appointed 3rd parties Due to the nature of Enchare's software, 3rd party partners can be explicitly appointed by you by the act of connecting your Encharge's account to your account with the 3rd party partner, either through Encharge's interface or through the 3rd party partner interface. By explicitly appointing 3rd party partners, you agree to allow Encharge to transfer any information needed to provide the Encharge services. You might at any time remove the connection between your Encharge account and 3rd party partners appointed by you. Required
Twilio Inc Encharge utilizes Twilio Sendgrid to send email messages for certain customer accounts. Please note that Twilio's infrastructure is located in the US. If you require your full account data to remain in the EU, please contact us to ensure that your account doesn't utilize email sending via Twilio. Not Required
ComplyDog Hosts the GDPR page you are currently viewing. Not Required
HubSpot Encharge uses HubSpot to manage our operations and communicate with our users and customers. Not Required
HelpScout Encharge uses Help Scout to serve our help documentation and to communicate with our users to answer support requests. Not Required
ConvertFlow Encharge uses ConvertFlow to serve forms, quizzes, and popups on the Encharge marketing site. Not Required
Meta Encharge uses the Meta Pixel to track performance of our ad campaigns on the Encharge marketing Site Not Required
First Promoter FirstPromoter is used by Encharge to run affiliate, influencer and referral marketing programs. Not Required
Segment.com Segment is a Customer Data Platform (CDP), which is used by Encharge to collect and use data from the users the Encharge App and marketing site. Not Required
Hotjar Hotjar is a tool that allows to visualize and map how users engage with a site. Not Required
Google Analytics Google Analytics is used to measure how users interact with the Encharge site. Not Required
Google Tag Manager Google Tag Manager (GTM) is a tool that allows website owners to manage and implement various code tags on their website. Not Required
NitroPack Used to provide a faster experience on the Encharge marketing site. Not Required


Please see our frequently asked questions below. Please keep in mind that this is not legal advice and we recommend consulting with your internal compliance team or privacy attorney for guidance on compliance matters. Encharge LTD is committed to helping our customers comply with applicable laws, but we cannot guarantee that your use of our products will be fully compliant. As always, we recommend seeking professional legal counsel for any specific questions or concerns.

Should I get consent from a customer to collect their personal data?

It is always good practice to receive explicit consent from your customer, as certain laws and regulations (such as the GDPR) require consent prior to collecting personal data of certain individuals (such as those in the EU).

It is also important to note that under GDPR, consent is one of a number of legitimate interests for processing data. Others include the need to process for the performance of a contract, the need to process in order to comply with a legal obligation, and the need to process in order to protect the vital interests of the data subject or another natural person. Full details can be found in Article 6 of GDPR.

Can I modify personal data?

Yes, you can modify all data to correct personal data as required by GDPR when you receive a Subject Access Request, or for other reasons. Simply contact us and we will work with you to make the adjustments.

Can I delete personal data?

Yes, you can delete any data, including data that contains personal data, as required by GDPR. You can also remove all other requested customer data by sending us a data request.

Is personal data permanently deleted when I remove it?

Yes, the deletion is permanent and unrecoverable.

How long is personal data retained in Encharge LTD if I don’t delete it?

Encharge LTD’s philosophy is that customers own and control all the data they collect. Any retention period required by law or your company policy is controlled by you.

You should ensure that all people and personal data are deleted prior to stopping your usage of Encharge LTD, especially if required by policy, law, or regulation.

Does my data get included in backups, and if so, for how long?

Yes. Encharge LTD backs up all customer data, and retains the backups for 90 days. After 90 days, the backup is deleted.

Can I delete customer’s personal data from Encharge LTD backups?

No. The backup dataset contains all customer data, and is used for disaster recovery purposes only. This is required for legal and compliance reasons related to availability obligations. Any personal data in these backups will be permanently deleted after 90 days.

If my data centre is located in the EU, does Encharge LTD transfer my personal data outside the EU at any point?

Our data centers are with Amazon Web Services in Ireland.

Does Encharge LTD ensure that my data is accessed only by employees with reasonable justification for doing so?

As required by GDPR, only qualified Encharge LTD employees with a specific need are permitted to access your account. The typical reason for accessing your account would be upon your specific request for support.

Does Encharge LTD use sub-processors that process my data?

Encharge LTD presently uses sub-processors to provide the service. As required by GDPR, Encharge LTD maintains a list of those sub-processors here.

If a data breach occurs with the Encharge LTD platform that affects my data, how and when will I be notified?

If a confirmed data breach occurs that is caused by Encharge LTD’s actions or inactions, we will, without undue delay, notify the account owner. Information about the breach will be released as it becomes available, as allowed by GDPR. The account owner will be the main point of contact for all notifications, and will be kept aware of the investigation and remediation efforts as they progress.

How can I comply with a Subject Access Request and portability as required by GDPR?

As you know about the data you are collecting, you are responsible for handling any Subject Access Request (SAR). Encharge LTD only provides the platform and wouldn’t know the details about your customizations, properties, or your customers.

A SAR means that a customer is asking about information being collected about him or her. If you collected personal data of an EU citizen or a person residing in the EU, you may have a legal obligation to respond to a SAR.

Data may be downloaded in industry-standard formats for data portability to comply with GDPR.

If Encharge LTD receives a SAR, it will do its best to contact the owner. It may not always be possible to know what who the rightful owner is.

How do I comply with a Subject Access Request to “be forgotten?”

Similar to the above, you know what data you have. If you collected personal data of an EU citizen or a person residing in the EU, you may have a legal obligation to respond and comply with a request to delete all identifiable data.

As previously stated, you have the ability to delete a customer's data.

How does Encharge LTD comply with its GDPR obligations to return or destroy all EU personal data?

Encharge LTD provide easy ways to download all your data in industry-standard formats. And, as previously described, you may easily delete data, and entire histories for a customer.

How does Encharge LTD comply with its GDPR obligations to encrypt personal data?

All data stored in our primary databases and backups are encrypted using an industry standard strong cipher. All data transmitted to the Encharge LTD platform are encrypted using the industry standard TLS protocol.

How can I ensure my customers that Encharge LTD security meets applicable law and the GDPR (Article 32)?

Encharge LTD is committed to safeguarding your data. We use sophisticated controls during processing to maintain the confidentiality, integrity, availability, and resilience of your data. Our Security page outlines the details of our application security, network security, policies, and more.

As related to Article 28 in the GDPR, Encharge LTD will only process personal data according to your instructions. In other words, the commands you use in the product are the “instructions,” and Encharge LTD does not use personal data for any other means. In addition, it does not transfer personal data to a third party without your consent. If personal data is transferred from the EU to a third country, then adequate safeguards will apply to the transfer (such as the EU-US Privacy Shield Framework).

Encharge LTD has developed recovery procedures to minimize downtime related to a disaster, with the ability to restore access to personal data in a timely manner in the event of a physical or technical incident.

We regularly test, assess and evaluate the effectiveness of our technical and organizational measures to ensure the security of the processing.

GDPR compliance powered by ComplyDog