A European email platform: where your data sits matters
A European email platform is a sending service whose servers, storage and management sit inside the European Union, so the personal data in your emails never leaves the EU. That matters because every send carries personal data — an email address at the very least — and you have to be able to show where it ends up.
2Mail is the email brand of JAAN bv, a Belgian company that has built and run its own platforms since 2000. Sending, storage, statistics and support all sit in Belgium, not with an intermediary outside the EU.
Four reasons the location of your platform matters
Not as a matter of principle, but in practice: these are the points where the difference becomes visible the moment something goes wrong or somebody asks.
Every email carries personal data
A sending list is by definition a collection of personal data: email addresses, often names, sometimes order or case numbers in the body. Who processes them and where is a question you must be able to answer — even if all you send is invoices.
A transfer outside the EU is not a detail
As soon as a provider processes data outside the EU, you need a valid basis for that transfer and you have to be able to document it. Keep everything inside the EU and that entire layer disappears — less paperwork, and less discussion during an audit.
Who can read your logs?
A sending platform stores more than the mail itself: who opened what, from which device, at what time. Ask who can inspect those logs, how long they are kept and whether tracking ends up with third parties. At 2Mail, open and click tracking runs on our own Belgian servers, without placing your data with third parties.
You remain the controller
Your provider is the processor; you are the controller. In the event of a breach or a data subject request, you are the one who has to answer within the deadline, using information your provider has to give you. A contact in your own language and time zone is not a luxury at that point.
Check in four steps how it stands with you
You do not need to wait for an audit. These four steps take half a day between them and produce answers you can act on straight away.
Find out where your sending runs today
Check your provider's terms or privacy policy for the place of processing and for sub-processors. If all you find is a parent company without a location, ask in writing — you will need that answer for your record of processing activities anyway.
Map which data you actually send
Walk through your mail types: newsletter, order confirmation, invoice, reminder. Note per type which personal data it carries. Often less is needed than is currently in there, and cutting the surplus is the cheapest measure available to you.
Ask for the data processing agreement
Any provider processing personal data on your behalf should be able to produce one, sub-processors included. Read it before you sign, not after something goes wrong. At 2Mail it is available on request.
If you move: set up authentication again
When your sending moves, your sending channel changes. Adjust the SPF record, publish the new DKIM key and check that DMARC still passes. Build the volume up gradually over the first few weeks so your domain reputation moves with you.
Six questions you can put to any provider
This page holds up no other provider as the standard and deliberately names none. What it gives you instead are the questions with which you can line them up yourself. The answers should be short and in writing.
If the first question is answered with a region rather than a country, that is information in itself: a regional label does not rule out processing elsewhere.
How 2Mail does it
What follows concerns our own platform only. It is verifiable, and you are welcome to hold us to it.
