Privacy FAQs - Klaviyo
2026-03-10 20:45 Diff
https://www.klaviyo.com/legal/privacy-faqs

Updated: April 17, 2025

Data Processing

1. Where can I find a copy of Klaviyo’s Data Processing Agreement (“DPA”)?

Our DPA is available online here. Klaviyo enters into a DPA with each of its customers to ensure that Customer Personal Data is sufficiently protected by contractual arrangements. “Customer Personal Data” means the Personal Data processed by Klaviyo on behalf of Customer or Customer Affiliate in connection with the provision of the Services. The DPA is incorporated into our Terms of Service, so all Customers who agree to our Terms of Service are also beneficiaries of the DPA.

2. What personal data does Klaviyo process?

Klaviyo’s Customers have full control over Customer Personal Data they upload into the Klaviyo platform. This data typically includes details such as the Customer end consumer’s names, email addresses, phone numbers, IP addresses, and cookie data. Klaviyo can only access and process this data as required to provide our Services. In the case of Customer Personal Data, it is processed strictly in accordance with the terms of our DPA.

Data Storage

1. Where is Customer Data stored? Where are Klaviyo’s Servers located?

Klaviyo currently stores all Customer Data in the United States using the AWS-East-1 data center, located in Northern Virginia.

2. How long is Customer Data kept?

Each Customer has full control over the individual data and profiles that are uploaded to the Klaviyo platform, and a Customer may delete all or part of the data at any time. Without any intervention by a Customer, the data is retained by Klaviyo until the termination of the Agreement, after which it will be deleted within 90 days from the effective date of termination.

Data Centers

Does Klaviyo offer data centers in other locations where data can be stored locally (i.e.EU, UK, Canada, etc.)?

At this time, Klaviyo does not offer any data storage in jurisdictions other than the United States.

Sub-Processors

1. Do other parties have access to my data? What do 3rd parties do with my data?

In order to provide services to its Clients, Klaviyo uses 3rd party Sub-processors who have access to Client data, including Personal Data. Our Subprocessors are bound by Data Processing Agreements (DPAs) and may only use Customer Data in accordance with Klaviyo’s written instructions, which does not permit the use of personal data for the benefit of the Sub-processor or any other Customer of Klaviyo. This is the case for most software as a service (SaaS) providers. A list of our current sub-processors, the location(s) they store and process the Personal Data form, and the purposes for which they process Customer Data is available here.

2. Klaviyo has entities in Australia and the United Kingdom; is my data stored there?

In order to provide Klaviyo Services, and to support our Customers in different regions around the world, our employees in Australia, Ireland, Singapore, and the United Kingdom may need to access (but not store) your data from those countries.

Sale/Sharing of Personal Data

1. Does Klaviyo share its Client’s customer data with anyone for advertising purposes?

Klaviyo does not sell OR share with third parties Customer Personal Data / Personally Identifiable Information (PII) from our Customers’ end-consumer lists provided to the Klaviyo platform in accordance with California’s CCPA/CPRA. This is set out in Appendix 6 of Klaviyo’s Data Processing Agreement, which we enter into with all of our Customers.

2. Does Klaviyo use my data for the benefit of its other Customers?

Klaviyo solely uses Customer Personal Data to provide the services to those Customers and not for the benefit of its other Customers. For clarity, Klaviyo may use aggregated and de-identified data, which does not identify specific Customers or individuals to improve the services, generally.

International Data Transfers and Data Privacy Framework (DPF)

1. What mechanism does Klaviyo use to transfer data to the US?

Klaviyo is a participant in the EU-U.S. Data Privacy Framework (DPF) and relies on the DPF to transfer data from the EU and the US. Additionally, the UK Extension to DPF (UK Extension to the DPF) and the Swiss-US Data Privacy Framework (Swiss-US DPF) apply to transfers of Data to personal character from the United Kingdom and Switzerland, respectively. For transfers that aren’t subject to the DPF, Klaviyo relies on the Standard Contractual Clauses (SCCs).

2. Is Klaviyo part of the EU-U.S. Data Privacy Framework (DPF) or use the Standard Contractual Clauses (SCCs)?

Yes, Klaviyo is a participant in the EU-U.S. Data Privacy Framework (DPF). Furthermore, Klaviyo is a participant in the UK Extension to the DPF and the Swiss-US Data Privacy Framework. In the event that DPF is not permitted for a particular transfer, or is invalidated as a transfer mechanism, the Standard SCCs will apply as a transfer mechanism with respect to such Personal Data. The European Commission has approved these two arrangements as valid transfer mechanisms for EU Personal Data. The UK Extension to EU-US DPF and Swiss-US DPF allows transfers of Personal Data from the UK and Switzerland respectively.

Country-Specific Privacy Laws

Does Klaviyo comply with each country’s privacy laws?

The Klaviyo platform is designed to be compliant with the EU’s GDPR, and California’s CCPA, which are amongst the most stringent privacy laws in the world. Additionally, under our DPA, Klaviyo contractually undertakes to comply with “applicable data protection laws” to the extent they are applicable to Klaviyo.

Security Measures

What measures does Klaviyo take to protect Customer Personal Data?

Klaviyo manages Customer Personal Data in accordance with our DPA entered into with all of our Customers. The DPA specifies the Technical and Organizational Measures (TOMs) and Supplementary Measures taken by Klaviyo in order to protect the Customer’s personal data. These measures are set out in Annex 2 of the DPA. Specific security documentation is available upon request.

Data Deletion

What happens if I receive a GDPR deletion request?

The Klaviyo platform allows its Customers to exercise full control and provide self-service management of all data, including Personal Data, provided to the platform. To learn more about GDPR deletions on the Klaviyo platform, please click here. Additionally, for more information on list cleanup in Klaviyo, please click here.

Sensitive Data

Can we use the Klaviyo platform to manage and store sensitive or special categories of data, for example health data?

Klaviyo’s Acceptable Use Policy prohibits the use of sensitive or special categories of data within the platform. Customers may, however, use the Klaviyo platform regarding other non-sensitive data relating to end customers.

Government Access Requests

How does Klaviyo handle law enforcement requests?

To date, Klaviyo has never received a government data access request. For more details, please refer to our Government Data Access Request Transparency Report.