Vendasta now participates in the EU-U.S. Data Privacy Framework (DPF), giving customers with European Union (EU) and United Kingdom (UK) data a recognized, publicly verifiable legal basis for transferring that data to us.
A clearer, verifiable answer on EU data transfers
Why it matters
EU data protection rules require a lawful mechanism for sending personal data outside the EU. Before DPF, answering "what is your legal basis for this transfer?" meant a longer review and extra paperwork. Now, you can point to Vendasta's participation in the DPF, which you can verify on the public Data Privacy Framework List.
This sits alongside our SOC 2 Type II report, which shows how we secure the data once it's with us, and our existing GDPR compliance program.
What it means for you as an EU-selling partner
- A faster answer to the transfer question.When an EU client or their legal team asks what legal basis covers the transfer of their data to Vendasta, you can point to our DPF participation and the public listing.
- Something you can put in writing.Reference our participation in proposals, security questionnaires and procurement reviews, alongside our SOC 2 Type II report.
- A better start to the data residency conversation.Lead with DPF and SOC 2 so the discussion starts from whether the transfer is lawful and the data protected, not only where it is stored.
Who it's for
- Partners with clients or end customers in the EU or UK
- Legal, procurement, and IT teams reviewing Vendasta's data practices
- Anyone answering EU data privacy questionnaires
- Sales and customer success teams who field EU data privacy questions from clients
Learn more
- Read our DPF Privacy Notice
- Review the Vendasta Trust Center
- Verify our listing on the Data Privacy Framework List
FAQs
Q: Does this mean Vendasta is GDPR compliant?
A: Vendasta complies with GDPR requirements, and DPF covers the transfer of EU personal data to the U.S.
Q: Does this mean my data will be stored in the EU?
A: No. DPF is about lawfully transferring data, not where it is stored.
Q: What does DPF cover?
A: Transfers of EU personal data, and UK personal data under the UK Extension, to Vendasta's participating U.S. entities, as described in our DPF Privacy Notice.
Q: My client asked for EU data residency. Does DPF cover that?
A: DPF is about lawfully transferring data, not where it is stored. GDPR requires that EU data stays protected wherever it goes, not that it stays in the EU. If a client says data location is a contractual or legal requirement, contact us before making any commitment.
Q: How can my client verify Vendasta's participation?
A: Search for Vendasta on the public Data Privacy Framework List, linked above.
Q: How is DPF different from Vendasta's SOC 2 report?
A: DPF is the legal basis for transferring EU data to the U.S. SOC 2 Type II is an independent auditor's report on how Vendasta secures data. Together they answer whether the transfer is lawful and whether the data is protected.
Q: Who do I contact with questions?
A: Visit trust.vendasta.com or write to security@vendasta.com.