privacy gdpr website
GDPR: Do I have to mention MailChimp in the privacy policy of a website if the registration form is only linked?
<p>If I use MailChimp to send out newsletters and on my website I link to the registration form hosted on the MailChimp server, but don't embed it, do I need a MailChimp section in the privacy policy of my website to comply with the GDPR?</p>

<p>The question is who is the Data Controller, and who is the Processor.</p>

<ul>
<li><p>If whatever MailChimp does is unrelated to you, then both you and MailChimp are Controllers. You are not responsible for MailChimp's compliance.</p></li>
<li><p>If MailChimp processes personal data on your behalf, you are the Controller and they are a Processor. Users do not have a direct legal relationship with the Processor. It is the Controller's obligation to ensure the Processor's compliance (e.g. by signing a data processing agreement) and to inform users.</p></li>
</ul>

<p>Here, you clearly use MailChimp as a processor to handle newsletters on your behalf. How you implement this technically (embedding vs linking) is not relevant for the GDPR compliance aspect.</p>

<p>Also note that from the perspective of the user they would be signing up for your newsletter, not for a MailChimp account. A related but much more difficult example would be if you use a social media platform for sending your updates, e.g. a Facebook group or Medium page. There, the platform would be both Controller regarding the user accounts but might also be a Processor regarding your group or page.</p>
