Skip to content

Data protection

This is not legal advice

It is a description of what the plugin does, and the reasoning behind why it is built that way. Whether your particular use is lawful, and what has to be in your privacy policy, depends on your case — and only you know it.

The starting point

wpNewsletterGermany is built for operators in German-speaking countries, and that shows in the decisions:

  • The data does not leave your installation. The subscribers live in your WordPress database, mail goes out over your mail route. There is no service provider you entrust addresses to, and therefore no data processing agreement you would have to conclude.
  • No IP addresses, no user agents. Nowhere — with one single, disclosed exception, see below.
  • Measuring is off out of the box. You have to switch open and click tracking on individually.
  • The plugin calls no server of the manufacturer at runtime. The one exception is the update access of the paid package: once an access key is entered, the backend asks our server for updates and whether the key is valid for this domain. Transmitted are the key, the installed version and the address of your website — never any subscriber data.

The four things you should do

1. Look at what is stored on your installation

Newsletter → Configuration → Data collected. The page shows it per area — for the core and for every module running in your installation. What is there is text you can adopt into your privacy policy.

See What the plugin stores.

2. Adopt the suggested text from WordPress

Settings → Privacy in the WordPress menu. The plugin puts a ready-made suggestion there covering:

  • the e-mail address and the other data from the subscription form, stored until unsubscription,
  • for every sent newsletter, who it went to and when,
  • with open tracking on, additionally the time of opening,
  • for undeliverable mail, the information from the bounce message,
  • that the data does not leave this website.

3. Publish the privacy page

WordPress creates it as a draft. As long as it is not published,

  • the reference in the subscription form is omitted,
  • the reference in the subscription mails is omitted,
  • the placeholders %privacyurl% and %privacylink% stay empty.

That is deliberate — a link to nothing would be worse than none at all. But it also means: without a published page, your form lacks the notice required by Art. 13 GDPR.

4. Serve over https

A subscription form transmits an e-mail address, often with a name. Over http that goes over the wire in clear text. Every host offers a certificate free of charge.

Disclosure, export and erasure

The plugin hooks into the WordPress privacy tools. You do not have to set anything up for it.

Tool What it does
Tools → Export Personal Data For one mail address, outputs what is stored
Tools → Erase Personal Data Deletes the subscribers for that address, with everything attached

The export is grouped:

Section Content
Newsletter subscription Salutation, name, postal address, e-mail address, subscription and confirmation time, status, groups — and the consent record including the wording
Newsletters sent Which newsletter, when sent, with tracking on when opened and how often
Links clicked With click tracking on, with times and counts
Further data from the subscription form The subscriber variables
Undeliverable mail Time, address, subject, headers and text of the bounce

Empty fields are left out. If a module is missing, its section is missing.

Take this route rather than deleting in the subscriber list

Both delete completely. But the route through Tools documents the process — with a confirmation by the person concerned and a record you can produce if it is ever disputed.

Several entries for one address

The subscriber table enforces no uniqueness on the mail address. If there are several entries for one address, all of them appear in the export, and all of them are deleted.

What goes with a deleted subscriber
the subscriber name, postal address, e-mail address, status
their group assignments
their consent record
their delivery rows including open timestamps and open counts
their clicks
the values of their subscriber variables
their bounce entries

The wording of the consent stays — it belongs to the remaining subscribers and carries no personal reference.

Two of these are new in 2.0

Up to 1.1.4 the delivery rows and subscriber variables were left behind. With open tracking on that meant: the record of when a deleted subscriber opened which newsletter stayed in the database. That has been fixed.

The one exception about IP addresses

The bounce processing module stores the complete headers of an undeliverable mail, and those contain the addresses of the mail servers involved.

That is the only place where IP addresses end up in the database. They are the only thing that shows why a mail did not arrive.

The exception is out in the open rather than hidden: under Newsletter → Data collected the module names it explicitly.

Next