GDPR Compliance
AT Valid is committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR) and Brazil's Lei Geral de Protecao de Dados (LGPD).
Our Commitment to Data Protection
At AT Valid, we understand that data protection is not just a legal requirement but a fundamental aspect of the trust our customers place in us. We are fully committed to protecting the privacy and security of all personal data we process.
As an email validation service, we handle sensitive data daily. This responsibility drives us to maintain the highest standards of data protection, implementing robust security measures and transparent data handling practices.
Our compliance extends to both GDPR (European Union) and LGPD (Brazil), ensuring protection for users worldwide regardless of their location.
Key GDPR Principles We Follow
Our data handling practices are built on the core principles of GDPR
Lawfulness & Transparency
We process data only with a valid legal basis and clearly inform you about how your data is used.
Purpose Limitation
Data is collected only for specified, explicit, and legitimate purposes related to email validation.
Data Minimization
We only collect the minimum amount of personal data necessary to provide our services.
Accuracy
We take reasonable steps to ensure personal data is accurate and kept up to date.
Storage Limitation
Personal data is retained only as long as necessary for the purposes for which it was collected.
Security
We implement appropriate technical and organizational measures to protect your data.
Your Data Protection Rights
Under GDPR and LGPD, you have several important rights regarding your personal data
Right to Access
You can request a copy of your personal data that we hold and information about how we process it.
Right to Rectification
You can request correction of inaccurate personal data or completion of incomplete data.
Right to Erasure
You can request deletion of your personal data under certain circumstances ("right to be forgotten").
Right to Data Portability
You can request your data in a structured, machine-readable format for transfer to another service.
Right to Object
You can object to processing of your personal data in certain circumstances, including direct marketing.
What Data We Process
Transparency about the personal data we collect and process for email validation
| Data Category | Purpose | Retention Period |
|---|---|---|
| Email Addresses | Validated to determine deliverability, syntax, and domain reputation | Configurable (default 90 days) |
| Account Information | Name, email, company for account management and support | Duration of account + 30 days |
| Usage Data | API logs and validation statistics for service improvement | 12 months |
| Billing Information | Payment processing through secure third-party providers | As required by law |
Note: Email addresses validated through our service are processed solely for verification purposes. We do not use them for marketing or share them with third parties.
Data Residency and International Transfers
What EU and UK organizations need to know before sending us a list: where it is processed, under which safeguards, and by whom.
Where your data is processed
AT Valid runs on Microsoft Azure in the Brazil South region (São Paulo), behind the Cloudflare edge (TLS termination, WAF and DDoS protection). Validation results and account data are stored in that region only.
International transfers
For customers in the EU/EEA and the UK, transfers to Brazil rely on the EU Standard Contractual Clauses (Decision 2021/914) and, for the UK, the ICO International Data Transfer Addendum, both included in our Data Processing Agreement (DPA).
Encryption and access
TLS 1.2+ in transit. Sensitive fields (integration credentials, cached validation results, payout details) are encrypted at rest with AES-256-GCM. Access is role-based per organisation and every administrative action is written to an audit log.
Controller and processor roles
For the e-mail lists you upload or send through the API, AT Valid acts as a processor on your instructions and never uses them for any other purpose. For your account, billing and support data, AT Valid is the controller.
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft Azure | Cloud hosting, databases and storage | Brazil South (São Paulo) |
| Cloudflare | CDN, TLS, WAF and DDoS protection | Global edge network |
| Stripe | Payment processing (card details never touch our servers) | United States / EU |
| Crisp | Support chat | EU |
| Google (Analytics, Ads) | Website analytics and campaign measurement — only after cookie consent | United States / EU |
Need a signed DPA or the SCCs? Write to [email protected] — our Data Protection Officer sends the current template and answers vendor-assessment questionnaires.
Data Protection Officer
Our Data Protection Officer is available to address any questions or concerns you may have about our data protection practices.
How to Exercise Your Rights
We make it easy for you to exercise your data protection rights
Submit a Request
Contact our Data Protection Officer at [email protected] with your request. Please include your full name and the email associated with your account.
Verification
We will verify your identity to protect your data from unauthorized access. This may require additional information.
Response
We will respond to your request within 30 days as required by GDPR. Complex requests may take up to 60 days with prior notification.
Additional Information
- All requests are free of charge, except for manifestly unfounded or excessive requests
- You have the right to lodge a complaint with a supervisory authority
- We maintain records of all data subject requests and our responses
- Enterprise customers can access a Data Processing Agreement (DPA) upon request
LGPD Compliance (Brazil)
AT Valid is also fully compliant with Brazil's Lei Geral de Protecao de Dados (LGPD), which came into effect in September 2020. LGPD shares many principles with GDPR, ensuring our Brazilian customers enjoy the same level of data protection.
Brazilian data subjects have similar rights under LGPD, including access, correction, deletion, and data portability. For LGPD-specific inquiries, please contact our DPO.
Ready to Clean Your Email List?
Start with 200 free credits. No credit card required.