Choosing an email service in the UK and EU: GDPR, PECR and billing in euros

The short version

1. Who this guide is for. This guide is for teams in the United Kingdom and the European Union who send email to customers and need to be sure their email provider fits their legal and finance requirements.
2. Who is the controller and who is the processor. Under the UK GDPR and the EU GDPR, you decide why and how you use your customers' email addresses, which makes you the controller.
3. Sub-processors and where data goes. An email provider rarely runs everything alone.
4. Consent for marketing email: PECR and the EU rules. In the UK, the Privacy and Electronic Communications Regulations, usually shortened to PECR, sit alongside the UK GDPR and govern marketing email.
5. Transactional mail is a different category. A password reset, an order confirmation or a security alert is part of a service the person asked for, and it does not need marketing consent.
6. Unsubscribes, suppression and the right to erasure. When someone unsubscribes, you have to stop emailing them.

Who this guide is for

This guide is for teams in the United Kingdom and the European Union who send email to customers and need to be sure their email provider fits their legal and finance requirements. It is written for the person who has to answer questions from a data protection lead, a procurement team or an accountant, not only for developers.

It is general information, not legal advice. Your own adviser decides what applies to your business. What we can do is lay out the questions that are worth asking any email provider, including us.

Who is the controller and who is the processor

Under the UK GDPR and the EU GDPR, you decide why and how you use your customers' email addresses, which makes you the controller. An email service that sends on your behalf processes that data for you, which makes it a processor. The law expects a written contract between the two that sets out what the processor may do with the data.

In practice that contract is usually called a data processing agreement. If you process personal data of people in the UK or EU, contact us about our data processing terms for your records. Ask for them early, because procurement reviews tend to wait on this document.

Sub-processors and where data goes

An email provider rarely runs everything alone. It may use cloud infrastructure, support tooling and payment services, each of which can touch personal data. Good practice is that the provider lists these sub-processors and tells you when the list changes.

Ask us for the current list before you sign, and ask how you are told when it changes. If data is sent outside the UK or the EEA, a lawful transfer mechanism has to cover it, and the right one depends on your situation. Ask the provider which mechanism applies to your use and have your adviser confirm it before you sign.

Consent for marketing email: PECR and the EU rules

In the UK, the Privacy and Electronic Communications Regulations, usually shortened to PECR, sit alongside the UK GDPR and govern marketing email. For individuals, you generally need consent, with a limited exception for existing customers who bought something similar and were given a clear chance to opt out. Rules for messages to company addresses are different. The EU has its own national laws built on the ePrivacy Directive.

Whatever the exact rule, the safe working practice is the same. Record when and how each person agreed, say what you will send, put a clear unsubscribe in every marketing email, and act on it quickly. A double opt-in sign-up is the easiest way to keep a record you can show a regulator.

Transactional mail is a different category

A password reset, an order confirmation or a security alert is part of a service the person asked for, and it does not need marketing consent. That only holds while the message really is transactional. If you add a promotion to a receipt, regulators and mailbox providers may treat the whole message as marketing.

Keep the two streams separate in how you send them, too. Use one subdomain and sending stream for transactional mail and another for campaigns, so a complaint on a newsletter never delays a login code.

Unsubscribes, suppression and the right to erasure

When someone unsubscribes, you have to stop emailing them. To do that reliably you must keep their address on a suppression list, which can look like it conflicts with an erasure request. The usual resolution is to delete the profile and the history but keep the minimum needed to honour the opt-out, which is the address itself.

Make sure the tools you use let you do both: suppress an address so it can never be mailed again, and remove the rest of a person's data when they ask. Write down your approach in your privacy notice so the answer is the same each time someone asks.

Prices and billing in euros

MigoSMTP plans can be billed in EUR. On the pricing page the monthly plan for 10,000 emails is €9, 100,000 emails is €69 and 500,000 emails is €299. Extra emails above your monthly volume are billed at €0.92, €0.78 or €0.60 per 1,000 on Starter, Growth and Scale. There is a free plan with 1,000 emails a month.

You can pay monthly, quarterly, half-yearly or yearly. Quarterly saves 5 percent, half-yearly saves 10 percent and yearly gives two months free. If your finance team needs particular details on an invoice, tell our billing team what you need on it when you sign up. The current numbers always live on the pricing page.

Authentication and delivery still matter most

Compliance does not deliver your mail. Mailbox providers decide that, and they ask for SPF, DKIM and DMARC on your sending domain, low complaint rates and an easy unsubscribe. Google, Yahoo and Microsoft all publish requirements for bulk senders that apply to mail from the UK and EU as much as anywhere.

Set up authentication first, start with a small volume of engaged recipients, and grow in steps. Our guides walk through the DNS records and the warmup, and our team can review your setup before a large launch.

Questions to ask any email provider

Ask for the data processing terms and read them. Ask for the sub-processor list and how you are told about changes. Ask how long message logs are kept and whether you can control that. Ask how suppression and erasure requests work together, and how you can export or delete your data if you leave.

Then ask what happens when something goes wrong: how you are told, how quickly you can reach a person, and what the provider does about a customer who abuses the service. A provider that answers these plainly is usually one you can work with.

Further reading and sources

• Regulation (EU) 2016/679 (GDPR), official text
• ICO: Direct marketing and privacy and electronic communications
• Google: Email sender guidelines

Related guides and tools

• Pricing in euros: Plans from €9 a month.
• Trust and security: How we approach security and privacy.
• Mailbox provider requirements: What Gmail, Outlook and Yahoo expect.