Klaviyo and data protection: checking consent, data and responsibilities

Start by reviewing your current setup

Note down where your shop collects information: checkout, newsletter form, customer account, import, support or a connected tool. For each source, note down which fields and events are sent to Klaviyo and what they are used for there. A purchase event and consent for marketing emails are different pieces of information.

Start with a controlled test profile. Check the details in the shop and then in the Klaviyo profile. Do the timestamps, source and status match? Does the profile contain additional details that did not appear in the visible form? This approach makes the actual data capture tangible. A general list of available integration features is no substitute for this check.

What needs to align in marketing consent?

For advertising by electronic mail, Section 7 of the UWG generally requires prior express consent. The exception for existing customers in paragraph 3 requires several conditions to be met simultaneously: an address obtained in connection with a sale, advertising for the company’s own similar offers, no objection, and clear information regarding the right to object at the time of collection and on every occasion of use. Furthermore, no costs other than the transmission costs in accordance with standard rates may be incurred in connection with the objection. Check the specific case; an existing order alone is not sufficient proof.

Document the text, the source and the time of registration, as well as the technical confirmation. The Guide to forms and double opt-in describes the test procedure. When importing data, ensure verifiable provenance. A status set within the tool does not retrospectively establish missing evidence.

Check data processing and the service providers involved

Klaviyo publishes a data processing agreement and information on the legal framework. Match these documents to the account you actually use and the services you have subscribed to. Also check the connected service providers, access rights and contractual roles. A plugin may introduce a further provider into the data flow.

Make a note of who in the team manages account rights, who approves new integrations and who reviews changes to data usage. The available contracts form the basis for this review. They do not confirm the blanket legality of every shop, every import list or every tracking configuration.

View form, cookie settings and tracking together

A form can capture consent for advertising, whilst website tracking operates via other settings. Check both processes separately and then in context. Test the page before a selection is made in the cookie banner, after refusal, after consent and after withdrawal of consent. Document which services and events are active in each case.

Also check the visible information: privacy notices, form declarations and the data actually collected should all match. For additional profile attributes, apply a simple working question: what specific decision does this field improve? If no necessary purpose can be identified, the field does not automatically belong in the data collection.

Define processes for unsubscribes, access requests and deletion

Unsubscribing from the newsletter, suppressing a mailing and deleting a profile are different actions. Use a test profile to check what each action triggers and whether connected systems adopt the desired status. Designate a responsible person and establish a traceable process for handling requests for information and erasure.

In the event of a complaint or formal notice, save the relevant enquiry, registration documents and the settings in question. If necessary, halt the process in question in a targeted manner and refer the legal assessment to the relevant specialist. An automatically generated reply or the thoughtless deletion of supporting documents may complicate the resolution of the matter.

Define the next check clearly

1. Select a data source and the purpose.
2. Track a test profile from the shop to Klaviyo.
3. Reconcile consent records and visible text.
4. Map contracts, providers and access rights.
5. Check opt-out, withdrawal and requested rights.
6. Document outstanding issues, including responsibility and deadlines.

The guide assists with organisational and technical assessments. Legal approval for your specific data processing must take into account its specific structure.