Mailchimp and EU Data Transfers: The Answer Intuit Gave QuickBooks Users
French QuickBooks users asked whether Mailchimp can lawfully move personal data to the US, and Intuit's accepted answer points to its data processing addendum.
A privacy question raised in French on the vendor’s community pages has drawn a formal reply, and the reply reaches well beyond France. It covers every Mailchimp customer in the European Economic Area, the United Kingdom, and Switzerland. The worry underneath is a common one for small businesses: where does your marketing data actually go, and is sending it there lawful?
A question posted in French, answered for the whole EEA
The thread asked, in substance, whether running Mailchimp from France squares with European data protection law. The accepted answer, published by Intuit, does not treat France as a special case. It addresses the EEA, the UK, and Switzerland together.
That scope matters more than the flag on the original thread. The mechanics work identically whether you trade from Paris, Brussels, or Helsinki. The reply also carries the vendor’s own byline rather than a volunteer’s, so we treat it as the formal position. We have read it and set out below what it establishes, in plain terms rather than legal ones.
Does Mailchimp move your data out of Europe?
It does, and the answer says so without hedging. Mailchimp is headquartered in the United States, and its servers are located there too. Data you submit can be transferred, stored, and processed in the US. Behind that sits a second layer. Mailchimp employs third-party vendors that handle personal data on its behalf, and some of those vendors run infrastructure outside the European Union as well.
The answer notes that the full roster of sub-processors appears in the privacy documentation published alongside the terms. For anyone whose internal policy requires knowing every processor in the chain, that roster is where the chain is spelled out.
The addendum that carries the legal weight
The centerpiece of the guidance is a data processing addendum, usually shortened to DPA. Its job is to let you transfer personal data to Mailchimp in the United States and to authorize the company to process that data on your behalf. Two practical points stand out for a busy small business.
First, the DPA is woven into the standard terms of service. There is no separate document to sign and no extra step to complete. Second, acceptance is automatic: by using Mailchimp or creating an account, you agree to the terms, and the addendum comes with them. Intuit also draws a line around its own role here. The transfer channel is covered. The lawfulness of how you use it is not.
Certification first, contract terms as backup
On the legal mechanism, the answer points first to the EU-US Data Privacy Framework. That arrangement followed the transfer deal struck down by the Court of Justice of the European Union in 2020. The Mailchimp entity is covered under Intuit’s participation in that program. The coverage extends to the UK extension and the Swiss counterpart. Intuit appears by name on the framework’s public list of certified organizations.
The answer then builds in a fallback for legal risk. If the framework were ever found invalid, Mailchimp is contractually committed to the standard contractual clauses adopted by the European Commission in revised form in June 2021. Those clauses, known as SCCs, apply automatically under the DPA. They would continue to allow data protected by the GDPR to be transferred lawfully to Mailchimp in the US. No customer action is needed to switch them on.
The duties that stay with you
The addendum covers the channel between you and the vendor. It does not decide whether your list was built on a lawful basis in the first place. Under the GDPR, that remains your responsibility. Consent for email marketing, records of that consent, and a lawful ground for collecting the data all sit on your side of the fence. Intuit’s guidance states the point directly: each user must ensure their own use of the service complies with applicable law.
The short version
For QuickBooks users who also market through Mailchimp, the practical position is simple. Nothing needs signing and nothing needs switching on. The DPA applies by default, the framework certification stands, and the contractual backup engages itself.
What the answer does not remove is the obligation to email only people whose data you hold lawfully. Viewed that way, the original question was never really about France. It was about who answers for the data, and the vendor’s position is plain: the transfer route is covered, the purpose is yours.