Brevo: DPA, subprocessors and data location

Where to find the Brevo DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: email and sms marketing and transactional messaging. The table is the short version; the sections below add detail.

Brevo at a glance

Notes on Brevo

Brevo's DPA is part of its Terms of Service (version October 1st, 2025), so it applies without a separate signature, and the sub-processor list is Annex 2 inside the same document.

Section 7.3 gives email or in-account notice before a new sub-processor is authorized, with no number of days. If you object on EU data protection grounds you can terminate the Terms during 30 days following the notice.

Hosting is in France (OVH) and Belgium (Google Cloud Platform). Annex 2 also lists optional sub-processors that only apply if you use the service, including SMS routing providers and AI providers such as OpenAI, Google Gemini and Anthropic.

Brevo DPA: where to find it and how it is accepted

Read the DPA on www.brevo.com. The Data Processing Agreement and its annexes are part of the Terms of Service, so there is no separate signature step on the page. The Terms are marked Version: October 1st, 2025..

Not stated in the source we checked (2026-10-17).

The DPA is part of the Terms of Service and does not list plans.

Brevo subprocessors: the list and how change notices reach you

Brevo's subprocessor list (22 entries on the check date).

Annex 2 of the DPA lists 22 entries (counted row by row): 5 infrastructure sub-processors (OVH, Google Cloud Platform, Cloudflare, Zendesk, Omni), 12 under "Specific services" that are only your sub-processors if you use that service (SMS routing, integrations, landing pages and AI providers), and 5 Brevo Group companies. The list sits inside the Terms of Service, not on a separate page.

How changes are announced: Email or notification in your account, before authorization (section 7.3).

Not stated in the source we checked (2026-10-17).

Section 7.3: Brevo notifies you by email or through your account before authorizing a new sub-processor. No number of days is stated.

You can object within 30 days. Terminate the Terms within 30 days of the notification, if the objection is justified by a violation of EU Data Protection Law (section 7.3).

Section 7.3: if you object on the ground of a violation of EU Data Protection Law, you can terminate the Terms during thirty (30) days following the email or notification. The clause is worded as a termination right and does not set a separate window for raising an objection.

Where Brevo stores data

• France (OVH hosting)
• Belgium (Google Cloud Platform hosting)

Annex 2 lists OVH hosting with a server location in France and Google Cloud Platform hosting with a server location in Belgium. Other entries show server locations such as the USA, EU/USA, Austria/Germany and Serbia, and optional services such as SMS routing and AI providers can process outside the EU. The Brevo Group entries show server locations in France, Belgium, Germany and the EU.

How Brevo moves data outside the EU and UK

• DPF (may be relied on for US transfers)
• SCCs and supplementary measures

Section 9: transfers outside the EEA (defined to include the UK and Switzerland) get an adequate level of protection, "including Standard Contractual Clauses and supplementary measures", and Brevo "may rely on the EU-US Data Privacy Framework for transfers to the US, as long as this framework remains valid". Annex 2 gives the safeguard per sub-processor.

Is Brevo a processor or a controller?

Processor: it handles your customers' data on your instructions.

Section 3.1: you are the controller and Brevo is the processor. Where you act as a processor for an end user, Brevo acts as a subprocessor.

Is Brevo GDPR compliant?

We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Brevo's own documents say:

• A DPA is published: The Data Processing Agreement and its annexes are part of the Terms of Service, so there is no separate signature step on the page. The Terms are marked Version: October 1st, 2025.
• A subprocessor list is published.
• Transfer mechanisms named: DPF (may be relied on for US transfers), SCCs and supplementary measures.
• Data locations named: France (OVH hosting), Belgium (Google Cloud Platform hosting).

What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.

Add Brevo to your own subprocessor list

This row uses the facts above. Change the purpose to match how you use Brevo, then paste it into your list, or open it in the generator to add your other vendors.

| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Brevo | Email and SMS marketing and transactional messaging | France (OVH hosting); Belgium (Google Cloud Platform hosting) | DPF (may be relied on for US transfers); SCCs and supplementary measures | [DPA](https://www.brevo.com/legal/termsofuse/) | [Subprocessors](https://www.brevo.com/legal/termsofuse/) |

Add to my list

If you add or replace Brevo: what to tell your customers

Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.

In the source we checked, Brevo doesn't state a notice period in days, so you may learn of a change later than your own notice period requires; plan for that.

Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.

What changed

2026-10-17

First check: facts recorded from Brevo's own Terms of Service (version October 1st, 2025), including the DPA and its sub-processor annex.

2026-10-17

Re-checked section 7.3 and counted Annex 2 row by row: 22 entries confirmed (5 infrastructure, 12 optional specific services, 5 Brevo Group companies). Section 7.3 confirmed: notice "by email or through your account" before authorizing, and a right to "terminate the Terms during thirty (30) days following the email or notification" if the objection is "justified by a violation of EU Data Protection Law". No changes to values.

Related vendors

• Email delivery
• SendGrid Transactional email delivery
• Resend Transactional email delivery
• Mailgun Transactional email delivery
• All vendors

Sources and method

• https://www.brevo.com/legal/termsofuse/ checked 2026-10-17

Facts come from Brevo's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: www.brevo.com.