In April 2016, the General Data Protection Regulation (GDPR) — a joint proposal by the European Commission, European Parliament, and the Council of the EU which provides individuals with even greater control over the collection and use of their personal data- was adopted by the European Union.
Campaign Monitor for Salesforce does not store any customer information. Customer data is stored in Salesforce and Campaign Monitor. Below are two links to on GDPR compliance for Salesforce and Campaign Monitor.
In terms of what is sent to Campaign Monitor, that is entirely up to yourself. You can choose not to send any custom data to Campaign Monitor or even any subscribers. You can see the information that is sent by simply going to Campaign Monitor. All data that is sent to Campaign Monitor is visible in Campaign Monitor. There are no other hidden fields. You can get a feel for the calls by going to api.campaignmonitor.com.
We are not in a position to disclose what metadata we extract due to commercial confidence, other than to say that no user information is retrieved. You can choose not to even allow us access to that metadata if you choose not to use the import wizard with List Views or bulk import from a Lead or Contact from a List View. Please note that the type of metadata we extract may change as Salesforce and our application evolve.
All data that is held by our application and is stored within your Salesforce environment can be found in objects starting with the namespace wbsendit. To reiterate, we don't connect into Salesforce, all connections are outward bound. This just means Campaign Monitor cannot call back into Salesforce and query your data.