ExpressInbox Privacy Policy

Last updated: [Insert date] · Effective date: [Insert date]

This Privacy Policy explains how ExpressVPN a company incorporated in the BVI ("ExpressInbox", "we", "us" or "our"), collects, uses, shares and protects personal data in connection with the ExpressInbox email and inbox management service, which lets you access your email securely and efficiently through WebMail's user-friendly interface, together with any related websites, applications, software and features (collectively, the "Service").

This Privacy Policy should be read together with the ExpressInbox Terms of Service available at https://expressinbox.com/termsofservice.

WHO WE ARE AND SCOPE

  1. For the purposes of applicable data protection law, [Insert legal entity name] is the controller of personal data processed in connection with the Service, except where this Privacy Policy states otherwise.
  2. This Privacy Policy applies to personal data we process about visitors to our websites, account holders and users of the Service, and other individuals who interact with us.
  3. Where we process personal data on behalf of a business customer (for example, where the Service is provided to an organisation for use by its personnel), that customer is the controller and we act as its processor. In such cases, our processing is governed by the data processing terms agreed with that customer.

PERSONAL DATA WE COLLECT

  1. We collect and process the following categories of personal data:
  2. account and registration data, such as your name, email address, username and password;
  3. billing and payment data, such as billing address and transaction records (payment card details are processed by our payment providers and are not stored by us in full);
  4. content data, such as the content of emails, messages, attachments, contacts, folders and other materials you send, receive or store through the Service;
  5. usage and technical data, such as IP address, device and browser type, operating system, log data, access times and interactions with the Service;
  6. communications data, such as records of your correspondence with us, including support requests; and
  7. cookies and similar technologies data, as described in clause 8.
  8. Where we require personal data to provide the Service and you do not provide it, we may be unable to provide the Service or parts of it to you.

HOW AND WHY WE USE PERSONAL DATA

  1. We process personal data for the following purposes and on the following legal bases:
  2. to create and administer your Account and provide the Service, on the basis that processing is necessary for the performance of our contract with you;
  3. to process payments and manage billing, on the basis that processing is necessary for the performance of our contract with you and for compliance with our legal obligations;
  4. to maintain, secure and improve the Service, and to detect and prevent fraud, abuse and security incidents, on the basis of our legitimate interests in operating a safe and effective service;
  5. to communicate with you, including responding to enquiries and providing service-related notices, on the basis of our legitimate interests and, where applicable, the performance of our contract with you;
  6. to send marketing communications, where you have consented or where we are otherwise permitted to do so, on the basis of your consent or our legitimate interests;
  7. to comply with legal and regulatory obligations, on the basis that processing is necessary for compliance with a legal obligation to which we are subject; and
  8. to establish, exercise or defend legal claims, on the basis of our legitimate interests.
  9. Where we rely on legitimate interests, we have carried out a balancing assessment to ensure that our interests are not overridden by your interests or fundamental rights and freedoms. You may contact us for further information about that assessment.
  10. We do not use the content of your emails or messages for advertising purposes, and we do not sell your personal data.

COOKIES AND SIMILAR TECHNOLOGIES

  1. We use cookies and similar technologies to operate the Service, remember your preferences, analyse usage and, where applicable, deliver marketing.
  2. Further information about the cookies we use and how you can manage them is set out in our Cookie Policy available at [Insert Cookie Policy URL].
  3. Where required by law, we obtain your consent before placing non-essential cookies.

SHARING PERSONAL DATA

  1. We may share personal data with:
  2. members of our group of companies, where necessary for the purposes described in this Privacy Policy;
  3. service providers and processors who provide hosting, infrastructure, payment processing, analytics, customer support and similar services on our behalf, in each case under appropriate contractual safeguards;
  4. professional advisers, such as lawyers, auditors and insurers, where necessary;
  5. law enforcement, regulators, courts or other public authorities, where we are required or permitted to do so by law; and
  6. a purchaser or prospective purchaser of all or part of our business, and their advisers, in connection with a merger, acquisition, reorganisation or sale of assets.
  7. We require all processors acting on our behalf to process personal data only on our documented instructions and to implement appropriate technical and organisational measures to protect it.

INTERNATIONAL TRANSFERS

  1. Personal data we process may be transferred to, and stored in, countries outside the [United Kingdom / European Economic Area] which may not provide the same level of protection for personal data.
  2. Where we transfer personal data to such countries, we implement appropriate safeguards, such as [the UK International Data Transfer Agreement or Addendum, and/or the European Commission's Standard Contractual Clauses], or rely on another lawful transfer mechanism.
  3. You may contact us using the details in clause 11 to obtain further information about the safeguards we apply and, where available, a copy of the relevant safeguards.

DATA RETENTION

  1. We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, regulatory or reporting requirements.
  2. When you close your Account, we will delete or anonymise your personal data within [Insert retention period] of closure, except where we are required to retain it for longer to comply with a legal obligation or to establish, exercise or defend legal claims.
  3. Further detail on our retention periods for specific categories of data is available on request.

SECURITY

  1. We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.
  2. These measures include [encryption in transit and at rest, access controls, and regular security testing].
  3. No method of transmission or storage is completely secure, and while we strive to protect your personal data, we cannot guarantee its absolute security.

YOUR RIGHTS

  1. Subject to applicable data protection law, you have the following rights in relation to your personal data:
  2. the right to be informed about how we process your personal data;
  3. the right to access your personal data;
  4. the right to rectification of inaccurate or incomplete personal data;
  5. the right to erasure of your personal data in certain circumstances;
  6. the right to restrict processing in certain circumstances;
  7. the right to data portability;
  8. the right to object to processing based on our legitimate interests or for direct marketing; and
  9. the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
  10. You may exercise your rights by contacting us using the details in clause 11. We will respond to your request within the period required by applicable law.
  11. You have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ICO); in the EU/EEA, this is the supervisory authority in your country of residence, place of work or the place of the alleged infringement. We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority.

CHILDREN

  1. The Service is not directed at children under the age of 18, and we do not knowingly collect personal data from children under that age.
  2. If we become aware that we have collected personal data from a child in a manner inconsistent with applicable law, we will take steps to delete it.

CONTACT US AND DATA PROTECTION OFFICER

  1. If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at [Insert contact email] or by writing to [Insert postal address].
  2. Our Data Protection Officer can be contacted at [Insert DPO contact details].
  3. [If applicable] Our representative in the [United Kingdom / European Union] for the purposes of applicable data protection law is [Insert representative name and contact details].

CHANGES TO THIS PRIVACY POLICY

  1. We may update this Privacy Policy from time to time. Where any change is material, we will notify you by email or through the Service before the change takes effect.
  2. The date at the top of this Privacy Policy indicates when it was last updated. We encourage you to review this Privacy Policy periodically.