Introduction
UKWebMail Ltd ("we", "us", "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our email hosting services.
We are registered as a data controller with the Information Commissioner's Office (ICO) under registration number ZA123456. Our registered address is Floor 3, Innovation House, 45 Colmore Row, Birmingham B3 2AA.
Information We Collect
We collect the following types of information:
Account Information
- Name, email address, and contact details
- Billing information and payment details
- Company name (if applicable)
- Account preferences and settings
Service Data
- Email messages, attachments, calendar entries, and contacts stored in your mailbox
- Email metadata (sender, recipient, subject, timestamps)
- Login records and IP addresses
- Device and browser information
Usage Information
- How you interact with our services
- Feature usage statistics
- Error logs and performance data
How We Use Your Information
We use your information for the following purposes:
- Providing our services: To deliver email hosting, process your emails, and maintain your account
- Customer support: To respond to your enquiries and resolve issues
- Billing: To process payments and manage your subscription
- Security: To protect against fraud, spam, and security threats
- Service improvement: To analyse usage patterns and improve our services
- Legal compliance: To comply with applicable laws and regulations
- Communications: To send service updates, security alerts, and (with your consent) marketing communications
Legal Basis for Processing
Under GDPR, we process your data based on:
- Contract: Processing necessary to provide our services to you
- Legitimate interests: Processing for security, fraud prevention, and service improvement
- Legal obligation: Processing required by law
- Consent: Where you have given explicit consent (e.g., marketing communications)
Data Storage and Security
All data is stored on servers located in UK data centres (London and Manchester). We do not transfer your personal data outside the United Kingdom unless required for specific services you request, in which case appropriate safeguards are applied.
We protect your data using:
- AES-256 encryption for data at rest
- TLS 1.2/1.3 encryption for data in transit
- Multi-factor authentication options
- Regular security audits and penetration testing
- ISO 27001 certified information security management
- Physical security controls at data centre facilities
Data Retention
We retain your data for as long as your account is active. After account closure:
- Mailbox contents are deleted within 30 days
- Account records are retained for 7 years for legal and tax purposes
- Backup data is purged within 90 days
- Anonymised usage statistics may be retained indefinitely
Your Rights
Under GDPR, you have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate or incomplete data
- Erasure: Request deletion of your data (subject to legal retention requirements)
- Portability: Receive your data in a machine-readable format
- Restriction: Limit how we use your data
- Objection: Object to certain processing activities
- Withdraw consent: Remove consent where processing is based on consent
To exercise these rights, contact us at [email protected] or write to our Data Protection Officer at the address above.
Email Content
We do not read, scan, or analyse the content of your emails for advertising or any purpose other than providing our services. We may scan emails for spam and malware detection, but this is automated and no human reviews your message content.
We will only access your email content if required by law (e.g., valid court order) or with your explicit consent (e.g., when providing technical support at your request).
Third-Party Services
We use carefully selected third-party services:
- Payment processors: Stripe and GoCardless for secure payment handling
- Infrastructure: UK-based data centre providers
- Analytics: Privacy-focused analytics (no personal data shared)
All third parties are bound by data processing agreements and must comply with GDPR.
Cookies
We use cookies and similar technologies as described in our Cookie Policy.
Children's Privacy
Our services are not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through our website. The "Last updated" date at the top indicates when the policy was last revised.
Contact Us
For privacy-related enquiries:
- Email: [email protected]
- Data Protection Officer: [email protected]
- Post: Data Protection Officer, UKWebMail Ltd, Floor 3, Innovation House, 45 Colmore Row, Birmingham B3 2AA
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.