Privacy notice

1. The controller

Name: Yellow Hashtag OÜ
Registered office: Harju maakond, Kesklinna linnaosa, Tornimäe tn 5, 10145 Tallinn
Company registration number: 16148756
Electronic contact: ugyfelszolgalat@postino.net

2. What data we handle

We ask for as little as the service allows.

GIVEN AT REGISTRATION
— family name and given name, for the invoice
— a secondary email address, for password recovery
— the email address and plan you chose

ARISING FROM USE OF THE SERVICE
— the messages and attachments stored in your mailbox
— your contacts and calendar entries, if you use them
— technical logs: sign-in times and IP addresses, error events

PAYMENT DATA
— the fact, amount, time and transaction identifier of the payment
— the billing name and address

We never see or store your card details — those are processed only by the payment provider.

3. Purpose and legal basis

PERFORMANCE OF A CONTRACT — GDPR Art. 6(1)(b)
Name, email address, secondary address, subscription data, the contents of the mailbox. Without these the service cannot be provided.

LEGAL OBLIGATION — GDPR Art. 6(1)(c)
Retention of invoicing data under accounting law.

LEGITIMATE INTEREST — GDPR Art. 6(1)(f)
Technical logs and security events, recorded to keep the system secure and to prevent abuse.

4. How long we keep it

Mailbox contents: according to the deletion schedule. After the subscription ends the messages are kept for thirty days, then deleted for good. The full schedule is in the terms of service.

Registration data (name, recovery address): until the account is deleted.

Billing data: 8 years, as required by accounting law, even after the account is deleted.

Technical logs: 30 days.

Support correspondence: 1 year.

5. Who we share data with

We do not sell your data and do not pass it to third parties for marketing. To provide the service we use the following processors:

PAYPAL
Purpose: handling payments. Data: name, email address, transaction details. Registered office: PayPal (Europe) S.a r.l. et Cie, S.C.A., Luxembourg. Their own notice governs their processing: https://www.paypal.com/uk/legalhub/privacy-full

HOSTING PROVIDER
Purpose: running the servers. Data: everything stored in the system. Name and office: Rackhost Zrt., 6722 Szeged, Tisza Lajos körút 41. (levelezés: 1132 Budapest, Victor Hugo utca 18-22.).

GOOGLE
Purpose: measuring traffic on the public pages. Data: technical details of the visit. It has no access to mailbox contents. Their own notice governs their processing: https://policies.google.com/privacy

The mailing system is run BY US, on our own servers. No external provider is involved, so subscription data never leaves our systems.

6. Transfers outside the European Union

Our servers operate within the European Union, and the contents of your mailbox do not leave it.

We use PayPal for payments and Google for traffic measurement. These companies may transfer data outside the European Union under their own practices; their notices, linked above, set out the safeguards and the legal basis.

7. Your rights

ACCESS — you may ask what data we hold about you, and request a copy.

RECTIFICATION — you may ask us to correct inaccurate data. You can change your name and secondary address yourself in your account.

ERASURE — you may ask us to delete your data. This ends the account. Data we are required by law to keep (invoices) must be retained until the statutory deadline.

RESTRICTION — you may ask us to restrict processing while a disputed matter is settled.

PORTABILITY — you can download your messages over IMAP at any time and take them to another provider. On request we will also provide your registration data in a machine-readable format.

OBJECTION — you may object to processing based on legitimate interest.

WITHDRAWAL OF CONSENT — you may stop consent-based processing at any time. This does not affect the lawfulness of processing before withdrawal.

Send your request to ugyfelszolgalat@postino.net. We reply within one month at the latest.

8. How we protect your data

The web interface is available only over an encrypted (HTTPS) connection; email clients connect over STARTTLS or SSL/TLS. Passwords are not stored in a recoverable form. Two-factor authentication can be enabled on your account. Access to the system is restricted and logged.

In the event of a personal data breach we inform those affected and the authority in the manner and within the deadline required by law.

9. Cookies

We use cookies that are necessary to run the site: they keep you signed in and store your language choice. These do not require consent, because without them the service would not work.

The cookie notice describes each one.

10. Children

The service is not available to people under 16. If we learn that we are handling the data of someone under 16 without parental consent, we delete it.

11. Complaints and remedies

If you believe our handling of your data is unlawful, please contact us first at ugyfelszolgalat@postino.net.

You may also complain to a supervisory authority. Under Art. 77 GDPR you may choose the authority in the EU member state where you live, where you work, or where the alleged infringement took place. Our own supervisory authority is:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400
Web: https://naih.hu

You may also go to court, either where you live or where we are established.

12. Changes to this notice

We may update this notice from time to time. We notify you by email before a material change takes effect. The version in force is always available at https://postino.net.