Subject to the statutory requirements, you have the following rights:

• access to the data we process about you (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• objection to processing (Art. 21 GDPR);
• withdrawal of consent with effect for the future (Art. 7(3) GDPR).

To exercise your rights, a message to support@anpa.de is sufficient.

We process personal data only on the basis of the statutory provisions. Legal bases are in particular Art. 6(1)(b) GDPR (performance of the user contract), (a) (consent, e.g. for advertising and push notifications), (c) (legal obligations, e.g. retention) and (f) (legitimate interests, in particular security and trouble-free operation).

To provide our e-mail and webmail service we process account data (e-mail address, username, encrypted password), content data (your e-mails, attachments, address book, calendar) and usage/connection data (time of access, IP address, protocols). Purposes are provision, maintenance and security of the service, sending and receiving messages, and spam/virus filtering. Legal bases: Art. 6(1)(b) and (f) GDPR.

An account is required to use the service. The data marked as mandatory during registration is necessary to establish and perform the user relationship (Art. 6(1)(b) GDPR). To prevent abusive registrations, Google reCAPTCHA may be used; usage information is transmitted to Google in the process.

Our app (Android/iOS) is an e-mail client that connects to your account. We process login data for authentication (encrypted transmission via HTTPS/TLS), e-mail and account data to the extent required for display/editing, and device/usage information (device type, operating system, app version). Login credentials are stored locally on your device to keep you signed in.

For push notifications (e.g. notice of new e-mails) we use Firebase Cloud Messaging provided by Google Ireland Limited / Google LLC. An anonymous push token is generated and transmitted to Google and our server; your IP address may be processed and transferred to the USA. Legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via your device settings.

In the free version of our app we display advertising via Google AdMob (Google Ireland Limited, Dublin; where applicable Google LLC, USA). Users with a paid, ad-free plan receive no advertising. For this, Google processes in particular your device advertising ID (Android Advertising ID or Apple IDFA), IP address, device information and data about displayed ads.

Personalised advertising only takes place with your consent (Art. 6(1)(a) GDPR), which we obtain via a consent banner before the first ad. Without consent, only non-personalised advertising is delivered (Art. 6(1)(f) GDPR). You can withdraw consent at any time and disable personalised advertising or reset your advertising ID in your device settings (Android: Settings → Google → Ads; iOS: Settings → Privacy & Security → Tracking). Google also processes data in the USA (EU-US Data Privacy Framework, standard contractual clauses). More information: policies.google.com/privacy.

On our websites, advertising via Google AdSense may be displayed to finance the free offering. Cookies or comparable technologies may be used and data (incl. IP address, cookie IDs, usage data) processed. The use of non-essential cookies and personalised advertising only takes place with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you give via our consent banner and can withdraw at any time.

When booking a paid plan we process the data required for contract and invoicing (name, address, VAT ID where applicable, selected plan, payment status). For credit-card and other payment methods we use the payment service provider Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands. Payment data is transmitted directly to Mollie; we do not store card data. Legal bases: Art. 6(1)(b) and (c) GDPR. Privacy information: mollie.com/en/privacy.

When accessing our servers, information is automatically stored in server log files (IP address, date/time, requested resource, data volume, status code, user agent). This serves trouble-free operation and the detection and defence of attacks (Art. 6(1)(f) GDPR). Log files are kept only for the necessary period.

Data is only passed on where necessary for the performance of the contract, where you have consented, or where we are legally obliged to do so. Service providers used, with whom – where required – data processing agreements (Art. 28 GDPR) exist: hosting/server infrastructure (data centre in Germany/EU), Google Ireland Limited / Google LLC (AdMob, AdSense, Firebase, reCAPTCHA) and Mollie B.V. (payment processing).

Where data is transferred to recipients in third countries (in particular the USA, e.g. with Google), this is done on the basis of an adequacy decision (EU-US Data Privacy Framework) and/or appropriate safeguards under Art. 46 GDPR (standard contractual clauses) and, where necessary, your consent.

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods (in particular commercial and tax law, generally 6 or 10 years). Account and content data are deleted after the end of the user relationship and expiry of any periods.

To protect your data during transmission we use state-of-the-art encryption (TLS/HTTPS, STARTTLS or SSL for IMAP/POP3/SMTP).

If you subscribe to a newsletter, we process your e-mail address on the basis of your consent (Art. 6(1)(a) GDPR) in order to send you information. You can unsubscribe at any time via the unsubscribe link.

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstrasse 98, 24103 Kiel, Germany
Phone: +49 431 988-1200
E-Mail: mail@datenschutzzentrum.de
www.datenschutzzentrum.de

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The respectively current version applies.

If you have questions about data protection or wish to exercise your rights, please write to support@anpa.de or to the address given under "Data Controller".