GDPR at Mailyoto

When we receive, check, forward or send email for your domains, we process it for you. You decide what happens to it, and we follow your settings. In GDPR terms, you are the controller and we are your processor.

For your own account (your sign-in, your plan and payments, and anything you write to support) we decide how the data is used, so we are its controller. The Privacy Policy covers that data.

The GDPR requires a written agreement between you and any processor you use. Ours is part of the Terms of Service, so it applies to your account from the day you create it, on every plan. There is nothing to request and nothing to send back.

We have already signed it. Sign in and open Account, then Profile, to download the signed copy. It includes the EU Standard Contractual Clauses for transfers, governed by Dutch law.

We offer one agreement to every customer so the terms are the same for everyone. If your organisation needs something it doesn't cover, write to us.

We store your account, your logs and any mail we hold for you in the European Union, in the Netherlands, France and Germany.

Your mail also passes through our servers in the United States, and US companies run our support tools. The Standard Contractual Clauses in the DPA cover every transfer outside the EU.

• Message content: only while we deliver a message and retry it. We don't keep it after delivery.
• Messages we could not deliver: no longer than their log entry, and only if your log settings allow it.
• Logs: 14 days on Free, up to 60 days on Pro and up to 365 days on Max. You can keep less for each domain.
• After you delete your account: everything within 30 days, and backup copies within a further 30 days.

These companies help us run the service. Each one has signed a data protection agreement with us. We email you 30 days before we add or replace one. The signed DPA in your dashboard names each of them.

• Infrastructure hosting Netherlands
• Cloud infrastructure France
• Infrastructure hosting United States
• Monitoring and logging Germany
• Support email United States
• Team communication about support requests United States

Connections use TLS, stored data and backups are encrypted, and only authorised staff can reach our systems. Annex II of the DPA lists the measures, and the security page shows the path one message takes.

If a breach affects data we process for you, we email your account's address without undue delay, and within 48 hours of becoming aware. The email says what happened, what data it affected and what we are doing about it, so you can meet your own duty to tell the regulator within 72 hours.

If someone asks us for the data we process for you, we pass the request to you, and we help you answer it. In the dashboard you can find and delete logs, and choose how much each domain logs.

For your own account data, write to us and we reply within one month.

Most security questionnaires can be answered from this page, the DPA and the sub-processor list. For anything else, email us.