Source: https://www.gmx.com/company/privacypolicy/
Timestamp: 2019-04-21 23:00:28+00:00

Document:
We will address your requests in accordance with the legal requirements.
Moreover, you have the right to lodge a complaint with a data privacy supervisory authority (Article 77 GDPR in conjunction with Section 19 BDSG [German Federal Data Protection Act]).
Do you have questions about your data? You always have the opportunity to request your data. In “My Account” you will find an overview of all your settings and data saved with GMX.
Do you have questions about your information? Then let’s get started: Log into GMX My Account and take a look for yourself!
You can request further information from our data protection officer using the contact details provided above.
You have the ability to check your data whenever you want. In the GMX My Account you can view your data and manage it yourself. If you have a contractual relationship with us, please understand that we save and process your data as required for the term of your contract. There may also be retention duties arising from legal requirements, for example commercial or tax law.
You can revoke the granted consent at any time. This also applies to the revocation of declarations of consent that you provided to us before the entry into force of the EU General Data Protection Regulation, i.e. before May 25, 2018. Processing that took place before the revocation is not affected by this.
In “My Account” you will find an overview under the menu item “Communication Profile”, where you can see what data you consented to for processing and how you can revoke it.
More details are provided below under the respective product category.
In addition, according to Art. 21 GDPR, you have the right to object to the processing of your personal data that is done on the basis of Art. 6 (1) (f) GDPR (data processing for the purposes of legitimate interests).
You can easily object by going to the menu item “Communication Profile” in “My Account”. If you have any questions, please do not hesitate to contact our customer service.
If you would like to exercise this right, go to “My Account” where you will find the option of exporting your data under the item “Personal Data”.
We do not use any fully automated decision-making pursuant to Art. 22 GDPR to justify and conduct our business with you, which has legal effect with respect to you or constitutes a significant impediment for you in a similar way.
If data processing is based on your consent, you provide data completely voluntarily and can revoke consent anytime in accordance with the following information.
However, in some cases, we need the data we collect from you to provide our contractually promised services in line with our GTCs, e.g. in the scope of GMX Free Webmail, or process them in our legitimate interest (see next point).
Except for a few justified exceptions, which we will inform you in more detail under the respective product category below, the following applies to emails, address book or calendar data: we process your data exclusively in secure data centers in Germany.
We store your personal data only for as long as necessary for the corresponding purpose or, if relevant, for as long as required or permitted in accordance with applicable law if a longer retention period is concerned. The duration of our business relationship with you (e.g. the period in which you maintain your account with us) or the fact that we must retain the data due to a legal obligation are decisive for this purpose. More details are provided below under the respective product category.
We need the data we collect in this context, provided we do not ask you for your consent, in order to provide our contractually agreed services in the scope of our GMX T&Cs. Therefore, we collect, process and use your personal data if this is necessary for contract justification and processing. The legal basis for this is Art. 6 (1) (b) GDPR.
Moreover, we process your personal data to guarantee our legitimate interests, provided your interests or fundamental rights and freedoms do not prevail. The legal basis for this is Art. 6 (1) (f) GDPR.
You provided your “user data”, e.g. name and date of birth, to us on registration.
Furthermore, we process content data. This is content that you actively create or use as a user. This includes, e.g.
data you upload, e.g. in the app.
We save this information so that it can be available to you to be used for various purposes. The email content is legally protected from access by unauthorized parties and will remain confidential, unless required to be disclosed by law.
Traffic data in accordance with applicable laws that arises when using the email service, e.g. date and time of access or delivery or IP address of the device used to access your inbox.
Content and usage data are deleted after 180 days of inactivity in accordance with our General Terms and Conditions. The email address registered by customers with GMX and the corresponding mailbox are stored beyond that in line with the statutory requirements.
In case of a cancellation request by the user, all user data are deleted and/or the account is deleted, unless longer retention periods apply.
Traffic data are deleted after expiry of the legal retention period.
However, please note that when downloading the app you additionally accept the GTCs of the respective app store, which may result in additional storage requirements.
In general, the following applies: We collect user data and content data in order to perform our contract with you. To object to the processing, you have to cancel or revoke your existing GMX Free Webmail contract and stop using your GMX Free Webmail products.
Storage and other processing of traffic data is subject to strict legal requirements. No objections can be made to the traffic data needed to provide the service.
You can find configuration options for controlling interest-based advertising in the Data Privacy & Advertising section.
To improve the user experience of our products, websites and applications, we use automatic and standardized analysis methods. You can view information about revoking the use of your data for analysis purposes here.
In order to provide the content and functions in this scope we work specifically on clarify of our website. Our aim is to ensure that our users can find their way in the variety of offers. For this reason, we process pseudonymized usage data in adherence to legal guidelines, which allow us to later identify whether our users are able to navigate our online portal well and/or what can be improved. The legal basis of this data processing is Article 6 (1) (f) GDPR.
We process pseudonymized usage data on the GMX Online Portal. Your usage information is transmitted to GMX by you or, respectively, your end device, which you use to visit our website. Personal data (cookies/usage data) are automatically collected and stored when you visit the GMX Online Portal. This concerns, for example, the retrieval of certain elements on the website or the date and/or time of your visit. We cannot identify you by means of this data, because it is pseudonymized. The data is also not combined with other personal data held by us.
To improve the user experience of our products, websites and applications, we use standardized analysis methods. How you can stop the use of your data for analysis purposes is described in the GMX Services section (Chapter 5).
Your usage data are stored in pseudonymized form and deleted after one year at the latest.
We always strive to improve our search function. For this reason, we process pseudonymized usage data in adherence to legal guidelines, which allow us to later identify whether our users are able to navigate our online portal well and/or what can be improved. The legal basis of this data processing is Article 6 (1) (f) GDPR.
Our search automatically collects usage data, such as search queries, IP addresses and anonymous data of the web browser. GMX search suggestions make your search easier for you. While you are typing, GMX uses an automated process to suggest search terms and phrases in real-time, which are based on frequent search queries of other users. After completing your search query, GMX shows you alternative search terms and related topics. Suggests of the GMX search are based on the data collected on the whole from the searches by all users and are not generated on the basis of your personal search history.
Online ads marked as such refer to websites placed in the search results for a fee. The shown sponsor links are usually related to the search term you entered.
To improve the user experience of our products, websites and applications, we use standardized analysis methods. You can revoke the use of your data for analysis purposes here.
We usually store the pseudonymized usage data in connection with the GMX search for 7 days, but a maximum of 21 days.
GMX offers the Internet search in partnership with Google and Oath (EMEA) / Yahoo Search.
In the scope of this partnership, search queries, IP addresses and anonymous data from the user’s web browser are shared with the partner.
Google and Oath (EMEA) / Yahoo Search use these data and clicks on search results to improve search products, for research and analysis, to better tailor the search results and ads, and to identify and protect from fraudulent activity related to advertisement.
GMX Search formats the search results provided by Google and Oath (EMEA) / Yahoo Search in order to adapt the search to the user’s ideas and expectations and to optimize it accordingly.
For more information about the collection and use of data by our partners, see the data privacy policies of our partners, linked below. Therefore, please bear in mind that depending on the partner company your IP address may be processed outside Europe.
Better surfing, perfect apps and customized offers: To make sure that you can find your way around our websites and our products are user-friendly, we analyze, for example, the surfing behavior on our websites and the range of our offers.
The legal basis of this data processing is Article 6 (1) (a) and (f) GDPR.
User data – e.g. your name and your e-mail address associated with your e-mail account.
Usage data – pseudonymized information that indicates the scope and type of use of our products and offers, e.g. IP addresses or cookies collected in the scope of the range measurements in connection with the digital offers of GMX.
In analyses for the purpose of optimized products, offers and websites, user and content data are not only stored by you, but also collected and processed in anonymized or pseudonymized form automatically by means of a uniform standard procedure.
Optimizely is a web analytics service provided by Optimizely, Inc., 631 Howard Street, Suite 100, San Francisco, CA 94105, USA, (“Optimizely”) based on the cookie technology. The information about your use of this website generated by the cookies is generally sent to an Optimizely server in the USA and stored there. Your IP address is first shortened by Optimizely within member states of the European Union or in other Contracting States to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to an Optimizely server in the USA and shortened there. On behalf of GMX, Optimizely will use the information to evaluate the use of the website and to compile reports on website activity.
We use Google Analytics on our website. A web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookie information, including your IP address to understand your use of the website and this will be transmitted to and stored by Google on servers in the United States. If you request IP anonymisation, Google Analytics will anonymise the last octet of the IP address. Only in exceptional cases, the full IP address is sent to and shortened by Google servers in the United States. On behalf of the website provider Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage to the website provider.
All data collected in the scope of analyses helps us design our products, apps and websites based on your needs and continually improve them for you. Nevertheless, you have the option to decide yourself.
To stop data analysis in order to design products, apps and websites based on your needs, please use the opt-out linked to the account: You can find it after you log in in “My Account” under “Communication Profile”.
TThe IP address sent by your browser in the context of Optimizely will not be pooled with other data from Optimizely. You can deactivate Optimizely tracking any time (and thus prevent the collection of data generated by the cookie and related to your use of the website, incl. your IP address, by Optimizely and the processing of these data by Optimizely) by following the instructions on http://www.optimizely.com/opt_out.
GMX takes the greatest care in handling your data and complies with the requirements of the European data privacy laws.
Other Analyses for demand-oriented products and websites – based on the entries of users and performance analyses of the products themselves – are stored for the periods set by the legal framework.
The shortened IP address is stored for a maximum of 60 days. The usage data in connection with the clear identifier are stored for a maximum of 6 months.
In addition, various website versions are tested for demand-oriented optimization of websites with the help of statistical analyses. Source code snippets are stored for this purpose. The collected data are then anonymized and evaluated according to strict data privacy criteria of GMX by our service provider “Optimizely”.
We do analyze data for a demand-oriented design of products and websites that are not forwarded to third parties. They are generally stored on our servers in Germany.
In the scope of optimization of our website, we also regularly conduct “tests” to optimize our websites through our service provider Optimizely B.V. Nes 76 1012 KE Amsterdam. However, this service provider also adheres to the strict data protection and security policies of GMX.
As a GMX user you can contact us anytime with questions about the services you use. To provide information, we document the provided services and also the actions taken by you as the customer. Furthermore, using the information provided by you, we ensure that our services are used securely and appropriately. For example, our customer service uses the data you entered to authenticate you personally in case of a request. So this is also done in the interests of your security.
In the area of customer service, the collection of your data is based on the information you provided when concluding the contract. The processing is necessary for contract performance or initiation. The legal basis is therefore Art. 6 (1) (b) GDPR.
User data – e.g. your name and e-mail address and other contact information.
Content data – content that you actively create or use as a user, for example, your e-mail filters in the settings.
Usage data – all pseudonymized information that arises when you use a service and indicates the scope of use of the product, for example, the number of sent or received e-mails.
When concluding a GMX Account contract, you save the personal data yourself, for example, you name, your mailing address, etc.
As a GMX FreeMail user, you use certain services or take certain actions. Data involved in this are documented by GMX.
Use the revocation options according to our GMX T&Cs.
In general, the following applies: We collect user data and content data in order to perform our contract with you. Therefore, to object to processing you have cancel the GMX FreeMail contract and/or delete your account.
The services provided by us in the scope of the Free Webmail contract and the actions taken by you will be documented until the deletion of your account and then deleted appropriately.
In general, no data are transferred to third parties in the area of customer relationship management and customer service.
In order to continue to provide our services to you free of charge, advertising is part of our offer. We strive to show you only ads that match your interests.
In order to guarantee a pleasant and intuitive user experience, on our Online Portal and in the GMX Mailbox, we analyze typical comings and goings of our visitors and the structure of user groups, albeit only on the pseudonymous level. This way, we would like to avoid, for example, showing you online ads too frequently in a certain period of time. For this reason, we allocate a user ID that shows us that someone has already seen this ad often; this is the only way we can control this for you. We do not combine these pseudonymous user profiles with your personal data. Therefore, we do not know who you are. We use them exclusively to optimize the user experience. The legal basis of this data processing is Article 6 (1) (f) GDPR.
All information collected in connection with advertising on our Online Portal and in the GMX E-mail Inbox about the user and is subject to the highest security standards. This information is often stored in cookies. Cookies are small text files stored by your browser and they ensure that a website “remembers” you. This allows websites to load faster on your next visit or usage data to be stored. To find out how you can object to this storage of usage data, see Revoking Consent to Data Processing.
In connection with advertising on our GMX Internet portal we process only process pseudonymized usage data. Usage data are all information arising during the use of a service and indicates the scope of use of each respective product. We collect these data via your device, which you use to navigate our portal.
Use the revocation options according to our GMX Data Privacy Notice.
If you no longer want to receive interest-based online advertising, you can control this by managing cookies for each partner using the opt-out function. To do this, please visit http://www.youronlinechoices.com/uk/your-ad-choices.
Deactivate Interest-based advertising and reset the advertising ID on Android devices.
On Android devices, the option “deactivate interest-based advertising” is deactivated as a standard. If you would like to change this, open the Google settings, click on “Ads” and activate them.* By using this OPT-OUT option, you stop the display of interest-based advertising based on the advertising ID of your device.
The menu options may vary depending on the device and version.
For targeted management of advertising content, we use the advertising ID within our Android applications or advertising ID (IDFA) within our Apple applications, which identify the device without personal references. So if you download and use 1&1 Mail & Media GmbH applications, you transfer a clearly allocated number (advertising ID or IDFA) to us. We are unable to make a personal identification based on the advertising ID or IDFA.
Of course, it is important to us to adhere to all data privacy regulations when it comes to advertising. When we allocate advertising space on our Internet portal, we work with companies from around the world. Many companies are also located abroad. Therefore, it is possible that your pseudonymous usage data are used outside of German in these cases for selection of advertising materials.
Handling of your personal data in conformance with data privacy requirements is regulated by the respective applicable law, for example, by the EU General Data Protection Regulation within the EU.

References: Art. 21
 Art. 6
 Art. 22
 Art. 6
 Art. 6
 Art. 6