Privacy Policy

1. General Information

1.1 Controller

The protection of your personal information is a top priority for 1&1 Mail & Media GmbH, Montabaur. Of course, we adhere to the relevant data privacy laws and would like to provide comprehensive information about the handling of your data in the following data privacy notice. The responsibility for this lies with

1&1 Mail & Media GmbH
Karlsruhe branch
Brauerstr. 48
76135 Karlsruhe
Germany

Managing Directors:
Thomas Ludwig, Jan Oetjen, Sascha Vollmer

Headquarters Montabaur

You can also contact our customer service:
Customer Service

1.2 Data Protection Officer

Data Protection Officer of 1&1 Mail & Media GmbH
1&1 Internet SE
Elgendorfer Str. 57
56410 Montabaur
Germany

or by e-mail to: dataprivacy@corp.gmx.com

1.3 Your Rights as a Data Subject

In accordance with the European General Data Protection Regulation (GDPR), every user has the right

to information pursuant to Article 15 GDPR,
the right to correction pursuant to Article 16 GDPR,
the right to deletion pursuant to Article 17 GDPR,
the right to restriction of processing pursuant to Article 18 GDPR,
the right to objection pursuant to Article 21 GDPR, and
the right to data portability under Article 20 GDPR.

We will address your requests in accordance with the legal requirements.
If you have any questions, please do not hesitate to contact our customer service.
Moreover, you have the right to lodge a complaint with a data privacy supervisory authority (Article 77 GDPR in conjunction with Section 19 BDSG [German Federal Data Protection Act]).

This is how you can exercise your rights:

1.3.1 Right to Information

Do you have questions about your data? No problem! You always have the opportunity to request your data. In “My Account” you will find an overview of all your settings and data saved with GMX.
Do you have questions about your information? Then let’s get started: Log into GMX My Account and take a look for yourself!
You can request further information from our data protection officer using the contact details provided above.

1.3.2 Correction & Deletion and Restriction of Your Processing

You have the control: Check your data whenever you want. In GMX My Account you can view your data, but also manage it yourself. If you have a contractual relationship with us, please understand that we save and process your data as necessary for the term of your contract. There may also be retention duties arising from legal requirements, for example commercial or tax law.

1.3.3 Revocation of Your Consent

You can revoke the granted consent at any time. This also applies to the revocation of declarations of consent that you provided to us before the entry into force of the EU General Data Protection Regulation, i.e. before May 25, 2018. Please note that revocation is only applicable for the future. Processing that took place before the revocation is not affected by this.
In “My Account” you will find an overview under the menu item “Communication Profile”, where you can see what data processing you granted us your consent for and how you can revoke it.
More details are provided below under the respective product category.

1.3.4 Objection

In addition, according to Art. 21 GDPR, you have the right to object to the processing of your personal data that is done on the basis of Art. 6 (1) (f) GDPR (data processing for the purposes of legitimate interests).

You can easily object by going to the menu item “Communication Profile” in “My Account”. If you have any questions, please do not hesitate to contact our customer service.

1.3.5 Your Right to Data Portability:

You have the right to receive your personal data, which you provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to someone else. You have this right if the processing of your data is based on consent in accordance with Art. 6 (1) (a) GDPR, Art. 9 (2) (a) GDPR or a contract pursuant to Art. 6 (1) (b) GDPR. When exercising this right, you may also choose to have the affected data transmitted directly by us to another controller, if this is technically feasible.
If you would like to exercise this right, go to “My Account” where you will find the option of exporting your data under the item “Personal Data”.

1.3.6 We Do Not Have Automated Decision-making

We do not use any fully automated decision-making pursuant to Art. 22 GDPR to justify and conduct our business with you, which has legal effect with respect to you or constitutes a significant impediment for you in a similar way.

1.3.7 Voluntary Nature of Data Provision

If data processing is based on your consent, you provide data completely voluntarily and can revoke consent anytime in accordance with the following information.
However, in some cases, we need the data we collect from you to provide our contractually promised services in line with our GTCs, e.g. in the scope of GMX Free Webmail, or process them in our legitimate interest (see next point).

1.3.8 Legitimate Interests

Occasionally, we also process the data of our members on the legal basis of Art. 6 (1) (f) GDPR. When processing your data in this case, we pursue the following legitimate interests, unless otherwise stated below:

improving our offers
protecting from abuse
internal statistical purposes

1.3.9 Transmission of Data Abroad

Except for a few justified exceptions, which we inform you about in more detail under the respective product category below, the following applies to e-mails, address book or calendar data: We process your data exclusively in secure data centers in Germany.

1.3.10 How to Exercise Your Right to Lodge a Complaint

In case of questions about data privacy related to our website or other products please contact:

The Data Protection and Freedom of Information Authority of the State of Rhineland-Palatinate (LfDI RLP)
Postfach 3040
55020 Mainz

1.4 Retention Periods

We store your personal data only for as long as necessary for the corresponding purpose or, if relevant, for as long as required or permitted in accordance with applicable law if a longer retention period is concerned. The duration of our business relationship with you (e.g. the period in which you maintain your account with us) or the fact that we must retain the data due to a legal obligation are decisive for this purpose. More details are provided below under the respective product category.

2. Data Privacy for GMX Free Webmail

GMX Free Webmail comprises 3 products that we offer in this context:

GMX Free Webmail e-mail box
File Storage
flexible access to GMX Free Webmail (GMX app)

2.1 Purpose of Processing and Legal Basis

As an e-mail service, GMX Free Webmail leaves hardly anything to be desired. You can:

read, write, manage and delete e-mails;
save and manage your contacts;
create, edit and delete appointments and invite participants to your calendar;
change your customer master data;
manage your privacy settings;
use your File Storage;
access your data on the go via our app;
and much more.

We need the data we collect in this context, provided we do not ask you for your consent, in order to provide our contractually agreed services in the scope of our GMX T&Cs. Therefore, we collect, process and use your personal data if this is necessary for contract justification and processing. The legal basis for this is Art. 6 (1) (b) GDPR.

Moreover, we process your personal data to guarantee our legitimate interests, provided your interests or fundamental rights and freedoms do not prevail. The legal basis for this is Art. 6 (1) (f) GDPR.

2.2 Categories and Origin of Personal Data

We process the following data categories in connection with the provision of our GMX Free Webmail service:

You provided your “user data”, e.g. name and date of birth, to us on registration.

Furthermore, we process content data. This is content that you actively create or use as a user. This includes, e.g.

your e-mails, address book contacts or
files you store in File Storage
data you upload, e.g. in the app.

We save this information so that it can be available to you to be used for various purposes. The e-mail content is legally protected from access by unauthorized parties and is subject, for example, during communication to telecommunications secrecy.

Usage data are all information arising during the use of a service and within the scope of use of each respective product. These data are deleted according to legal regulations after the end of use. In case of special services, e.g., push notifications, we ask you for permission when setting up the app to inform you about new incoming e-mails.

Traffic data in accordance with Section 96 TKG [German Telecommunications Act] that arises when using the e-mail service, e.g. date and time of access or delivery or IP address of the device used to access your inbox [sic!].

2.3 Duration of Storage

Content and usage data are deleted after 180 days of inactivity in accordance with our General Terms and Conditions. The e-mail address registered by customers with GMX and the corresponding mailbox are stored beyond that in line with the statutory requirements.

In case of a cancellation request by the user, all user data are deleted and/or the account is deleted, unless longer retention periods apply.
Traffic data are deleted after expiry of the legal retention period.
However, please note that when downloading the app you additionally accept the GTCs of the respective app store, which may result in additional storage requirements.

2.4 Revocation Options for GMX Free Webmail Products

In general, the following applies: We collect user data and content data in order to perform our contract with you. To object to the processing, you have to cancel or revoke your existing GMX Free Webmail contract and stop using your GMX Free Webmail products.
Storage and other processing of traffic data is subject to strict legal requirements. No objections can be made to the traffic data needed to provide the service.

You can find configuration options for controlling interest-based advertising in the Data Privacy & Advertising section.

To improve the user experience of our products, websites and applications, we use automatic and standardized analysis methods. You can view information about revoking the use of your data for analysis purposes here.

3. Data Privacy in the GMX Online Portal

3.1 GMX Online Portal

3.1.1 Purpose of Processing and Legal Basis

In order to provide the content and functions in this scope we work specifically on clarify of our website. Our aim is to ensure that our users can find their way in the variety of offers. For this reason, we process pseudonymized usage data in adherence to legal guidelines, which allow us to later identify whether our users are able to navigate our online portal well and/or what can be improved. The legal basis of this data processing is Article 6 (1) (f) GDPR.

3.1.2 Categories and Origin of Personal Data

We process pseudonymized usage data on the GMX Online Portal. Your usage information is transmitted to GMX by you or, respectively, your end device, which you use to visit our website. Personal data (cookies/usage data) are automatically collected and stored when you visit the GMX Online Portal. This concerns, for example, the retrieval of certain elements on the website or the date and/or time of your visit. We cannot identify you by means of these data, because they are pseudonymized. The data are also not combined with other personal data held by us.

3.1.3 Configuration Options

To improve the user experience of our products, websites and applications, we use standardized analysis methods. How you can stop the use of your data for analysis purposes is described in the GMX Services section (Chapter 5).

You can find configuration options for controlling interest-based advertising in the Data Privacy & Advertising section.

3.1.4 Duration of Storage

Your usage data are stored in pseudonymized form and deleted after one year at the latest.

3.1.5 Transfer to Third Parties or Abroad

Very simply and clearly: We do not transfer your data to third parties.

3.2 GMX Search

3.2.1 Purpose of Processing and Legal Basis

We always strive to improve our search function. For this reason, we process pseudonymized usage data in adherence to legal guidelines, which allow us to later identify whether our users are able to navigate our online portal well and/or what can be improved. The legal basis of this data processing is Article 6 (1) (f) GDPR.

3.2.2 Categories and Origin of Personal Data

Our search automatically collects usage data, such as search queries, IP addresses and anonymous data of the web browser. GMX search suggestions make your search easier for you. While you are typing, GMX uses an automated process to suggest search terms and phrases in real-time, which are based on frequent search queries of other users. After completing your search query, GMX shows you alternative search terms and related topics. Suggests of the GMX search are based on the data collected on the whole from the searches by all users and are not generated on the basis of your personal search history.

3.2.3 Configuration Options

We only show you want you want to see! Online ads marked as such refer to websites placed in the search results for a fee. The shown sponsor links are usually related to the search term you entered.

You can find configuration options for controlling interest-based advertising in the Data Privacy & Advertising section.

To improve the user experience of our products, websites and applications, we use standardized analysis methods. You can revoke the use of your data for analysis purposes here.

3.2.4 Duration of Storage

We usually store the pseudonymized usage data in connection with the GMX search for 7 days, but a maximum of 21 days.

3.2.5 Transfer to Third Parties or Abroad

GMX offers the Internet search in partnership with Google and Oath (EMEA) / Yahoo Search.
In the scope of this partnership, search queries, IP addresses and anonymous data from the user’s web browser are shared with the partner.
Google and Oath (EMEA) / Yahoo Search use these data and clicks on search results to improve search products, for research and analysis, to better tailor the search results and ads, and to identify and protect from fraudulent activity related to advertisement.
GMX Search formats the search results provided by Google and Oath (EMEA) / Yahoo Search in order to adapt the search to the user’s ideas and expectations and to optimize it accordingly.
For more information about the collection and use of data by our partners, see the data privacy policies of our partners, linked below. Therefore, please bear in mind that depending on the partner company your IP address may be processed outside Europe.

Google
Oath (EMEA) / Yahoo Search

4. Data Privacy Related to GMX Services

4.1 Analyses

4.1.1 Purpose of Processing and Legal Basis

Better surfing, perfect apps and customized offers: To make sure that you can find your way around our websites and our products are user-friendly, we analyze, for example, the surfing behavior on our websites and the range of our offers.

The legal basis of this data processing is Article 6 (1) (a) and (f) GDPR.

4.1.2 Categories and Origin of Personal Data

We collect the following data in the surveys:

User data – e.g. your name and your e-mail address associated with your e-mail account.
Usage data – pseudonymized information that indicates the scope and type of use of our products and offers, e.g. IP addresses or cookies collected in the scope of the range measurements in connection with the digital offers of GMX.

In analyses for the purpose of optimized products, offers and websites, user and content data are not only stored by you, but also collected and processed in anonymized or pseudonymized form automatically by means of a uniform standard procedure.

Optimizely is a web analytics service provided by Optimizely, Inc., 631 Howard Street, Suite 100, San Francisco, CA 94105, USA, (“Optimizely”) based on the cookie technology. The information about your use of this website generated by the cookies is generally sent to an Optimizely server in the USA and stored there. Your IP address is first shortened by Optimizely within member states of the European Union or in other Contracting States to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to an Optimizely server in the USA and shortened there. On behalf of GMX, Optimizely will use the information to evaluate the use of the website and to compile reports on website activity.

We use Google Analytics on our website. A web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookie information, including your IP address to understand your use of the website and this will be transmitted to and stored by Google on servers in the United States. If you request IP anonymisation, Google Analytics will anonymise the last octet of the IP address. Only in exceptional cases, the full IP address is sent to and shortened by Google servers in the United States. On behalf of the website provider Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage to the website provider.

4.1.3 Configuration Options

All data collected in the scope of analyses helps us design our products, apps and websites based on your needs and continually improve them for you. Nevertheless, you have the option to decide yourself.

To stop data analysis in order to design products, apps and websites based on your needs, please use the opt-out linked to the account: You can find it after you log in in “My Account” under “Communication Profile”.

The IP address sent by your browser in the context of Optimizely will not be pooled with other data from Optimizely. You can deactivate Optimizely tracking any time (and thus prevent the collection of data generated by the cookie and related to your use of the website, incl. your IP address, by Optimizely and the processing of these data by Optimizely) by following the instructions on http://www.optimizely.com/opt_out or [sic!].

Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do this, you may not be able to use the full functionality of this website. Furthermore you can prevent Google’s collection and use of data (cookies and IP address) by downloading and installing the browser plug-in available under https://tools.google.com/dlpage/gaoptout.

4.1.4 Duration of Storage

GMX takes the greatest care in handling your data and complies with the requirements of the European data privacy laws.

Other Analyses for demand-oriented products and websites – based on the entries of users and performance analyses of the products themselves – are stored for the periods set by the legal framework.

The shortened IP address is stored for a maximum of 60 days. The usage data in connection with the clear identifier are stored for a maximum of 6 months.

In addition, various website versions are tested for demand-oriented optimization of websites with the help of statistical analyses. Source code snippets are stored for this purpose. The collected data are then anonymized and evaluated according to strict data privacy criteria of GMX by our service provider “Optimizely”.

4.1.5 Transfer to Third Parties or Abroad

Data from you that we analyze ourselves for a demand-oriented design of products and websites are not forwarded to third parties. They are generally stored on our servers in Germany.

In the scope of optimization of our website, we also regularly conduct “tests” to optimize our websites through our service provider Optimizely B.V. Nes 76 1012 KE Amsterdam. However, this service provider also adheres to the strict data protection and security policies of GMX.

4.2 Customer Care & Service

4.2.1 Purpose of Processing and Legal Basis

As a GMX user you can contact us anytime with questions about the services you use. To provide information, we document the provided services and also the actions taken by you as the customer. Furthermore, using the information provided by you, we ensure that our services are used securely and appropriately. For example, our customer service uses the data you entered to authenticate you personally in case of a request. So this is also done in the interests of your security.

In the area of customer service, the collection of your data is based on the information you provided when concluding the contract. The processing is necessary for contract performance or initiation. The legal basis is therefore Art. 6 (1) (b) GDPR.

4.2.2 Categories and Origin of Personal Data

In the scope of customer care, we process the following data:

User data – e.g. your name and e-mail address and other contact information.
Content data – content that you actively create or use as a user, for example, your e-mail filters in the settings.
Usage data – all pseudonymized information that arises when you use a service and indicates the scope of use of the product, for example, the number of sent or received e-mails.

When concluding a GMX Account contract, you save the personal data yourself, for example, you name, your mailing address, etc.

As a GMX FreeMail user, you use certain services or take certain actions. Data involved in this are documented by GMX.

4.2.3 Configuration Options

Use the revocation options according to our GMX T&Cs.

In general, the following applies: We collect user data and content data in order to perform our contract with you. Therefore, to object to processing you have cancel the GMX Free Webmail contract and/or delete your account.

You can find configuration options for controlling interest-based advertising in the Data Privacy & Advertising section.

To improve the user experience of our products, websites and applications, we use standardized analysis methods. You can revoke the use of your data for analysis purposes here.

4.2.4 Duration of Storage

The services provided by us in the scope of the Free Webmail contract and the actions taken by you will be documented until the deletion of your account and then deleted immediately.

4.2.5 Transfer to Third Parties or Abroad

In general, no data are transferred to third parties in the area of customer relationship management and customer service.

5. Data Privacy & Advertising at GMX

5.1 Advertising on the GMX Online Portal and GMX Mailbox

5.1.1 Purpose of Processing and Legal Basis

In order to continue to provide our services to you free of charge, advertising is part of our offer. We strive to show you only ads that match your interests.

In order to guarantee a pleasant and intuitive user experience on our Online Portal and in the GMX Mailbox, we analyze typical comings and goings of our visitors and the structure of user groups, albeit only on the pseudonymous level. This way, we would like to avoid, for example, showing you online ads too frequently in a certain period of time. For this reason, we allocate a user ID that shows us that someone has already seen this ad often; this is the only way we can control this for you. We do not combine these pseudonymous user profiles with your personal data. Therefore, we do not know who you are. We use them exclusively to optimize the user experience. The legal basis of this data processing is Article 6 (1) (f) GDPR.

All information collected in connection with advertising on our Online Portal and in the GMX E-mail Inbox about the user and is subject to the highest security standards. This information is often stored in cookies. Cookies are small text files stored by your browser and they ensure that a website “remembers” you. This allows websites to load faster on your next visit or usage data to be stored. To find out how you can object to this storage of usage data, see Revoking Consent to Data Processing.

5.1.2 Categories and Origin of Personal Data

In connection with advertising on our GMX Internet portal we process only process pseudonymized usage data. Usage data are all information arising during the use of a service and indicates the scope of use of each respective product. We collect these data via your device, which you use to navigate our portal.

5.1.3 Configuration Options

Use the revocation options according to our GMX Data Privacy Notice.

If you no longer want to receive interest-based online advertising, you can control this by managing cookies for each partner using the opt-out function. To do this, please visit http://www.youronlinechoices.com/uk/your-ad-choices.

Deactivate Interest-based advertising and reset the advertising ID on Android devices.

On Android devices, the option “deactivate interest-based advertising” is deactivated as a standard. If you would like to change this, open the Google settings, click on “Ads” and activate them.* By using this OPT-OUT option, you stop the display of interest-based advertising based on the advertising ID of your device.

In addition, you have the option of resetting your advertising ID. You can do this also in the Google settings › Ads:
Click on “Reset advertising ID” and all information collected so far will be reset and the advertising ID on your device will be replaced by a randomly generated number.*

The menu options may vary depending on the device and version.

Use of the advertising ID within applications (apps)

For targeted management of advertising content, we use the advertising ID within our Android applications or advertising ID (IDFA) within our Apple applications, which identify the device without personal references. So if you download and use 1&1 Mail & Media GmbH applications, you transfer a clearly allocated number (advertising ID or IDFA) to us. We are unable to make a personal identification based on the advertising ID or IDFA.

5.1.4 Transfer to Third Parties or Abroad

Of course, it is important to us to adhere to all data privacy regulations when it comes to advertising as well! When we allocate advertising space on our Internet portal, we work with companies from around the world. Many companies are also located abroad. Therefore, it is possible that your data [sic!] pseudonymous usage data are used outside of German in these cases for selection of advertising materials.

Handling of your personal data in conformance with data privacy requirements is regulated by the respective applicable law, for example, by the EU General Data Protection Regulation within the EU.