1. General Information

1.1 Controller

Protecting the privacy and personal information of our users is an important priority for Sjöberg Services AB. We process personal data in accordance with applicable data protection legislation and aim to provide clear and comprehensive information regarding how personal information is collected, used, stored, and protected.

The entity responsible for the processing of personal data is:

Managing Directors: Nikola Berg, Ester Samuelsson, Frederick Quick, Milan Jakobsson

Registered headquarters: IDKERBERGET, Sweden

1.2 Data Protection Officer

Questions or requests concerning data protection may be addressed to the Data Protection Officer of Sjöberg Services AB at:

Email: privacy@vermail.top

1.3 Your Rights as a Data Subject

Under the European General Data Protection Regulation (GDPR), data subjects are granted a number of rights concerning the processing of their personal data.

These include:

• the right of access pursuant to Article 15 GDPR;
• the right to rectification pursuant to Article 16 GDPR;
• the right to erasure pursuant to Article 17 GDPR;
• the right to restriction of processing pursuant to Article 18 GDPR;
• the right to object pursuant to Article 21 GDPR; and
• the right to data portability pursuant to Article 20 GDPR.

Requests concerning the exercise of these rights will be handled in accordance with the applicable legal requirements.

If you have questions regarding your personal data or the exercise of your rights, you may contact Vermail customer service or our Data Protection Officer.

In accordance with Article 77 GDPR, you also have the right to lodge a complaint with a competent data protection supervisory authority.

For questions concerning data protection in connection with telecommunications services, you may contact:

privacy@vermail.top

For privacy-related questions concerning our website or other products and services that are not related to telecommunications, you may also contact:

privacy@vermail.top

You may additionally submit a complaint to the competent supervisory authority in your country. Information about European data protection supervisory authorities is available at:

https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

Exercising Your Rights

The following sections explain in greater detail how you may exercise the individual rights available to you under applicable data protection law.

1.3.1 Right of Access by the Data Subject

Through the self-service area of your Vermail account, you can access an overview of the settings and personal information associated with your account.

If you require additional information regarding the processing of your personal data, you may contact our customer support team or our Data Protection Officer using the contact information provided above.

1.3.2 Rectification, Erasure and Restriction of Processing

The “My Account” section of your Vermail mailbox allows you to review and manage personal information connected with your account.

Where you have an existing contractual relationship with us, certain personal data must continue to be stored and processed for the duration of that relationship. We may also be required to retain specific information for longer periods where applicable laws impose retention obligations, including requirements arising under commercial or tax legislation.

1.3.3 Withdrawal of Your Consent

Where processing is based on your consent, you may withdraw that consent at any time.

This right also applies to consent granted before the EU General Data Protection Regulation became applicable on May 25, 2018.

Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.

If you no longer wish to receive interest-based advertising, you may withdraw the relevant consent through Permission Management.

Additional information about withdrawal options is provided within the sections relating to the respective products and services.

1.3.4 Right to Object

Under Article 21 GDPR, you have the right, where the applicable legal requirements are satisfied, to object to processing of your personal data carried out on the basis of Article 6(1)(f) GDPR, including processing based on our legitimate interests.

1.3.5 Right to Data Portability

Where the requirements of the GDPR are met, you have the right to receive personal data concerning you in a structured, commonly used and machine-readable format.

You may also transmit such data to another controller.

This right applies in particular where processing is based on:

• consent under Article 6(1)(a) GDPR;
• consent under Article 9(2)(a) GDPR; or
• a contract under Article 6(1)(b) GDPR.

Where technically feasible, you may request that we transmit the relevant personal data directly to another controller.

You may also export available account information yourself by opening “My Account” and selecting the relevant export function under “Personal Data”.

1.3.6 Right Not to Be Subject to Certain Automated Decisions

We do not use automated decision-making within the meaning of Article 22 GDPR where such processing would produce legal effects concerning you or otherwise significantly affect you.

1.3.7 Voluntary Provision of Data

Where processing is based on consent, the provision of your data is voluntary and you may withdraw your consent at any time.

However, certain information may be necessary in order for us to provide services under our General Terms & Conditions, including Vermail Free Webmail.

In other situations, processing may be based on our legitimate interests as described below.

1.3.8 Legitimate Interests

In certain circumstances, we process customer data on the basis of Article 6(1)(f) GDPR.

Depending on the processing activity, our legitimate interests may include:

• improving our products and services;
• preventing misuse, fraud or abuse;
• protecting our systems and users; and
• preparing internal statistics and analyses.

1.3.9 Transfers of Data Abroad

Personal data may be transferred or disclosed in the circumstances described below.

Group Companies

Where applicable, data may be transmitted to affiliated or group companies for legitimate business and security purposes.

The original service infrastructure described in this notice includes group-level data processing involving United Internet AG, Montabaur, including centralized information used to protect affiliated companies. Where such data is made available to another group company, this may occur for a specific purpose and subject to consideration of the legitimate interests and rights of the customer.

External Service Providers

We may provide personal data to third-party service providers where this is necessary for them to perform services on our behalf.

Such providers may include companies involved in:

• website and infrastructure hosting;
• data analysis;
• information technology services;
• technical infrastructure;
• customer support;
• email delivery; and
• related operational services.

We may also process or disclose personal information where this is necessary or appropriate in connection with legal obligations or legitimate interests.

This may include:

• complying with applicable laws or regulations, including legislation outside your country of residence;
• responding to public authorities or government agencies;
• cooperating with law-enforcement authorities;
• responding to lawful requests, orders or inquiries;
• enforcing our contractual terms;
• protecting our rights, privacy, security or property;
• protecting the rights, security or property of our affiliates, customers or other persons.

Personal data may also be disclosed or transferred as part of a corporate transaction, including a reorganization, merger, acquisition, joint venture, assignment, transfer, sale or other disposal of all or part of a business, assets or shares, including insolvency or comparable proceedings.

Recipients in such situations may include prospective or actual acquiring companies and their professional advisers.

Except where specific justified exceptions are described for individual products, the original processing arrangements covered by this notice provide that email, address-book and calendar information is processed in secure data centers located in Sweden.

1.4 Retention Periods

We retain personal data only for as long as necessary for the purpose for which it was collected or, where a longer period applies, for as long as storage is required or permitted under applicable law.

Relevant factors may include:

• the duration of your contractual or customer relationship with us;
• the period during which your account remains active; and
• statutory retention obligations.

Additional retention rules may apply to particular products and are described in the relevant sections below.

2.1 Purpose of Processing and Legal Basis

Vermail FreeMail provides a range of email and communication functions.

Depending on the service, users may:

• receive, compose, organize and delete emails;
• create and manage contacts;
• create, modify and delete calendar appointments;
• invite participants to calendar events;
• update account and customer information;
• manage privacy preferences, including settings relating to interest-based advertising;
• use online storage;
• access account information through mobile applications;
• create rules for organizing email; and
• use additional account-management features.

Where processing is necessary in order to provide the services agreed with you under the Vermail General Terms & Conditions and is not based on consent under Article 6(1)(a) GDPR, the legal basis is Article 6(1)(b) GDPR.

We may additionally process personal data where necessary for our legitimate interests, provided that your interests, fundamental rights and freedoms do not override those interests.

2.2 Categories and Sources of Personal Data

To provide Vermail FreeMail, we may process several categories of personal data.

User Data

This includes information you provide when registering, such as your name, date of birth and other account information.

Content Data

Content data consists of information that you actively create, store or use through the service.

Examples include:

• emails;
• address-book contacts;
• files stored in the Cloud;
• information uploaded through applications; and
• calendar entries.

We store such information so that it remains available for the purposes and functions provided by your account.

Email content is protected against unauthorized access and is treated confidentially except where disclosure is required by applicable law.

Usage Data

Usage data includes information generated through the use of our services and individual product functions.

Such information is deleted in accordance with applicable legal requirements.

For certain optional features, such as push notifications, we may request your permission when the feature is activated so that notifications can be sent when new messages arrive.

Traffic Data

Traffic data may include information generated when the email service is used, such as:

• date and time of access;
• delivery information; and
• the IP address of a device used to access the mailbox.

Such information is processed in accordance with applicable legal requirements.

2.3 Storage Period

In accordance with the General Terms & Conditions described in the original service framework, content and usage data may be deleted after 180 days of inactivity.

The registered email address and associated mailbox may be retained beyond that period where required by applicable statutory provisions.

When the optional “Improved Spam Detection” service is used, information collected for that feature may be processed and retained for 30 days.

When a valid account cancellation request is submitted, user information and/or the account may be deleted unless applicable laws require longer retention.

Traffic data is deleted following expiry of the applicable legal retention period.

Users should also be aware that downloading the Vermail Mail App may involve accepting the terms and conditions of the relevant application store, which may independently impose additional storage or processing requirements.

2.4 Withdrawal and Objection Options for Vermail FreeMail

As a general principle, user data and content data are processed where necessary to provide the services contractually agreed with you.

Where such processing is necessary for performance of the Vermail FreeMail contract, ending that processing generally requires termination of the applicable service or account.

The retention and processing of certain traffic data is subject to specific legal requirements. Where such traffic data is necessary to provide the service or must be retained by law, it may not be possible to object to that processing.

Options for controlling interest-based advertising are described in the Data Privacy & Advertising section.

We may also use standardized or automated analytical methods to understand and improve the experience provided through our websites, products and applications.

Information regarding withdrawal or opt-out options for such analyses is provided in the relevant privacy settings and sections of this notice.

3.1 Vermail Online Portal

3.1.1 Purpose of Processing and Legal Basis

We aim to make the Vermail Online Portal clear, intuitive and easy to navigate.

To understand how visitors use our portal and identify areas that may require improvement, we may process pseudonymized usage information in accordance with applicable law.

Where this processing is based on consent, the legal basis is Article 6(1)(a) GDPR.

3.1.2 Categories and Sources of Personal Data

The Vermail Online Portal may process pseudonymized usage information.

This information may be supplied directly through your interactions with the portal or automatically by the device used to access the website.

Examples include:

• cookies;
• usage information;
• retrieval of specific website elements; and
• the date and time of visits.

The information described here is processed in pseudonymized form and is not intended to directly identify you.

Such pseudonymized usage information is not combined with other personal information held about you for the purposes described in this section.

3.1.3 Configuration Options

We use standardized analytical processes to improve the usability of Vermail websites, applications and products.

Information about preventing or withdrawing the use of your information for analytical purposes is provided in the Vermail Services section, including Section 4.1.3.

Options for controlling interest-based advertising can be found in the Data Privacy & Advertising section.

3.1.4 Storage Period

Pseudonymized portal usage information is retained for no longer than one year.

3.2 Vermail News

3.2.1 Purpose of Processing and Legal Basis

Vermail News is intended to provide users with convenient access to current information and articles.

Various background processes may be used to make the presentation and use of news content more relevant and convenient.

With your consent, certain information, which may include location information, may be used to improve usability.

Where processing relies on your consent, the legal basis is Article 6(1)(a) GDPR.

3.2.2 Categories and Sources of Personal Data

When Vermail News is used, pseudonymized usage data may be processed in order to optimize the user experience.

Such data may be supplied through your interactions or automatically through the device used to access news content.

This may include:

• cookies;
• usage information;
• retrieval of particular news or page elements;
• date of access; and
• time of access.

Because such information is pseudonymized for the purposes described here, it is not intended to enable us to identify you directly.

It is also not combined with other personal information held by us for these purposes.

3.2.3 Storage Period

The principal storage periods are:

• pseudonymized information collected for these purposes may be retained for one year;
• usage information may be deleted when the relevant use ends.

Additional information is available in the Data Privacy & Advertising section.

3.2.4 Transfer to Third Parties

For the processing described in this section, data is not transferred to third parties.

3.3 Vermail Search

3.3.1 Purpose of Processing and Legal Basis

We continually seek to improve the search experience made available through Vermail.

With your consent, we may process pseudonymized usage data to understand how users interact with the search and online portal and to identify possible improvements.

The legal basis for consent-based processing is Article 6(1)(a) GDPR.

3.3.2 Categories and Sources of Personal Data

The search service may automatically collect usage information such as:

• search terms and queries;
• IP addresses; and
• technical or anonymous information relating to the user's browser.

3.3.3 Configuration Options

Paid search placements or sponsored results are identified as advertising.

Sponsored links are generally selected in relation to the search terms entered by the user.

Options for controlling interest-based advertising are available in the Data Privacy & Advertising section.

Standardized analytical methods may also be used to improve our products, websites and applications.

Information on preventing the use of data for analytical purposes is provided in the Vermail Services section.

3.3.4 Storage Period

Pseudonymized usage information generated in connection with Vermail Search is normally retained for approximately 7 days and, where necessary, for a maximum period of 21 days.

3.3.5 Transfers to Third Parties or Abroad

With your consent, Internet search functionality may be provided in cooperation with Google and YouTube API Services.

Within the scope of such cooperation, information including search queries, IP addresses and anonymous browser information may be transmitted to the relevant partner.

Google and YouTube API Services may process search data and interactions with results for purposes including:

• improving their search products;
• research and analysis;
• improving the relevance of results;
• tailoring advertising;
• identifying fraudulent advertising activity; and
• protecting their services against misuse.

Vermail Search may format or present search results supplied by Google and YouTube API Services in order to adapt the search experience to user expectations.

Depending on the partner and the processing involved, IP addresses or other information may be processed outside Europe.

Further information is available in the relevant partner documentation:

Google

• Google Terms of Service
• Google Privacy Policy

YouTube API Services

• YouTube Terms of Service
• Google Privacy Policy

3.4 Vermail Browser

3.4.1 Purpose of Processing and Legal Basis

The original service configuration covered by this privacy notice includes versions of Mozilla Firefox and Internet Explorer adapted or optimized for use with the email service.

Such browser configurations may include:

• a customized start page;
• the MailCheck browser extension;
• selected bookmarks; and
• the Vermail search service as the default search engine.

Where the processing of personal information is required in order to provide the browser-related service under the applicable user agreement, the legal basis is Article 6(1)(b) GDPR.

Pseudonymized data may additionally be processed to improve products on the basis of Article 6(1)(f) GDPR where the relevant legal requirements are satisfied.

3.4.2 Categories and Sources of Personal Data

Information processed in connection with the browser service may include account or file data supplied by the user, such as an email address.

Content data may include content actively created or used by the customer, including emails.

Such information is stored in order to make it available to the user and is protected against unauthorized access.

Where applicable, communications are also subject to relevant telecommunications confidentiality requirements.

3.4.3 Configuration Options

Account/file data and content data required to provide the service are processed for performance of the applicable user agreement.

Where processing is necessary for that agreement, objecting to such processing may require termination of the applicable service.

The storage of traffic data may also be subject to strict statutory requirements. Where traffic information must be processed to provide the service or comply with legal obligations, an objection may not be possible.

Advertising preferences and newsletter settings can be managed through the Data Privacy & Advertising section.

Information regarding analytical opt-outs is provided in the Vermail Services section.

3.4.4 Storage Period

The original service framework provides for internal storage and deletion periods of 30 days in this context.

For information concerning storage by Mozilla or Microsoft, users should refer to the respective privacy information supplied by those providers.

3.4.5 Transfers to Third Parties or Abroad

Where the browser functionality is provided in cooperation with third-party partners, pseudonymized user information may be transferred to those partners.

The Firefox privacy documentation explains what information Mozilla receives through use of Mozilla Firefox and how Mozilla processes that information.

Similarly, Microsoft's privacy documentation, including its information concerning Microsoft Edge and Internet Explorer, explains what information Microsoft may receive and how that information is handled.

3.5 Vermail MailCheck

3.5.1 Purpose of Processing and Legal Basis

Vermail MailCheck is a browser extension or Windows taskbar application designed to notify users about newly received email without requiring them to manually open their mailbox.

The original MailCheck functionality described by this notice supports accounts from services including:

• Vermail;
• WEB.DE;
• 1&1;
• mail.com;
• Gmail; and
• Outlook.com.

Where processing is required to provide MailCheck under a user agreement, the legal basis is Article 6(1)(b) GDPR.

3.5.2 Categories and Sources of Personal Data

Information processed may include account or file data provided by the user, such as an email address.

Email addresses associated with supported third-party services such as Gmail and Outlook.com may be stored locally on the user's device.

Content data may include email or other content actively created or used through the service.

This information is processed so that the relevant functionality can be made available to the user.

Content is protected against unauthorized access and, where applicable, subject to telecommunications confidentiality requirements.

3.5.3 Configuration Options

File data and content data required to provide MailCheck are processed in order to perform the applicable user agreement.

Where processing is essential for providing that functionality, objection may require ending the relevant service.

Traffic-data processing may be subject to statutory requirements and cannot necessarily be objected to where it is required for service provision.

Information regarding analytical opt-outs can be found in the Vermail Services section.

MailCheck does not collect personal content from supported third-party email services merely because the extension has technical access to such information.

Third-party account information is accessed for the purpose of presenting message previews or notifications to the user.

For performance purposes, certain information may be stored locally on the user's device. Such locally stored information can generally be removed by uninstalling the extension.

3.5.4 Storage Period

The original internal retention and deletion period applicable in this context is 30 days.

For information concerning storage by third-party email providers such as Gmail or Outlook.com, users should consult the privacy policies of the relevant provider.

3.5.5 Transfers to Third Parties or Abroad

Vermail does not transfer user information obtained through MailCheck to third parties merely because the extension connects to a third-party account.

MailCheck acts as a tool allowing the user to interact with information already held by the relevant third-party provider.

Those providers process information received through their own services in accordance with their respective privacy policies.

4.1 Analyses

4.1.1 Purpose of Processing and Legal Basis

We carry out analyses designed to understand how visitors interact with our websites, products and services and to help us make those services easier to use.

This may include analysis of browsing behavior, the reach and performance of our online offerings and comparable indicators.

We may also carry out customer-satisfaction surveys, opinion research and research relating to our digital products.

Such activities may use standardized analytical procedures together with established methods and techniques from applied social research.

Depending on the processing activity, the relevant legal basis may include Article 6(1)(a) and/or Article 6(1)(f) GDPR.

4.1.2 Categories and Sources of Personal Data

Depending on the type of analysis or survey, we may process the following categories of information.

Content or survey information:
For example, customer surveys may ask for socio-demographic information such as age or gender. Where applicable, such information is evaluated in pseudonymized form.

User data:
This may include information such as your name or the email address associated with your account.

Usage data:
This includes pseudonymized information describing how our services are used. Examples may include IP addresses or cookies used for audience measurement or analysis of Vermail digital services.

Information supplied in surveys is generally provided directly by users.

Where a survey invitation is associated with an email account, the relevant email address may originate from the information supplied when the user registered that account.

Where consent has been provided, inventory data or content data may also be used for analyses intended to optimize our products, services or websites.

SiteSpect

The original service configuration described in this notice includes the use of solutions supplied by SiteSpect, located at:

Such solutions may be used to present new developments or website variants to limited groups of users and to evaluate the resulting interactions through cookies and related information.

The original notice states that the relevant pages were optimized using information generated through website usage and that associated servers were hosted internally within the service provider's infrastructure.

Google Tag Manager

The website may use Google Tag Manager (GTM), a tag-management solution operated by:

Google Tag Manager is designed to manage JavaScript and HTML tags used for tracking, analytics and related website functionality.

The Tag Manager itself does not ordinarily create its own tracking profile, but it may trigger other tags which can independently collect information.

Google Tag Manager does not itself access the information collected by those tags.

The tracking tools configured through GTM may include:

• Google Analytics

Where privacy settings disable relevant processing, the Tag Manager configuration is intended to respect the applicable choices.

Additional information about Google's privacy practices and Google Tag Manager is available in Google's privacy documentation and applicable terms of use.

Google Analytics

The website may use Google Analytics, a web analytics service supplied by Google LLC.

Google Analytics may use cookies and related information, including IP-address information, to analyze how visitors use a website.

Where IP anonymization is enabled, the relevant IP address may be shortened or otherwise anonymized.

In exceptional circumstances, the full IP address may first be transmitted to Google infrastructure and subsequently shortened.

On behalf of the website operator, Google may process this information for purposes including:

• evaluating website usage;
• preparing reports concerning website activity;
• providing analytics services to website operators; and
• providing related services concerning website and Internet usage.

4.1.3 Configuration Options

Information collected through analytics is intended to help us adapt and improve products, applications and websites according to user needs.

Where the relevant processing is optional, users are provided with the opportunity to refuse or withdraw from such processing.

To disable data analysis intended to personalize or optimize products, applications or websites, use the corresponding opt-out functionality available through the account Privacy Settings.

Where Google Analytics is used, browser settings may also allow you to restrict or reject cookies.

Please note that disabling cookies may affect certain website features.

Google also provides tools that may allow users to prevent certain Google Analytics collection.

Where available, relevant settings may additionally be managed through Permission Management.

4.1.4 Storage Period

Vermail aims to process analytical information in accordance with applicable European data protection requirements.

Information generated through other analyses relating to customer demand, product performance, website improvement or comparable activities is retained for the period permitted or required under the applicable legal framework.

4.1.5 Transfers to Third Parties or Abroad

Information analyzed internally by Vermail solely for the purpose of improving our own products and websites is not transferred to external third parties unless otherwise stated in this notice or required by law.

4.2 Customer Care & Service

4.2.1 Purpose of Processing and Legal Basis

Vermail users may contact customer support regarding questions, problems or requests concerning the services they use.

To provide effective support, we may document services supplied to the customer as well as actions performed in connection with the account.

Information supplied by users may also be processed to ensure that services are used securely and appropriately.

For example, customer support may use account information to verify the identity of a person contacting us about an account.

Where customer-service processing is necessary to establish or perform a contractual relationship, the legal basis is Article 6(1)(b) GDPR.

4.2.2 Categories and Sources of Personal Data

Customer-service activities may involve the following categories of information:

User data – for example, your name, email address and other contact information.

Content data – information created or configured by you through the service, such as email-filter settings.

Usage data – pseudonymized information generated when services are used, including information describing the extent to which a product is used, such as the number of emails sent or received.

When establishing a Vermail account relationship, you may provide information such as your name, postal address and other registration information.

Activities performed through a Vermail FreeMail account may also be recorded or documented where necessary to provide, secure or support the service.

4.2.3 Configuration Options

Where applicable, use the withdrawal or termination options described in the Vermail Terms & Conditions.

As a general principle, user and content information required to provide the contractually agreed service must be processed while that service remains active.

Consequently, objecting to processing that is strictly necessary for Vermail FreeMail may require termination or deletion of the relevant account.

Settings relating to interest-based advertising are available in the Data Privacy & Advertising section.

Standardized analytical methods may also be used to improve Vermail products, websites and applications.

Information about preventing the use of information for analytical purposes is provided in the Vermail Services section.

4.2.4 Storage Period

Services supplied under the Free Webmail relationship and relevant actions performed by the user may be documented for as long as the account remains active.

Such information is subsequently deleted in accordance with the applicable deletion and retention requirements after the account is removed.

4.2.5 Transfers to Third Parties or Abroad

As a general rule, information processed for customer relationship management or ordinary customer-support purposes is not transferred to third parties.

However, where inaccurate or outdated inventory information is discovered in the context of collection or payment-reminder procedures, postal address information supplied by the customer or updated address information obtained through address research may, where legally permitted, be transferred to collection partners.

5.1 Advertising on the Vermail Online Portal

5.1.1 Purpose of Processing and Legal Basis

Advertising helps finance the continued availability of free Vermail services.

Where advertising is displayed, we seek to present advertising that is relevant to users and their interests.

Interest-based advertising may include:

• advertising for Vermail products;
• advertising for services offered through commercial partnerships; and
• advertising purchased by external companies on the Vermail Online Portal.

Revenue generated through these advertisements helps finance the operation of free products and services.

To provide an intuitive user experience, we may analyze general patterns of interaction with the online portal and the structure of user groups.

Where described in this notice, such analysis is conducted using pseudonymized information.

Pseudonymization is used as a privacy measure so that information is associated with randomized identifiers rather than being stored directly in connection with an identified individual.

For example, a pseudonymous identifier may make it possible to recognize that the same browser or user profile has already been shown a particular advertisement several times.

This information can be used for purposes such as controlling advertising frequency.

Pseudonymized advertising profiles used for these purposes are not intentionally combined with directly identifying personal information.

Where this processing is based on consent, the legal basis is Article 6(1)(a) GDPR.

Pseudonymized usage information may also be processed in accordance with applicable law in order to improve the user experience.

We may work with third-party advertising partners to provide a wider range of relevant online advertising, including advertising displayed outside Vermail's own portals.

Where permitted and where you have provided the required consent, information used for advertising may include:

• an email address in hashed or pseudonymized form;
• IP address;
• browser information;
• operating-system information; and
• other technical or usage information.

Such information may be shared with advertising partners for the purpose of providing personalized content or interest-based advertising.

An online identifier may also be generated so that a browser or device can be recognized across relevant interactions.

The identifier itself is not intended to contain directly identifying personal information.

You may withdraw relevant consent through Permission Management.

Information collected for advertising and pseudonymized profile creation is protected using appropriate security measures.

Such information may be stored using cookies.

Cookies are small files stored through a browser that enable websites to remember certain information between visits and may be used to improve page loading, retain settings or record usage information.

Information regarding control of these technologies is provided in Section 5.1.3.

5.1.2 Categories and Sources of Personal Data

Advertising on the Vermail Online Portal may involve processing pseudonymized usage information.

Usage information includes data generated when a user interacts with the service and may describe the nature or extent of use.

Examples include:

• clicks and interactions within the Vermail portal;
• use of Cloud storage;
• use of other Vermail functions; and
• comparable account or portal usage.

The information may be collected through the device used to access the portal.

Where you have a Vermail account, account-related or inventory information may also be processed in pseudonymized form using a user identifier.

Inventory data may include information supplied during registration.

5.1.3 Configuration Options

Users may exercise the withdrawal options provided in the Vermail Data Privacy Notice.

If you no longer wish to receive interest-based advertising based on consent, you may withdraw that consent through Permission Management.

We may also cooperate with advertising partners that provide usage-based advertising.

Where available, a list of relevant partners can be viewed through Permission Management under Our Partners.

Disabling Interest-Based Advertising and Resetting Advertising IDs on Mobile Devices

Android

Android devices provide privacy and advertising controls through the device and Google settings.

Depending on the operating-system version, users may be able to:

• restrict or disable interest-based advertising;
• manage advertising permissions; and
• reset or replace the device advertising identifier.

Menu names and procedures may vary according to Android version and device manufacturer.

iOS

Apple devices provide advertising and tracking controls through privacy settings.

Depending on the version of iOS, users may be able to restrict personalized advertising and control whether applications can track activity across applications and websites operated by other companies.

From versions of iOS implementing Apple's App Tracking Transparency framework, applications must request authorization before accessing the user's IDFA for cross-app or cross-site tracking.

If such permission has not been provided, the application cannot use the IDFA for those purposes.

Users who previously granted permission may generally modify their choice in:

Settings → Privacy → Tracking

Restrictions on tracking or personalized advertising do not necessarily reduce the total number of advertisements shown.

Menu names and available options may vary depending on the device and operating-system version.

Windows

Certain versions of Windows provide controls governing whether applications can use an Advertising ID.

Where supported, users may disable use of the Advertising ID through the relevant Privacy or Advertising settings.

Some versions may also provide an option to reset the identifier.

The exact menu structure depends on the device and version of Windows.

Use of Advertising Identifiers in Applications

For advertising purposes, Vermail applications may use device-based advertising identifiers where allowed.

On Android this may include an Android Advertising ID.

On Apple devices this may include the IDFA.

Such identifiers are intended to identify a device or application environment rather than directly identify the user by name.

Where Vermail applications operated by Sjöberg Services AB receive such an identifier, it may be associated with the relevant device for advertising purposes where legally permitted and subject to the applicable consent requirements.

The advertising identifier by itself is not intended to allow Vermail to identify the user personally.

5.1.4 Transfers to Third Parties or Abroad

Advertising services may involve cooperation with companies located in different countries.

As a result, pseudonymized usage information used for selecting or delivering advertisements may, in certain circumstances, be processed outside the country in which the user resides.

Personal information must nevertheless be handled in accordance with applicable data protection legislation.

Within the European Union, this includes the requirements of the General Data Protection Regulation.

5.2 Advertising in the Vermail Mailbox

5.2.1 Purpose of Processing and Legal Basis

Your Free and Secure Email Account

Vermail FreeMail is intended to provide users with a convenient digital environment for managing email and related services.

In order to continue offering certain services free of charge, Vermail may display advertising.

Where possible, advertising may be selected according to the interests or preferences of the user.

Where personalized or interest-based advertising is based on consent, the legal basis is Article 6(1)(a) GDPR.

Users may review or withdraw applicable consent through the Vermail Help Center, Permission Management or other privacy controls made available within the service.

Personal data may also be collected and processed without additional consent where such processing is necessary to establish or perform a contractual relationship or to carry out billing.

The legal basis for such processing is Article 6(1)(b) GDPR.

Where applicable, users may object to further processing by contacting:

Email: privacy@vermail.top

Following an objection, certain information may continue to be processed temporarily where this is technically unavoidable or legally required.

Information generally required to establish and administer a contractual relationship may include:

• name;
• postal address;
• date of birth;
• email address;
• telephone number;
• payment or bank information, where relevant; and
• password or authentication information.

Such information is generally collected through digital registration or order forms.

5.2.2 Categories and Sources of Personal Data

Advertising displayed in the mailbox may involve the processing of:

• inventory or account information; and
• pseudonymized usage information.

Inventory information may include information you supplied during registration, such as your name or address.

Usage information consists of data generated while our products and services are used.

Such information may be used to understand usage patterns and improve advertising relevance.

Where usage information is not required for billing or another legally permitted purpose, it is deleted in accordance with applicable legal requirements after the relevant period of use ends.

5.2.3 Configuration Options

Users may exercise the withdrawal options described in the Vermail Data Privacy Notice.

If you no longer wish to receive interest-based advertising based on consent, you may withdraw the relevant consent through Permission Management.

Vermail may also cooperate with external partners to provide a broader range of relevant online advertising.

Such partners may independently participate in usage-based or interest-based advertising.

Where available, the principal advertising partners can be viewed in Permission Management under Our Partners.

Disabling Interest-Based Advertising and Resetting Advertising IDs

Android Devices

Depending on your Android version and device, Google or operating-system privacy settings may provide options to restrict personalized advertising, manage the device Advertising ID or replace/reset that identifier.

The available menu structure varies according to device and software version.

iOS Devices

Apple privacy settings may allow users to restrict personalized advertisements and manage application tracking.

On versions of iOS subject to Apple's App Tracking Transparency requirements, applications must request permission before using an IDFA to track activity across applications or websites owned by other companies.

If permission has not been granted, the application may not use the IDFA for that tracking purpose.

Previously granted tracking permission can generally be changed through:

Settings → Privacy → Tracking

Disabling personalized advertising or tracking does not necessarily reduce the overall number of advertisements displayed.

Windows Devices

Certain Windows versions provide settings allowing users to control whether applications may use an Advertising ID.

Where available, users may disable this function or reset the relevant identifier through the device's privacy and advertising settings.

The precise procedure depends on the Windows version and device.

Advertising IDs Within Applications

Vermail applications may use a device Advertising ID where applicable and legally permitted.

Android applications may use an Android Advertising ID, while Apple applications may use an IDFA.

When applications operated by Sjöberg Services AB are downloaded and used, an advertising identifier may be transmitted for permitted advertising-related purposes.

Such an identifier can generally be associated with a particular device but is not, by itself, intended to enable us to identify the user personally.

5.2.4 Transfers to Third Parties or Abroad

Vermail recognizes the importance of complying with applicable privacy requirements when advertising is delivered.

Advertising activities may involve cooperation with businesses operating in multiple countries.

Consequently, pseudonymized usage information may in certain circumstances be processed outside the country in which the user resides for purposes connected with selecting or providing advertising.

Any processing remains subject to the relevant data protection requirements.

Within the European Union, these requirements include the GDPR.

5.2.5 Google Fonts

Advertising or other website elements may use web fonts provided by:

Where Google Fonts or comparable remotely supplied font resources are requested, the user's IP address may be transmitted to Google as technically necessary to provide the requested content.

Further information concerning Google's processing practices is available through Google's Privacy Policy.