For the personal data registered by OneBox in the course of provision of services to you, OneBox is the Data Controller and with regard to the content of your digital mailbox and your archive system, you are the Data Controller and OneBox is the Data Processor.
OneBox as the Data Controller
OneBox collects personal data such as a) names, CPR, identification and contact details (address, telephone number, e-mail, date of birth), b) login details, c) details on you that you have entered yourself, e.g. credit card and payment details, d) details of your communications with OneBox e) details of your activities in your digital mailbox, f) details on the operating system used by your computer, mobile device and browser used, and g) IP address.
OneBox processes your personal data as part of its business, including a) to be able to provide services to you, b) to be able to send you newsletters and promote our products and services, c) for anonymized statistics and analyses, d) for product development and improvement of our service, and e) for internal and administrative purposes. Certain personal data may be processed because it is required by law.
When necessary, OneBox can share your data with a) OneBox group companies, b) IT suppliers and third parties who process your data on our behalf, c) authorities and businesses with whom you have registered, d) businesses to whom you have given consent for sharing, and e) OneBox’s associates when necessary to be able to provide a service you have chosen. Disclosure and transfer of data outside the country will always be in compliance with the PDPL; and – when required – with your prior consent.
National ID number (CPR)
Your National ID number (CPR) will only be processed in three situations: a) to ensure that you are the correct recipient of messages b) to identify you when a sender with whom you are not yet registered wants to send messages to you in OneBox, to which you can respond by registering, and c) for electronic disclosure, including when you are redirected to someone else’s website by clicking on a link, and automatically logged on.
OneBox processes your personal data either a) on the basis of your prior consent, b) to fulfill an agreement with you, or c) in certain circumstances in pursuance of a legitimate interest. A legitimate interest can be improvement of our services, responding to an inquiry from you or anything similar.
You have the right to a) request access to your personal data, b) correct, delete or limit the use of your personal data, and c) object to the processing of your personal data.
If OneBox processes your personal data on the basis of your consent (including consent to direct marketing), you can withdraw that consent at any time. This will not affect the legality of the processing based on your consent before you withdrew it.
Confidentiality and storage
Your personal data will always be processed confidentially, regardless of whether you have actively given your personal data, or they have been gathered by OneBox in some other manner. OneBox will only store your personal data for as long as necessary to fulfill our obligations.
If you have any questions concerning your personal data and our processing of it, or you want to complain, you can use the User Support function on our website. If your complaint is not dealt with satisfactorily by O OneBox, and you want to pursue the matter further, you can contact the competent authorities (Data Protection Authority).
Our data protection controller
Because our core business is the sending of electronic mail between a sender and an end-user that can contain personal data, OneBox has appointed a data protection controller.
General questions concerning personal data compliance and data protection law can be addressed to the OneBox data protection controller at the following address: firstname.lastname@example.org
OneBox as the Data Processor
The following constitute the rights and undertakings applicable to you as the Data Controller and OneBox as the Data Processor.
Scope and purpose
OneBox only processes personal data for the purposes necessary for your digital mail and other content to be placed and stored in your digital mailbox and in your archive system.
The processing of personal data by OneBox in the course of provision of services includes gathering, registering, storing, deleting, updating and disclosure.
Categories of personal data
The content of messages and documents transferred to OneBox, either by a sender to be placed in your digital mailbox or by yourself for storing in your archive system at OneBox, is determined by the sender or you. Messages and documents therefore contain body text that is not determined by OneBox, and that can contain general and sensitive data to some extent.
Categories of data subjects
The categories of data subjects on which OneBox processes personal data are determined by the sender and yourself. In addition to yourself, the data subjects can include children, spouses or others who may be named in the content of documents and messages (body text).
OneBox only processes the personal data referred to on the basis of your instructions, unless such processing is required according to the PDPL, in which case OneBox will inform you of such legal requirements before processing, unless the law in question forbids such information with regard to important social interests.
If OneBox believes a specific instruction to contravene the PDPL, we will notify you accordingly.
Relevant data protection law
OneBox is obliged to comply with the PDPL in force at any time.
Technical and organizational security precautions
OneBox shall take the necessary technical and organizational measures needed (including any additional measures necessary) to prevent personal data being accidentally or illegally destroyed, lost or degraded, and to them being disclosed to any unauthorized third parties, abused, or in general processed in breach of data protection law.
Identification of the necessary technical and organizational security measures takes into account the
- current technical level,
- costs of implementation, and
- nature, scope, context and purpose of processing, along with the risks of varying probability and severity to the rights and liberties of natural persons.
OneBox ensures that those employees involved in the processing of personal data are subject to a duty of confidentiality and to a mandatory bond of secrecy.
Transfer of personal data:
OneBox uses suppliers to run its systems and therefore transfers your personal data to them. Suppliers to OneBox will be listed below:
OneBox will inform you if we plan to make changes in the use of the above suppliers. In the event of continued use of OneBox’s services after such notification, you must accept the change.
OneBox only processes personal data within the borders of the Kingdom of Bahrain or outside in accordance with the relevant terms of the PDPL.
Liability for compensation
This aspect is regulated by the PDPL, although OneBox cannot be held liable for indirect loss and consequential loss.