Version 2.0 · In effect from 20 August 2026 · Last updated 20 August 2026
1. Who we are
HDQTRS is an unincorporated business established in United Kingdom.
We are the data controller for the personal data described here — the business that decides why and how it is used — except where section 2 says otherwise.
| Contact | For |
|---|---|
| [email protected] | Privacy questions, and requests to exercise your rights |
| [email protected] | Help with your account or the service |
| [email protected] | Reporting spam, abuse, or unlawful content |
| Not appointed | Data Protection Officer, where one is appointed |
| Not appointed — we do not currently offer the service in the EEA | Our representative in the EU/EEA (Art. 27 EU GDPR) |
| Not applicable — we are established in the UK | Our representative in the UK (Art. 27 UK GDPR) |
2. What this policy covers
This policy applies to the HDQTRS web applications, including HDQTRS Mail at mail.hdqtrs.app and the HDQTRS Dashboard at dashboard.hdqtrs.app, and to the mail servers that send and receive messages for those accounts.
Accounts provided by an organisation. Where your mailbox was created for you by an employer or another organisation, that organisation decides how the data in the account is used and we act on its instructions as its processor. In that case the organisation's own privacy notice governs, that organisation may be able to access, export, or delete the contents of your mailbox, and you should direct your requests to them first. We remain responsible for the technical data we need to run the platform securely.
This policy does not cover other websites or services you reach through a link or an email, which have their own privacy practices.
3. What we collect
We collect only what the service needs to work. In practice, that is:
| Category | What it includes | Where it comes from |
|---|---|---|
| Account identity | Your email address, your password (stored only as a salted hash — we never see or store the password itself), your display name, and your profile picture. | You, or the organisation that created your account. |
| Settings | Your email signature, accent colour, light or dark theme, default sort order, and which mailbox you last had open. | You. |
| Message data | Sender and recipient names and addresses, subject lines, message bodies in HTML and plain text, a short preview snippet, timestamps, folder, read and starred status, message identifiers, and any attachments. | You, and the people who email you. |
| Technical data | IP address, browser and device type, and request timestamps, recorded in web and mail server logs. | Automatically, when you use the service. |
| Support correspondence | Anything you send us when you ask for help. | You. |
| Privacy requests | The kind of request you made, what you wrote, a reference number, and what we did about it. | You, when you use the request form. |
| Agreement records | Which version of this policy and of the Terms you accepted, and when. No IP address or device details are stored with it. | You, when you accept them. |
Data about people who email you. When someone sends a message to your mailbox we receive their name, address, and whatever they wrote. We do not notify every sender individually, because doing so for every message would take disproportionate effort and would itself generate unwanted mail. This policy serves as that notice.
Profile pictures are publicly addressable. Your profile picture is stored in a public storage bucket, which means anyone who has the exact image URL can view it, even without an HDQTRS account. Do not upload an image you would not want seen this way. You can remove it at any time from Account → Profile picture.
What we do not collect. We do not use advertising trackers, analytics trackers, or social media pixels, and there are none embedded in these applications. Our interface fonts are served from our own servers, so simply loading a page does not send your IP address to a third-party font provider. We do not sell personal data, we do not share it for behavioural advertising, and we do not use the contents of your mail to train machine learning models.
4. Why we use it, and our legal basis
Most privacy laws require a lawful reason for every use of personal data. Ours are set out below, with the GDPR article named because it is the strictest formulation; the equivalent basis applies under UK, Swiss, Canadian, Australian and New Zealand law. Where we rely on legitimate interests, we have weighed those interests against your rights and concluded they do not override them; you can ask us for that assessment.
| What we do | Legal basis |
|---|---|
| Run your mailbox: send, receive, store, search, and display your messages | Performance of our contract with you — Art. 6(1)(b) |
| Create your account, authenticate you, and keep your session valid while you use the service | Performance of our contract with you — Art. 6(1)(b) |
| Keep you signed in after you close your browser, and carry that sign-in between HDQTRS sectors | Your consent — Art. 6(1)(a). You give it through the cookie banner and can withdraw it at any time. |
| Remember an interface preference you set yourself, such as theme or accent colour | Performance of our contract — Art. 6(1)(b). We store it only because you changed the setting. |
| Protect the service: filter spam, detect abuse, investigate security incidents, and keep server logs | Our legitimate interests in a secure and usable service — Art. 6(1)(f) |
| Answer your support requests | Performance of our contract, and our legitimate interest in supporting our users — Art. 6(1)(b) and 6(1)(f) |
| Handle a privacy request you raise, and keep a record that we handled it | Compliance with a legal obligation — Art. 6(1)(c). Data protection law requires us to respond, and to be able to show that we did. |
| Record which version of these documents you accepted | Our legitimate interest in being able to establish what was agreed — Art. 6(1)(f) |
| Meet legal obligations, including responding to lawful requests from authorities and keeping accounting records | Compliance with a legal obligation — Art. 6(1)(c) |
5. Your email content
Email is private correspondence and we treat it that way. We store and transmit your messages so that we can deliver the service you asked for, and for no other purpose.
- No human at HDQTRS reads your messages, except where you explicitly ask us to in order to resolve a support issue, where an automated abuse or security process flags a message for review, or where we are legally required to.
- We do not scan message content to profile you, to target advertising, or to train models.
- Messages may contain sensitive information — health details, political opinions, financial details — simply because people write about those things. Several laws treat this as a special category needing extra care, and one (California) classes the contents of your mail as sensitive personal information outright. We do not seek out or deliberately process such data; we handle it only as an unavoidable part of storing and delivering your correspondence.
- Remote images and other external content in a message are loaded from the sender's servers when a message is displayed, which can tell the sender that the message was opened. That is a property of email itself rather than of this service.
- Email in transit between providers is not guaranteed to be encrypted end to end. We use transport encryption wherever the receiving server supports it, but once a message leaves our infrastructure it is subject to the practices of the recipient's provider.
8. International transfers
Some of our providers process data outside your country, principally in the United States. Where the law requires a specific safeguard for that, we rely on the one it prescribes:
| If you are in | The safeguard we rely on |
|---|---|
| The EEA | An adequacy decision under Art. 45 GDPR where one covers the destination — including the EU–US Data Privacy Framework for certified US providers — otherwise Standard Contractual Clauses under Art. 46(2)(c), with a transfer impact assessment and encryption in transit and at rest. |
| The UK | UK adequacy regulations where they cover the destination — including the UK Extension to the EU–US Data Privacy Framework — otherwise the ICO International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. |
| Switzerland | A Federal Council adequacy decision where one applies — including the Swiss–US Data Privacy Framework — otherwise the Standard Contractual Clauses as recognised by the FDPIC. |
| Canada, Australia or New Zealand | Contractual commitments requiring the recipient to protect the data to a comparable standard. Under Australian Privacy Principle 8 we remain accountable to you for what an overseas recipient does with your data, and New Zealand Information Privacy Principle 12 permits the disclosure only because those comparable safeguards are in place. |
You can request a copy of the safeguards that apply to a specific transfer by writing to [email protected].
9. How long we keep it
We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.
| Data | Kept for |
|---|---|
| Account record: email address, display name, profile picture, and settings | Until you delete your account, then removed immediately by the deletion process, except where [TODO: name any records you must keep, e.g. billing records] must be retained |
| Messages you send, receive, and draft | Until you delete them. Deleting moves a message to Trash; emptying Trash removes it permanently. Deleting your account removes all of them at once |
| Mail server transport logs | 30 days, after which they are rotated out and deleted automatically |
| Web and application server logs | [TODO: confirm your web host’s log retention and state it here, e.g. 14 days] |
| Privacy requests you raise, and our response | Kept while we work on the request, then for [TODO: e.g. 2 years] as a record that we handled it correctly |
| Which version of these documents you accepted, and when | For as long as your account is open, then for as long as a claim could be brought about the agreement |
| Records we are legally required to keep, such as billing records | 6 years from the end of the accounting period, per UK tax law |
Backups are kept on a rolling schedule and are overwritten in the normal course. Data you delete may persist in a backup for a short period after deletion, during which it is not used for anything other than restoring the service.
10. How we protect it
The measures we apply include:
- HTTPS for all web traffic, and transport encryption for mail wherever the other server supports it;
- encryption at rest for the managed database and file storage;
- passwords stored only as salted hashes, never in a form we can read;
- row-level access rules in the database so an account can reach only its own messages, with privileged keys held server-side and never sent to the browser;
- sanitisation of message HTML before it is displayed, which strips scripts and other active content from incoming mail;
- access to production systems limited to the people who need it, and kept under review.
If something goes wrong. If a personal data breach occurs we will notify the competent regulator within the time its law allows — 72 hours of becoming aware, under the GDPR and UK GDPR — and we will tell you directly, without undue delay, where the breach is likely to result in a high risk to you. In Australia the Notifiable Data Breaches scheme applies; in New Zealand, the notifiable privacy breach rules in the Privacy Act 2020; and in the United States, the breach notification statute of each affected state. We will notify the relevant regulator and the people affected as each of those requires.
No system is perfectly secure. Please use a strong, unique password, keep it to yourself, and tell us at [email protected] if you think your account has been accessed by someone else.
11. Your rights
We give the rights below to everyone who uses HDQTRS, wherever you live, rather than only to people whose local law compels them. Some regions add further rights on top; those are in sections 13 onwards.
| Right | What it means |
|---|---|
| Access | Ask whether we hold data about you, and get a copy of it. |
| Portability | Get the data you gave us in a structured, machine-readable format you can take elsewhere. |
| Correction | Have inaccurate data corrected and incomplete data completed. |
| Deletion | Delete your account and its contents. We may keep what we are legally required to keep, or what we need to establish or defend legal claims. |
| Restriction | Ask us to pause processing while a dispute about accuracy or lawfulness is resolved. |
| Objection | Object to processing based on legitimate interests. We will stop unless we can show compelling grounds that override your rights. |
| Withdraw consent | Withdraw any consent you gave, at any time, without affecting what was lawful before you withdrew it. |
| Non-discrimination | We will not degrade your service or charge you more because you exercised a right. |
Rights over message content have a limit worth stating plainly: your mailbox contains other people's personal data too. Where answering a request in full would disclose a third party's data, we may need to redact parts of the response.
12. How to exercise them
Two of them you can do yourself, immediately, without asking us. In Mail, go to Settings → Privacy:
- Download my data exports your account record, settings, and every message in your mailbox as a single JSON file. That covers access and portability.
- Delete my account permanently removes your account, every message, every draft, and your profile picture. It asks you to type your email address first, because it cannot be undone.
For everything else there is a request form, in the same place. Correction, restriction, objection, withdrawing consent, a complaint, or an appeal against a decision — pick the kind of request, tell us what you want, and you get a reference number and the date we will respond by. Because you are signed in when you send it, we do not need to put you through a separate identity check.
You can also simply write to [email protected] from the address on your account, if you prefer.
We respond within 30 days, and within 20 working days for New Zealand access requests, which is the tightest deadline we work to. If a request is especially complex we may need longer, and we will tell you why inside that window. There is no charge, unless a request is manifestly unfounded or excessive.
You can use an authorised agent to make a request on your behalf. We will ask for proof that you gave them permission.
13. If you are in the European Economic Area
Our processing is governed by the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the ePrivacy Directive (2002/58/EC). The legal bases in section 4 are the GDPR Article 6 bases. Alongside the rights in section 11, you have:
- the right not to be subject to a decision based solely on automated processing (Art. 22) — see section 20;
- the right to a judicial remedy (Art. 79) as well as a regulatory complaint;
- the right to be told the safeguards used for any transfer outside the EEA (Art. 46).
Where message content amounts to a special category of data under Article 9, we process it only to deliver your correspondence — we do not use it for any other purpose.
You can complain to your national data protection authority (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en). We would rather you came to us first at [email protected], but you are not required to.
A list of authorities across the EEA is published by the European Data Protection Board at edpb.europa.eu. You may complain in the country where you live, where you work, or where the problem happened.
14. If you are in the United Kingdom
Our processing is governed by the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). UK GDPR gives you the same rights as section 11, and PECR — not the ePrivacy Directive — governs the storage described in section 6.
Transfers out of the UK rely on UK adequacy regulations, the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, as set out in section 8.
You can complain to Information Commissioner's Office (ICO) (https://ico.org.uk). We would rather you came to us first at [email protected], but you are not required to.
15. If you are in Switzerland
Our processing is governed by the Swiss Federal Act on Data Protection (revFADP). You have rights of access, correction, deletion and objection equivalent to those in section 11, and you may ask for the data you provided in a portable format.
You can complain to Federal Data Protection and Information Commissioner (FDPIC) (https://www.edoeb.admin.ch). We would rather you came to us first at [email protected], but you are not required to.
16. If you are in the United States
This section covers the California Consumer Privacy Act as amended by the CPRA, and the comprehensive privacy statutes of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states as they take effect. It applies to the extent one of those statutes covers you; where it does not, section 11 still does, because we extend those rights to everyone.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising— under the CCPA definitions of “sell” and “share”, and we have not done so in the preceding 12 months. There is therefore no “Do Not Sell or Share My Personal Information” mechanism to offer: there is nothing to opt out of.
Notice at collection. The categories in section 3, expressed in CCPA terms:
| CCPA category | Collected | Purpose | Sold or shared |
|---|---|---|---|
| Identifiers (name, email address, IP address, account ID) | Yes | Run your account and secure the service | No |
| Internet or network activity (request logs, device and browser type) | Yes | Security, abuse prevention, diagnostics | No |
| Sensitive personal information: account log-in credentials | Yes | Authenticate you — nothing else | No |
| Sensitive personal information: the contents of your mail, where we are not the intended recipient | Yes | Store, transmit and display your correspondence — nothing else | No |
| Commercial information (billing records, where a paid plan applies) | Where applicable | Take payment and meet tax obligations | No |
| Biometric, geolocation, or inferences drawn to profile you | No | — | No |
The right to limit sensitive personal information does not arise here. We use the sensitive categories above only to perform the service you asked for and to keep it secure, which are purposes the CPRA excludes from that right. We do not use them to infer characteristics about you.
Your rights — to know, access, correct, delete, obtain a portable copy, opt out of sale or sharing, limit sensitive data, and not be discriminated against for exercising any of them — are all covered by section 11 and the self-service tools in section 12. Depending on your state you may also have the right to opt out of targeted advertising and profiling that produces legal or similarly significant effects; we do neither.
Appeals. If we refuse a request, you may appeal by replying to our decision at [email protected] with the word “appeal”. We will respond within 45 days with a written explanation. If we deny the appeal we will tell you how to complain to your State Attorney General. Virginia, Colorado, Connecticut and several other states require this route.
Response times. California allows 45 days, extendable once. We aim for 30.
We recognise Global Privacy Control and similar opt-out preference signals. Since we do not sell or share data, receiving one changes nothing about how we treat you.
You can complain to California Privacy Protection Agency, or your State Attorney General (https://cppa.ca.gov). We would rather you came to us first at [email protected], but you are not required to.
17. If you are in Canada
Our processing is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial legislation. We collect, use and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances, and we rely on your consent — express where the information is sensitive, implied where it is plainly necessary to provide a mailbox you signed up for. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; withdrawing consent to the core processing means closing your account.
You have the right to access your personal information and to challenge its accuracy and completeness. Section 12 covers both. Quebec residents also have a right to data portability and to be informed of automated decision-making; we describe both above.
You can complain to Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca). We would rather you came to us first at [email protected], but you are not required to.
18. If you are in Australia
Our processing is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Under APP 1 this policy is our openly available statement of how we handle personal information; under APP 5 it is the notice we give you at collection.
- APP 6. We use personal information only for the purpose we collected it for, or a directly related purpose you would reasonably expect.
- APP 8. We disclose personal information to overseas recipients — the providers listed in section 7 — and we remain accountable to you for how they handle it.
- APP 11. Where we no longer need information and are not required to keep it, we destroy or de-identify it.
- APP 12 and 13. You may request access to, and correction of, your personal information. Section 12 covers both.
You do not have to identify yourself for general enquiries, though we cannot act on an account request without verifying who you are.
You can complain to Office of the Australian Information Commissioner (OAIC) (https://www.oaic.gov.au). We would rather you came to us first at [email protected], but you are not required to.
19. If you are in New Zealand
Our processing is governed by the Privacy Act 2020 and its Information Privacy Principles. Unlike Australia, the Privacy Act 2020 has no small-business exemption — it applies to every agency handling personal information, whatever its size, and it reaches overseas agencies carrying on business in New Zealand.
- IPP 6 and IPP 7. You may ask for access to, and correction of, your personal information. Section 12 covers both.
- IPP 12. We disclose personal information to recipients outside New Zealand — the providers in section 7 — only where they are subject to comparable safeguards, which we secure contractually.
- Notifiable privacy breaches. If a breach has caused, or is likely to cause, serious harm, we will notify the Privacy Commissioner and the people affected as soon as practicable.
Response times. IPP 6 requires us to decide on an access request as soon as reasonably practicable and no later than 20 working days after we receive it. That is tighter than our general 30-day commitment and takes precedence for New Zealand users.
If you are not satisfied with how we handle a request, you may complain to the Privacy Commissioner, and access complaints may ultimately be heard by the Human Rights Review Tribunal.
You can complain to Office of the Privacy Commissioner (https://www.privacy.org.nz). We would rather you came to us first at [email protected], but you are not required to.
20. Children
HDQTRS is a business service and is not directed at children. We do not knowingly create accounts for anyone under 16, or under the lower age at which your country allows a child to consent to online services on their own.
In the United States we do not knowingly collect personal information from children under 13, as COPPA requires. If you believe a child has an account with us, contact [email protected] and we will delete it. We do not sell the personal information of anyone under 16 under any circumstances.
21. Automated decision-making and profiling
We do not make decisions about you solely by automated means that produce legal effects concerning you or similarly significantly affect you. We do not build marketing profiles from your data, and we do not carry out targeted advertising or profiling of the kind US state privacy laws let you opt out of.
We do apply automated spam and malware filtering to incoming mail, which may move a message to a spam folder or reject it at the server. That is a security measure rather than a decision about you, and you can ask us to look at any message you believe was filtered wrongly.
22. Changes to this policy
We update this policy when the service changes or the law requires it. The version number and dates at the top of this page always reflect the current text.
If a change materially affects how we use your personal data, we will tell you in advance by email or through the application, so that you have a chance to review it and, if you wish, to object or close your account. Continuing to use HDQTRS after a change takes effect means the updated policy applies to you.