Email.eu — Privacy Statement

Last updated: 21 June 2026

We only collect what we need, we keep it in the EU, and we never sell it. This statement explains what personal data we process as controller — about visitors to our website, prospective customers, and the people who administer a Workspace. For personal data inside a customer's Workspace, the customer is the controller and we act as processor under the Data Processing Agreement.

1. Who we are

The controller is Remails B.V., trading as Email.eu, Boumaboulevard 406, 9723 ZT Groningen, The Netherlands (KVK 89044819). For privacy questions, contact privacy@email.eu. We are not required to appoint a Data Protection Officer under Article 37 GDPR and have not appointed one; privacy matters are handled by the team reachable at privacy@email.eu.

2. What we process, why, and on what basis

We process personal data only for clear purposes and only as long as we need it.

Website visitors. Limited technical data needed to serve and secure the site, and aggregate usage statistics (see Section 9). We use Umami, a privacy-focused, cookieless, open-source analytics tool that we self-host on our own EU infrastructure — the data never leaves our cluster and is not shared with any third party. It does not set cookies, does not build cross-site profiles, and does not store raw IP addresses. We do not run advertising trackers. Lawful basis: legitimate interest (security, operation, and measuring use of the site).
Enquiries & support. Your name, email address, and the content of your message, so we can respond and keep a record. Lawful basis: legitimate interest / steps prior to a contract.
Account & billing. For Administrators and billing contacts: name, email, organisation, invoice/address details, and account configuration. Lawful basis: performance of the contract and compliance with legal (e.g. tax) obligations.
Demos, trials & marketing. Contact details you give us to request access, book a demo, or subscribe to updates. Lawful basis: consent, which you can withdraw at any time (every email includes an unsubscribe link).

We do not sell or share personal data with data brokers, and we do not use it for automated decision-making that produces legal or similarly significant effects.

3. How long we keep it

Enquiry/support correspondence: retained for 12 months after the matter is resolved.
Account & billing records: retained for the duration of the contract and afterwards as required by law (Dutch tax law generally requires 7 years for financial records), plus up to 2 years for account records.
Marketing/newsletter: deleted within 1 month of unsubscribing.

4. Where it's processed

All personal data we process as controller is processed within the EU/EEA. Where a recipient or sub-processor would involve a transfer outside the EU/EEA, we apply an appropriate safeguard under Chapter V GDPR (adequacy decision or Standard Contractual Clauses with supplementary measures) — but our standing commitment is EU-only processing.

5. Who we share it with

We share personal data only with service providers acting on our behalf, under data protection terms — principally our hosting provider (OVHcloud, France), payment processor (Mollie, Netherlands), and invoicing/accounting provider (Moneybird, Netherlands). All are EU/EEA-based. Our website analytics (Umami) is self-hosted on our own infrastructure and involves no third-party analytics provider. The sub-processors that handle data inside customer Workspaces are listed in the annex to the DPA. We may disclose data where legally required, in which case we apply our transparency commitments (including our published government-request reporting). We do not otherwise disclose personal data to third parties.

6. Importing your data from Google

If you choose to migrate into Email.eu from Google — Gmail, Google Drive, Google Calendar, or Google Contacts — you can connect your Google account with "Continue with Google." When you do:

You stay in control, and it's read-only on Google's side. We use Google's APIs only to read the data you ask us to bring across, and only after you grant consent. We never create, modify, or delete anything in your Google account.
Your data goes only to your own Email.eu account — your mailbox, Drive, calendar, or address book. It is not used for any other purpose, and it is not shared with anyone else.
We keep almost nothing. The migration runs automatically and streams your data straight into your Email.eu account; we do not retain the migrated messages, files, events, or contacts afterwards. The only credential we store is the Google authorisation token, encrypted at rest, and we delete it as soon as the migration finishes.
No profiling, no ads, no training. We do not use Google data to serve advertising, to build profiles, or to train machine-learning models, and no person at Email.eu reads it.

Email.eu's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The same principles apply to imports from other providers (for example Microsoft, or any IMAP mailbox): read-only on the source, into your own Email.eu account, with source credentials encrypted and discarded when the migration completes.

7. How we protect it

We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, least-privilege administration, staff confidentiality undertakings, and monitoring. See the Email.eu trust center and the DPA for detail.

8. Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, and you can object to processing or withdraw consent at any time. To exercise a right, contact us at privacy@email.eu. We will respond within one month (extendable by up to two further months for complex requests, with notice). If your personal data sits inside a customer Workspace, we will direct your request to that customer as the controller.

9. Cookies

Our analytics (self-hosted Umami) is cookieless and sets no cookies on your device. We use only the small number of strictly functional cookies described in our Cookie Statement. We set no advertising or cross-site tracking cookies, so there is no consent wall to click through.

10. Changes

We may update this statement to reflect changes in our processing or the law. We will post the updated version here and revise the "Last updated" date; we will give prominent notice of material changes.

11. Complaints & supervisory authority

If you have a concern, please contact us first at privacy@email.eu so we can put it right. You also have the right to lodge a complaint with the Dutch Data Protection Authority — the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) — or with the supervisory authority in your EU/EEA country of residence or work.