Privacy Notice

How to use this notice

The correct contact and legal role depend on the context in which the mailbox is used:

• A customer buying the Service directly should contact Obsidiancorps about orders, invoices, support, account administration and personal-use mailbox processing.
• An employee, contractor or other user of a business mailbox should normally contact the organisation that issued the mailbox, because that organisation decides the purposes of the mailbox processing.
• An external sender or recipient should contact the owner of the relevant mailbox or domain. Obsidiancorps will assist the controlling customer where required by the GDPR and the applicable data-processing agreement.

1. Who we are

1.1 Obsidiancorps S.à r.l.-S. is a Luxembourg company registered with the Luxembourg Trade and Companies Register under number B294975, with registered office at 1, rue Pasteur, L-4642 Differdange, Luxembourg. Its VAT number is LU36465320.

1.2 Obsidiancorps supplies and manages email hosting services, including account creation, secure configuration, customer administration, monitoring, log review, support, migration assistance and optional archive or restore services.

1.3 Privacy questions and requests may be sent to info@obsidiancorps.com or by post to the registered office above. Please mark postal correspondence for the attention of Privacy.

2. Scope and data-protection roles

2.1 This notice applies to personal data processed in connection with quotations, orders, account setup, domain configuration, hosted email, contacts, calendars, tasks, webmail, mobile synchronisation, administration, monitoring, support, migration, backup restore and the optional Security Email Archive.

2.2 Obsidiancorps acts as data controller when it determines why and how personal data is used for its own contract management, invoicing, customer communications, service security, legal compliance, service improvement and direct relationship with a personal-use subscriber.

2.3 For a business or professional customer, the customer normally acts as data controller for mailbox content, address books, calendars, tasks, employee account data and other personal data processed through the Service. In that context, Obsidiancorps acts as data processor and Qboxmail acts as sub-processor.

2.4 The customer is responsible for determining lawful purposes and legal bases, providing required notices, managing user permissions, selecting suitable security settings, handling data-subject requests and deciding retention periods for the personal data it controls.

2.5 For an individual personal-use subscriber, the household exemption may mean that the individual is not acting as a GDPR controller. In that case, Obsidiancorps acts as controller for the processing needed to provide, administer and secure the Service, and Qboxmail acts as processor for hosted content except where Qboxmail independently determines limited technical processing described in section 7.

2.6 This notice does not replace a business customer’s own employee, customer, supplier or website privacy notice. It also does not govern websites, apps or integrations operated by third parties.

3. Personal data we process

4. Where the data comes from

We may obtain personal data directly from the customer or user, from an organisation’s authorised administrator, from the operation of the Service, from external senders and recipients, from a previous mail provider during an authorised migration, from domain or DNS records, from payment and accounting providers, or from public authorities where permitted by law.

When a business customer supplies personal data about mailbox users or other people, the customer confirms that it is authorised to do so and that it has provided any information required by Articles 13 or 14 of the GDPR.

5. Why we process personal data and our legal bases

6. Managed administration and access to data

6.1 The managed nature of the Service means that authorised Obsidiancorps personnel may access the Qboxmail control panel, account settings, domain configuration, audit information and logs to create accounts, apply secure settings, investigate faults, monitor service health, respond to security events and follow customer instructions.

6.2 Routine monitoring is designed around status information, metadata, audit events and logs. Obsidiancorps does not routinely read message content. Content may be accessed only where it is necessary for a specific support, migration, restore, security or legal task and where access is authorised or otherwise permitted by law.

6.3 Access is limited according to job responsibilities and the principle of least privilege. Personnel and contractors with access are subject to confidentiality obligations and security requirements.

6.4 A business customer is responsible for determining who may request account changes, password resets, exports, archive searches or restore operations. Obsidiancorps may require verification or administrator approval before acting.

6.5 When investigating suspected compromise, spam, malware, unlawful use or an abuse complaint, Obsidiancorps and Qboxmail may process relevant logs, message metadata, security indicators and, where strictly necessary, affected content. Accounts may be restricted or suspended as described in the Email Hosting Terms and Conditions.

7. Qboxmail and other recipients

7.1 Qboxmail

The underlying hosting platform is supplied by Qboxmail S.r.l., Via Pollative 111/o, 59100 Prato (PO), Italy, VAT number IT02338120971. Qboxmail provides the mail servers, webmail, control panel, backup, archive and related infrastructure.

For mailbox content and customer-controlled collaboration data, Qboxmail acts as a processor or sub-processor. It may store data, make backup copies, provide security functions and perform operations needed to deliver the service or requested by Obsidiancorps on the controlling customer’s behalf.

Qboxmail separately acts as data controller for limited service-user data that it determines is necessary for technical support, antispam, antivirus, service-use controls, technical inspections, maintenance, fraud and abuse prevention, cooperation with authorities and aggregate statistics. This may include IP addresses, device and browser information, usernames, actions and outcomes, and message metadata such as sender, recipient, subject and message ID.

7.2 Other recipient categories

• Authorised Obsidiancorps employees, contractors and professional advisers who need access for service delivery, security, accounting, audit or legal advice.
• Qboxmail providers involved in antispam, antivirus and user-trustworthiness verification, subject to Qboxmail’s own GDPR arrangements.
• Banks, payment providers, accountants, auditors and tax advisers involved in billing, payment and legal compliance.
• Domain registrars, DNS providers, migration sources and other technical providers where needed for a customer-requested setup or migration.
• Third-party integration providers selected or enabled by the customer or user. Their own privacy notices apply to data they receive.
• External email recipients and their mail providers, because sending an email necessarily discloses the message and addressing data to the intended recipients and the systems used to deliver it.
• Courts, regulators, law-enforcement bodies and other competent authorities where disclosure is legally required or necessary to protect rights, users or infrastructure.

Obsidiancorps does not sell hosted personal data. It does not disclose mailbox content to advertisers or use mailbox content to build advertising profiles.

8. International transfers

8.1 Qboxmail’s Data Processing Agreement states that customer-hosted data and its backups are hosted only in facilities located in the European Economic Area. Qboxmail may provide the general area of the facilities on request, while withholding exact data-centre addresses for security reasons.

8.2 Qboxmail states that certain providers used for its independent service-user security processing may be located in the United States. Qboxmail states that it uses processor contracts and European Commission Standard Contractual Clauses for those transfers.

8.3 Email is a global communications system. When a user sends a message to a recipient outside the EEA, the message may be transmitted to and stored by that recipient or its mail provider in another country. That transfer is initiated by the user or controlling customer.

8.4 Customer-selected integrations or external clients may also transfer data outside the EEA. Customers should review the relevant provider’s privacy terms and ensure an appropriate transfer mechanism where they are acting as controller.

8.5 A copy or summary of applicable transfer safeguards may be requested, subject to necessary redactions for confidentiality and security.

9. How long we keep personal data

Personal data is kept only for as long as necessary for the purpose for which it is processed, subject to legal obligations, security needs, technical backup cycles and the controlling customer’s instructions.

10. Security measures

Obsidiancorps and Qboxmail use technical and organisational measures designed to protect personal data against unauthorised access, unlawful use, accidental loss, destruction or alteration. Measures vary according to the selected plan and configuration and may include:

• TLS encryption for webmail, POP, IMAP and SMTP connections, with encrypted authentication.
• Antivirus, antispam, malware detection, reputation checks and quarantine controls for incoming and outgoing mail.
• Two-factor authentication, IP restrictions, password expiry and password-reuse controls where available under the selected plan.
• Role-based access, least privilege, authorised personnel, confidentiality duties and monitoring of administrator activity.
• Firewalls, physical data-centre controls, redundancy, power and environmental protections, vulnerability management and incident procedures.
• Automatic daily mailbox snapshots retained for 15 days and additional disaster-recovery backups not directly accessible by customers.

No internet or email service can be guaranteed to be completely secure or error-free. Users must protect credentials, enable available security features, keep devices and software supported and updated, avoid forwarding one-time codes, and promptly report suspected compromise.

11. Personal data breaches

Obsidiancorps maintains procedures for identifying, assessing and responding to personal data breaches. Qboxmail has contractually committed to notify Obsidiancorps promptly of a breach affecting data it processes on our behalf.

Where Obsidiancorps is the controller, it will notify the CNPD and affected individuals when required by the GDPR. Where a business customer is the controller, Obsidiancorps will provide reasonable information and assistance so the customer can meet its own notification duties. Customers must provide accurate incident contacts and cooperate promptly with investigations.

12. Your data-protection rights

Subject to the conditions and exceptions in the GDPR, you may have the right to:

13. Complaints to the CNPD

You may lodge a complaint with the Luxembourg National Commission for Data Protection if you believe personal data has been processed in breach of the GDPR. The CNPD recommends contacting the controller first where practical.

Schedule 1 — Business customer privacy responsibilities

This Schedule is a practical summary for a business or professional customer acting as controller. It does not replace the customer’s own legal assessment or the applicable data-processing agreement.

Schedule 2 — Contact summary