Last updated 2026-09-07.
This page is the information a controller needs under Article 28 of the UK GDPR and the EU GDPR. It forms part of the terms of service. Customers who need a countersigned data processing agreement can request one from hello@warymail.co.uk.
1. Roles
You are the controller of the personal data in the mailboxes you connect and of the people you correspond with. Wary Tech Ltd is the processor and acts only on your documented instructions — which are: to provide WaryMail as described in the terms, in the documentation, and through the settings you choose in the application.
2. Subject matter, duration, nature and purpose
- Subject matter
- Providing a hosted email workspace: syncing, indexing, displaying, sending and tracking mail for the mailboxes you connect.
- Duration
- For as long as your account exists, plus the deletion period in clause 8.
- Nature and purpose
- Collection, storage, organisation, retrieval, transmission, erasure — all in order to run the service for you.
3. Categories of data subject
- Your staff and other members of your workspace.
- Anyone who sends mail to, or receives mail from, a connected mailbox.
- Contacts created from that correspondence.
4. Categories of personal data
- Identification and contact data: names, email addresses, signatures.
- Message content: subjects, bodies while cached, attachments you open.
- Metadata: dates, folders, read state, thread relationships.
- Tracking data: opens and clicks on mail you send, with the IP address the request came from, a one-way hash of it, the browser or mail client it reported, and the device, operating system and browser read out of that. Where the message was addressed to more than one person and your mailbox supports it, each recipient receives an individually marked copy, so an open or click identifies which of them it was.
- Whatever else your correspondents happen to put in an email — which can include special category data. WaryMail does not ask for it and does not process it differently, so if your mail routinely contains health, biometric or similar data you should tell us before you rely on this document.
5. Security
The technical and organisational measures are described on the security page: encryption in transit, encryption of mailbox credentials at rest, per-workspace isolation enforced by default, two-factor authentication, least-privilege staff access with re-authentication and audit records, sanitised rendering of untrusted mail, backups and a rehearsed restore procedure. We review those measures as the service changes.
6. Sub-processors
You give general authorisation for the sub-processors listed on the sub-processors page. We will give at least 30 days' notice before adding or replacing one, and you may object on reasonable data protection grounds; if we cannot resolve the objection you may terminate the affected part of the service. Each sub-processor is bound by terms no less protective than these.
7. International transfers
Application data is held in the United Kingdom. Where a sub-processor operates elsewhere, the transfer relies on an adequacy decision or on standard contractual clauses with the UK addendum where required.
8. Deletion and return
- You can export your data from the application at any time without asking us.
- Disconnecting a mailbox deletes its credentials and cached content.
- On termination we delete workspace data within 30 days, except where the law requires us to keep something (invoices) or where it persists in backups until those rotate out of retention.
- We will confirm deletion in writing on request.
9. Assistance
- Data subject requests. If a request reaches us about data we hold for you, we will pass it to you rather than answering it, and help you respond.
- Breach notification. We will tell you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need for your own notification duties.
- Impact assessments. We will provide the information you reasonably need for a DPIA or a prior consultation.
10. Audit
We will provide the information needed to demonstrate compliance with this page, and allow an audit — by you or an auditor you appoint who is not a competitor — on reasonable notice, no more than once a year unless an incident or a regulator requires otherwise, at your cost and without disrupting other customers.
11. Your responsibilities
- Have a lawful basis for the mail you send and the tracking you switch on.
- Give your own recipients the privacy information they are entitled to.
- Connect only mailboxes you are authorised to connect, and remove members promptly when they leave.
- Configure retention and tracking settings in the way your own obligations require.
12. Contact
Data protection contact: hello@warymail.co.uk.