Data protection and GDPR
In short: ViviMail data is stored in the United Kingdom. Business customers get a data processing agreement as part of our terms. You can download your data or request deletion from your dashboard, and we answer every request within one month.
1. Overview
- Data location: all ViviMail data, including mailboxes, is stored on servers in the United Kingdom (Portsmouth).
- Roles: we are a processor for your email content and a controller for account and billing data. See our Privacy Policy.
- Data processing agreement: included in our Terms of Service (Schedule 1), covering Article 28 UK GDPR. No separate signature is needed.
- Regulator: Viviron Ltd is registered with the Information Commissioner's Office, registration reference ZC198708.
2. Exercising your rights
- Download your data: in the dashboard, go to Account security > Your data and choose Download my data. You get a file with your account, organisations, devices, settings and security history.
- Export your email: connect any IMAP email app (for example Thunderbird) to copy your mailboxes.
- Delete your account: in the dashboard, go to Account security > Your data and choose Request account deletion. We complete it within one month and confirm by email.
- Anything else (correction, restriction, objection): email hello@vivimail.co.uk with "Privacy" in the subject.
If you are a customer's employee or correspondent, requests about email content should go to that organisation, as the controller. We will help them respond.
3. Sub-processors
| Sub-processor | Purpose | Data | Location and safeguard |
|---|---|---|---|
| Contabo GmbH | Server hosting | All service data, including mailboxes | United Kingdom |
| Cloudflare, Inc. | Website security and delivery, DNS, robot check | IP addresses, website requests | Global; UK IDTA / UK Addendum and UK Extension to the EU-US Data Privacy Framework |
| Stripe Payments Europe Ltd and Stripe, Inc. | Payments and billing | Billing contact details, payment data | Ireland and USA; UK adequacy and UK Addendum |
We give customers at least 30 days' notice of a new sub-processor on this page and by email to account owners.
4. Security measures
- Encryption in transit for the website, webmail and email apps (TLS), and encrypted connections to other mail servers where they support it.
- Two-step verification required for every account, with passkey support; per-device app passwords for email apps.
- Passwords stored only as strong one-way hashes (Argon2id); API keys and 2FA secrets encrypted.
- Strict separation between customer organisations, enforced in the database.
- Staff access to customer accounts only where necessary, with a recorded reason, time limits and logging.
- Spam and virus filtering, sending limits and automatic alerts for suspicious activity, password-guessing and blocklisting.
- Server access restricted to a private network; changes to security settings raise alerts.
5. If something goes wrong
If we become aware of a personal data breach, we contain it, assess the risk and record it. Where required we notify the ICO within 72 hours and affected individuals without undue delay. For breaches affecting customers' email content, we notify the customer within 48 hours so they can meet their own obligations.
6. Contact
Email hello@vivimail.co.uk with "Privacy" in the subject, or write to Viviron Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. You can also complain to the ICO.