Privacy Policy

1. The Operator

Owner and operator of the database containing personal data: BiccomTech LLP, BIN [BIN], address: [registered address].

Enquiries regarding personal data: privacy@hatmail.kz.

2. What Data We Collect

At registration:

• first name and last name;
• mailbox address;
• mobile phone number;
• password — stored only as an irreversible hash; no one can read it, including the Operator’s employees.

When the Service is used:

• messages, attachments, folders and labels stored in the mailbox;
• information about sign-in sessions: time, IP address, information about the browser or email client application;
• the security event log: successful and failed sign-in attempts, password changes and resets, blocks;
• technical information about message delivery: sender and recipient addresses, time, delivery result.

If you connect a mailbox held with another email service (the “Other mailboxes” section of the settings):

• the address of the connected mailbox and the name of the email service;
• the names and ports of that service’s mail servers (IMAP and SMTP) and the login name;
• the app password that you created with that email service — stored only in encrypted form, never displayed anywhere and never written to logs; the Service does not request or store the password to the mailbox itself;
• copies of the incoming and sent messages of that mailbox together with attachments and the “read”, “flagged” and “answered” marks — they are stored in your Hatmail mailbox as ordinary messages;
• technical information about copying: the time of the last check, the number of messages copied, records of which messages have already been copied (as irreversible hashes, without message content), information about connection errors, the time at which messages were sent from the address of that mailbox;
• a record of when you gave the instruction to connect the mailbox and when you disconnected it, together with the version of this Policy.

We do not collect information about racial or ethnic origin, political views, health or other special categories of data, and we do not ask you to provide it. Biometric data is not collected.

3. What We Use the Data For

• creating and maintaining the mailbox; receiving, storing and delivering messages;
• confirming the phone number at registration and restoring access;
• protection against account compromise, spam, fraud and malware;
• limiting bulk mailings from the mailboxes of the Service;
• connecting, on your instruction, to your mailboxes held with other email services: copying their messages to your mailbox and sending your messages from the addresses of those mailboxes;
• responding to user enquiries;
• complying with the requirements of the legislation of the Republic of Kazakhstan.

We do not use the content of messages to display advertising, do not build advertising profiles and do not sell data.

4. Grounds for Processing

Data is processed on the basis of the consent that the user gives at registration, and for the performance of the User Agreement. Certain data is processed in cases where this is expressly provided for by the laws of the Republic of Kazakhstan.

The data of a connected mailbox held with another email service is processed on the basis of a separate instruction that you give at the time each such mailbox is connected. Without an instruction, a mailbox is not connected. The instruction remains in effect while the mailbox is connected and terminates when it is disconnected.

5. Where and For How Long Data Is Stored

Personal data and messages are stored on servers located in the territory of the Republic of Kazakhstan.

• The account and messages — for as long as the mailbox exists.
• Information about sign-in sessions — until the end of the session, but no longer than 30 days without a new sign-in.
• The security event log — 12 months.
• An incomplete registration request and the SMS code — 10 minutes, after which they are deleted.
• Technical server logs are limited in size and are overwritten as they fill up.
• The data of a connected mailbox held with another email service (address, servers, app password, technical information about copying) — for as long as the mailbox is connected. On disconnection it is deleted immediately, and from backups within 7 days; the record of the connection and disconnection, with the mailbox address, remains in the security event log for that log’s retention period. On disconnection, the copies of messages are either deleted or remain in your mailbox, as you choose; those that remain are stored like your other messages, and you can delete them at any time.
• When a Hatmail mailbox is deleted, the data of all mailboxes connected to it and the copies of their messages are deleted together with it.

After a mailbox is deleted, the messages and account data are destroyed within no more than 30 days, unless longer storage is required by law.

6. To Whom Data Is Transferred

We transfer data to third parties only in the following cases:

• To the SMS provider SMS-Centre LLP (smsc.kz, Republic of Kazakhstan) — the phone number and the text of the message containing the confirmation code.
• To the recipients of your messages and the mail servers through which messages are delivered — to the extent necessary for delivery. If a recipient is located outside the Republic of Kazakhstan, the message is transferred there on your instruction.
• To the email service whose mailbox you have connected (for example, Google, Mail.ru, Yandex or another one specified by you) — on your instruction. The Service connects to it on your behalf and transmits the login name and the app password for sign-in; messages that you send from the address of that mailbox are transferred to the servers of that email service, and it is that service that delivers them to the recipients. If its servers are located outside the Republic of Kazakhstan, this data is transferred there on your instruction given at the time of connection (cross-border transfer). Further processing is carried out by the email service itself under its own rules.
• To state bodies — in response to requests made in the manner prescribed by the legislation of the Republic of Kazakhstan.

In all other cases data is not transferred to third parties and is not placed in publicly available sources.

7. How We Protect Data

• the connection to the Service and between mail servers is encrypted (TLS);
• passwords are stored as hashes; at sign-in the password is exchanged for a temporary access key, which is not issued to the browser;
• session information is stored in encrypted form;
• the app passwords of connected mailboxes are stored in encrypted form (AES-256-GCM) and are never displayed anywhere;
• connections to the servers of other email services are established only over a secure channel (TLS) with certificate verification; the app password is not transmitted without encryption;
• the content of messages in HTML format is displayed in an isolated area, and external images are not loaded by default;
• only authorized employees of the Operator have access to the servers.

If a personal data security breach occurs, the Operator will notify the authorized body within the period established by law and will inform the affected users.

8. Cookies

The Service uses one strictly necessary cookie, hm_sid, which stores the session identifier after sign-in. It is not accessible to scripts on the page, is transmitted only over a secure connection and is valid for up to 30 days. The Service does not use advertising or analytics cookies.

9. Your Rights

In accordance with the Law “On Personal Data and Their Protection”, you have the right to:

• know what data about you the Operator holds and obtain a copy of it;
• request that the data be amended or supplemented if it is inaccurate;
• request the blocking or destruction of data collected in violation of the law;
• withdraw your consent to the processing of data;
• at any time disconnect a mailbox held with another email service in the settings, or revoke the app password with that email service — after that the Service loses access to the mailbox;
• appeal against the Operator’s actions to the authorized body for the protection of personal data or to a court.

To exercise your rights, write to privacy@hatmail.kz from the address of your mailbox. We will reply within the periods established by the legislation of the Republic of Kazakhstan.

Withdrawal of consent means ceasing to use the Service: the mailbox cannot operate without the processing of data, and it will be deleted.

10. Children

The Service is not intended for persons under the age of 14. The data of minors aged 14 to 18 is processed with the consent of their legal representatives.

11. Amendments to the Policy

The new version of the Policy is published on this page with its date indicated. If the changes extend the list of data, the purposes of processing or the range of recipients, we will request new consent.