Purpose-limited
Data is processed only for operation, contracts, support, security and legal obligations.
Privacy at 24-mail
Privacy Policy
Privacy information under the GDPR, the German Federal Data Protection Act (BDSG), the Telecommunications Digital Services Data Protection Act (TDDDG) and the rules relevant to the email service — organized by the actual areas of the website, registration, mailbox, Cloud/Webdisk and support.
Last updated 22 September 2026 · Privacy Center 2.3.0
Scope 24-mail.com and associated services
No sale of personal data
Personal data is not sold for data trading or third-party advertising profiles.
Confidential communications
Communications content and the circumstances of telecommunications are protected under the applicable telecommunications rules.
Data-subject rights
Access, rectification, erasure, restriction, data portability, objection and complaint rights remain available.
1. Controller
Who is responsible for data processing
24-mail
Mike Krüppner
An der Reihe 02
09496 Marienberg
Germany
Contact
Email: info@24-mail.com
Web: 24-mail.com
Where a data protection officer is legally required for a processing activity, the officer's contact details will be provided in accordance with the applicable legal requirements. Privacy enquiries can in any event be sent to the contact address above.
2. Legal framework
Relevant rules
- GDPR for general data-protection principles, transparency duties and data-subject rights.
- BDSG as supplementary German data-protection law.
- TDDDG and TKG for telecommunications data, confidentiality of communications and special obligations of email services.
- Section 25 TDDDG for storing or accessing information on terminal equipment, in particular cookies and comparable technologies.
3. Legal bases
Why data may be processed
- Art. 6(1)(b) GDPR: performance of a contract and pre-contractual measures.
- Art. 6(1)(c) GDPR: compliance with legal obligations.
- Art. 6(1)(f) GDPR: legitimate interests, especially secure operation, abuse prevention, error analysis and legal defence, where those interests are not overridden.
- Art. 6(1)(a) GDPR: consent where processing requires consent; consent may be withdrawn for the future.
- Special legislation: the applicable provisions of the TDDDG and TKG additionally apply to telecommunications and traffic data.
4. Processing activities
Which data is processed by 24-mail
The following areas summarize the privacy information previously published by 24-mail and place it in the context of the current services and legal bases.
Website & server logs
When the website is accessed, technically necessary connection data may be processed, in particular IP address, date and time, requested resource, browser/user agent, operating system, referrer and technical status information.
- Purpose
- Delivery of the website, stability, error analysis and protection against attacks and abuse.
- Legal basis
- Art. 6(1)(f) GDPR and, where applicable, specific statutory security provisions.
Registration & customer account
During registration, the data requested in the relevant form is processed. This includes in particular name, requested email address, password and — where enabled or voluntarily provided — address, country, telephone number, alternative email address and other profile information. Registration time and registration IP address may be logged to prevent abuse.
- Purpose
- Creation and administration of the account, contract performance, authentication, security and support.
- Legal basis
- Art. 6(1)(b) and (f) GDPR; Art. 6(1)(c) GDPR where legal obligations apply.
Email transport, SMTP, spam & virus protection
Technically necessary communications and traffic data is processed for sending and receiving email. According to the currently published logging concept, delivery records in particular process sender, recipient, Message-ID and message size; subject lines or message bodies are not permanently logged in these transport logs for diagnostic purposes.
- Purpose
- Delivery, spam and malware protection, error analysis, abuse prevention and traceability of technical delivery processes.
- Special protection
- Communications content and related circumstances are subject to telecommunications confidentiality where applicable.
Webmail, POP3 & IMAP
Mailbox access may log account, time and IP address. For technical troubleshooting, deletion or move operations may log Message-ID, size and source and destination folders. Message content is not stored as diagnostic content in these technical operation logs.
- Purpose
- Authentication, mailbox operation, error analysis and protection against unauthorized access and abuse.
Cloud/Webdisk & Organizer
When Cloud/Webdisk, calendar, contacts, tasks or notes are used, 24-mail processes the content entered by the user and the account, access and metadata technically required to provide and synchronize those functions.
- Purpose
- Provision of the storage, organization and synchronization functions selected by the user.
- Legal basis
- Art. 6(1)(b) GDPR; technical security logs additionally Art. 6(1)(f) GDPR or applicable special legislation.
POP3 collection service, aliases & forwarding
Where these functions are used, 24-mail processes the destination addresses, server and account data, and technical retrieval and delivery information required for the respective function. The POP3 collection service processes credentials required to retrieve mail from the external account.
- Purpose
- Operation of the collection, alias and forwarding functions configured by the user.
Contact form & support
Depending on the request, support may process name, reply address, selected topic, custom subject, mailbox context, affected mailbox address, message, technical form-validation data, timestamps and security data. Never send your password through the contact form.
- Purpose
- Handling the request, assigning it to the affected account, preventing abuse, maintaining traceability and legal defence.
- Legal basis
- Art. 6(1)(b) GDPR for contract-related enquiries; otherwise Art. 6(1)(f) GDPR.
Applications
If job-application documents are sent to 24-mail, the data in them is processed solely for the application process. If no employment relationship is established, the data is deleted once it is no longer required for the application process and the defence of possible legal claims, unless consent or another legal basis permits longer storage.
5. Cookies, consent & local storage
Which cookies 24-mail uses
Yes, 24-mail uses cookies. Technically required cookies protect sign-in, sessions and requested service functions. From 24-mail 2026.281, persistent convenience cookies for language, view and interface preferences are stored persistently only when you allow them. The reviewed 24-mail source tree contains no advertising, tracking or audience-measurement cookie integration.
Cookie choice for this browser
You can change your choice at any time. Technically required cookies cannot be disabled because core functions such as secure sign-in and sessions otherwise cannot be provided reliably.
–
Your choice is stored in the m24_privacy_consent cookie for up to 180 days. It contains no identifier, only the choice and consent version. It is used solely to respect your decision and avoid asking again on every page view.
Technically required cookies
These include the b1gMail/PHP session, sessionSecret_* for secure session handover and, when using the mobile interface, bm_mobile2026. These cookies are used independently of the convenience choice where required for the requested function.
Explicitly requested sign-in function
If you enable “stay signed in”, bm_savedUser, bm_savedToken, bm_savedSSL or, on mobile, bm_msavedUser and bm_msavedToken may be stored for up to one year. This function is activated only at your explicit request and can be removed again in the mailbox privacy settings.
Convenience and preference cookies
These include bm_language, m24_view, m24_view_sig, noMobileRedirect, bm_externalContentDefault, bm_showStartPage and layout cookies such as vSepHeight1, hSepWidth1* and toggleGroup[...].
Without convenience consent, server-side preference cookies are limited to the current browser session where needed for the current function; persistent layout cookies are not newly written. Choosing “Reject optional” removes known persistent convenience cookies from this browser.
Local Storage & Session Storage
The interface also uses local browser storage for functions that are actually used, for example temporary mail selection, interface state or locally saved drafts. This storage is not used for advertising or tracking. Local drafts are deliberately not deleted automatically when cookies are rejected so that user-created content is not lost.
Current storage overview
| Storage | Category / purpose | Duration in 2026.284 | Trigger |
|---|---|---|---|
b1gMail/PHP session, sessionSecret_*, bm_mobile2026 | required: sign-in, session, secure handover, requested mobile view | browser session | sign-in or use of mobile interface |
m24_privacy_consent | privacy choice / consent management | up to 180 days | choice of “Reject optional” or “Allow convenience” |
bm_savedUser, bm_savedToken, bm_savedSSL; mobile bm_msavedUser, bm_msavedToken | explicitly requested “stay signed in” | up to 1 year | only when the sign-in option is enabled |
bm_language, m24_view, m24_view_sig, noMobileRedirect | language and mobile/desktop presentation | without convenience consent: session; with consent: depending on function up to 1 year | language or view change |
bm_externalContentDefault, bm_showStartPage | account preferences for external mail content or start page | without convenience consent: session; with consent: up to 1 year | related account setting |
vSepHeight1, hSepWidth1*, toggleGroup[...] | persistent layout/interface state | only with convenience consent, up to 1 year | corresponding interface action |
| Local Storage / Session Storage | feature-related interface state, temporary selection and local drafts | depending on feature, until session end or replacement/deletion | use of the relevant feature |
Cookie values are never shown in the mailbox “Privacy & cookies” settings for security reasons. The browser can list JavaScript-readable cookie names there live. HttpOnly cookies are intentionally not readable by JavaScript and may therefore be absent from that browser list.
Legal classification of device storage
Section 25(1) TDDDG generally requires consent for storing or accessing information on terminal equipment. Under Section 25(2)(2) TDDDG, consent is not required where storage or access is strictly necessary to provide a digital service expressly requested by the user. Consent for convenience storage can be changed or withdrawn at any time for the future.
No advertising or tracking use
The source tree reviewed for 24-mail 2026.284 contains no integration of Google Analytics, Matomo or comparable advertising/audience-measurement systems. A production configuration applied outside this webroot cannot be excluded or confirmed solely from the development tree.
6. Bot protection
CAPTCHA and Cloudflare Turnstile
24-mail may use a CAPTCHA provider to protect contact and registration forms against automated attacks. Where Cloudflare Turnstile is enabled, the service is provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.
According to Cloudflare, Turnstile processes only signals required for bot detection, including IP address, TLS/browser characteristics, user agent, site key and originating page. According to the provider, the contents of form fields are not read or transmitted by Turnstile.
Purpose and legal basis: protection against automated abuse, spam and attacks; Art. 6(1)(f) GDPR. Where the bot-protection service stores or accesses information on your device, permissibility is additionally governed by Section 25 TDDDG.
Third-country transfer: Cloudflare states that transfers from the EEA to the United States rely on its certification under the EU-U.S. Data Privacy Framework and, alternatively, Standard Contractual Clauses with supplementary safeguards.
7. Retention
Deletion periods and retention criteria
Personal data is generally stored only as long as necessary for the relevant purpose or as long as legal obligations or the establishment, exercise or defence of legal claims justify longer storage. The following periods reflect the technical retention concept previously published for 24-mail.
| Area | Typical data | Purpose | Published period |
|---|---|---|---|
| Web server / web portal / administration | Access time and IP address | Security, abuse prevention, error analysis | 4 days |
| SMTP / spam and virus filters | Sender, recipient, Message-ID, size | Delivery records, error analysis, abuse prevention | 7 days |
| POP3 / IMAP | Login time, IP address, technical deletion/move metadata | Account security and error analysis | 4 days |
| Customer administration | Master and account data | Contract and account administration | Generally 4 weeks after the end of the contract, unless legal obligations require otherwise |
| Account change logs | IP address for changes | Abuse prevention and traceability | 7 days |
| Customer support | Request, email content, attachments where applicable, voluntary information | Support, documentation, legal defence | Generally 2 years after the end of the calendar year, unless another period is required |
| Mailing-list server, where used | Login, IP, sender, recipient, Message-ID, size | Delivery and abuse prevention | 7 days |
| Webmail | Login time and IP address | Function and account security | 4 days |
| POP3 collection service, where used | Server, login, required credentials, retrieval log | Retrieval from external mailboxes | 7 days after removing the connection |
| General security logs | Logins and source IP addresses | Function, security, debugging | 4 days |
Note: statutory retention obligations, specific security incidents, open support cases or the establishment, exercise or defence of legal claims may lead to a different retention period in individual cases.
8. Recipients & third countries
Who may receive data
Categories of recipients
- authorized system administration and support personnel where required for the relevant purpose;
- technical service providers and processors where used for hosting, security or operation and where an appropriate legal framework exists;
- Cloudflare where Turnstile bot protection is enabled;
- authorities and courts where a valid legal obligation or other legal basis requires disclosure.
No commercialization of personal data
24-mail does not sell personal data and does not use account data or communications content for third-party advertising profiles or market research. Data is disclosed only where required to provide the service, required by law or permitted by another valid legal basis.
Transfers outside the EU/EEA, where they occur, take place only under the conditions of Art. 44 et seq. GDPR.
9. Security & confidentiality
Protection of the mailbox and communications
24-mail uses technical and organizational measures intended to be appropriate to the risk of processing. These include encrypted access paths, access restrictions, logging of security-relevant events, spam/malware protection and mechanisms against automated abuse.
Where 24-mail acts as a provider of telecommunications services, communications content and the circumstances of telecommunications are subject to communications confidentiality under the TDDDG. Knowledge obtained from telecommunications processes may be used or disclosed only to the extent permitted by law.
10. Statutory information requests
Authorities, courts and law enforcement
24-mail does not disclose subscriber, usage, traffic or communications data solely on the basis of an informal interest expressed by a third party. Disclosure takes place only where the required legal basis and other legal conditions are met. Requests are reviewed for their formal and substantive requirements.
Special statutory information procedures apply to telecommunications services. Which data must be disclosed, which body may request it and whether a judicial order is required depend on the specific data type, purpose and applicable legal basis. Statutory confidentiality or non-disclosure requirements remain unaffected.
11. Your rights
Data-subject rights under the GDPR
You may request information about personal data processed about you and the other information provided by law.
Incorrect personal data can be corrected and incomplete data completed.
You may request erasure of personal data where the statutory conditions are met.
Processing may be restricted where the statutory conditions are met.
Where applicable, you may receive data you provided in a structured, commonly used and machine-readable format.
You may object, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR.
Consent can be withdrawn at any time for the future. The lawfulness of processing carried out before withdrawal remains unaffected.
You may lodge a complaint with a data-protection supervisory authority if you consider the processing of your personal data to be unlawful.
No solely automated decision-making
According to the currently published service concept, there is no solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.
12. Data-protection supervision
Complaint options
Telecommunications privacy
Under Section 29 TDDDG, the Federal Commissioner for Data Protection and Freedom of Information (BfDI) is generally responsible for data-protection supervision of telecommunications services provided on a commercial basis.
The Federal Commissioner for Data Protection and Freedom of Information
Graurheindorfer Straße 153
53117 Bonn
www.bfdi.bund.de
Other processing activities
Depending on the subject of the processing, a different data-protection supervisory authority may be competent for activities not subject to special telecommunications privacy rules. For non-public bodies established in Saxony, this is generally the Saxon Commissioner for Data Protection and Transparency unless a special jurisdiction applies.
Saxon Commissioner for Data Protection and Transparency
Maternistraße 17
01067 Dresden
www.datenschutz.sachsen.de
13. Provision of data
Required and voluntary information
Fields are marked as mandatory only where necessary. Without the data required for registration, the contract, sign-in or a specific support request, the relevant service may not be provided or the request may not be processed. Voluntary information is treated as such and may, where technically provided, be changed or removed later.
14. Show definitions
Personal data
Information relating to an identified or identifiable natural person.
Data subject
The person whose personal data is processed.
Processing
Any operation involving personal data, such as collecting, storing, using, transmitting, restricting or deleting it.
Restriction
Marking stored data with the aim of limiting future processing.
Profiling
Automated processing used to evaluate certain personal aspects of a person.
Pseudonymization
Processing in which data can no longer be attributed directly to a specific person without separately held additional information.
Controller
The entity that determines the purposes and means of processing.
Processor
An entity that processes personal data on behalf of the controller.
Recipient / third party
Entities to which personal data is disclosed; the GDPR distinguishes between recipients and third parties.
Consent
A freely given, informed and unambiguous indication of wishes for a specific processing purpose.
This Privacy Policy is updated when legal requirements, services used or actual processing activities change. The version published on 24-mail.com at the relevant time is the current version.