Privacy policy

Effective Date: October 2026 | Last Updated: October 2026

Inboxroad B.V. (“Inboxroad”, “we”, “us”, or “our”) provides high-performance email delivery infrastructure, server routing, and platform services. We process personal data in full compliance with the EU General Data Protection Regulation (GDPR / DSGVO) and national data protection laws.

1. Identity and Contact Details of the Data Controller

Inboxroad B.V. acts as the Data Controller for personal data collected through our website, client portal, sales inquiries, and billing relationships.

• Legal Entity: Inboxroad B.V.

• Address: De Lairessestraat 130, 1075 HL Amsterdam, The Netherlands

• Chamber of Commerce (KvK): 70654182

• VAT ID: NL858409276B01

• Privacy Email: privacy@inboxroad.com

2. Controller vs. Processor Roles

In accordance with EU Data Protection Law, Inboxroad operates in two distinct legal capacities:

• As a Data Controller: We collect and process personal data belonging to our website visitors, sales prospects, account admins, and billing contacts.

• As a Data Processor: When clients utilize our mail transfer agent (MTA) infrastructure and IP pools to route email campaigns, our clients act as the Data Controller for recipient data. Inboxroad processes recipient email addresses, envelope metadata, and campaign content strictly as a Data Processor governed by a mandatory Data Processing Agreement (DPA).

3. Data Categories, Purposes & Lawful Basis

We process personal data only when an explicit legal basis under Article 6(1) GDPR applies:

• Account Setup & Service Delivery: Full name, business email, phone number, company details, credentials.

  (Lawful Basis: Contract Performance — Art. 6(1)(b))

• Billing & Invoicing: Billing address, VAT number, transaction details, IBAN/payment history.

  (Lawful Basis: Legal Obligation — Art. 6(1)(c) & Contract Performance — Art. 6(1)(b))

• Infrastructure Security & Diagnostics: IP addresses, FCrDNS PTR records, SMTP logs, user-agent headers.

  (Lawful Basis: Legitimate Interest — Art. 6(1)(f) for server stability & IP reputation)

• B2B Direct Sales & Outreach: Business contact info, job title, domain ownership records.

  (Lawful Basis: Legitimate Interest — Art. 6(1)(f) for B2B commercial outreach)

• Website Analytics & Tracking: Online identifiers, device metadata, cookie consent states.

  (Lawful Basis: Consent — Art. 6(1)(a) granted via Consent Manager)

4. Server Diagnostics & SMTP Traffic Logs

To optimize deliverability, prevent abuse, and manage Virtual MTA pool routing, our PowerMTA infrastructure records operational SMTP traffic metadata.

• Logged Data: Sender IP, domain, Virtual MTA ID, recipient address, timestamp, SMTP response codes (2xx/4xx/5xx), and SPF/DKIM/DMARC status.

• Retention Window: Operational diagnostic logs are automatically purged or anonymized after 30 to 90 days, unless retained for ongoing security audits.

5. Data Sharing & Third-Party Sub-Processors

We do not sell or rent personal data. Data is shared strictly with service providers under confidential data processing agreements (EU data center providers, payment processors, and core infrastructure vendors).

Cross-border transfers outside the European Economic Area (EEA) are executed via Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework.

6. Data Retention Schedules

• Active Account Data: Contract duration plus 1 year following termination.

• Financial & Accounting Records: 7 years under Dutch statutory tax laws (Rijksbelastingdienst).

• SMTP & Bounce Diagnostic Logs: 30 to 90 days.

• Marketing & Sales Contacts: Retained until consent is revoked or an objection is filed.

7. Your Statutory Rights (Art. 15–22 GDPR)

You hold the following rights under EU data protection law:

• Access (Art. 15): Request a copy of your personal data.

• Rectification (Art. 16): Request correction of inaccurate information.

• Erasure (Art. 17): Request deletion of your personal data.

• Restriction (Art. 18): Restrict active processing under legal conditions.

• Data Portability (Art. 20): Receive your data in a structured, machine-readable format.

• Objection (Art. 21): Object to processing based on legitimate interests or direct marketing.

To exercise your rights, email privacy@inboxroad.com.

Supervisory Authority Complaints:

You have the right to lodge a complaint with the lead Dutch supervisory authority:

Autoriteit Persoonsgegevens (AP)

PO Box 93374, 2509 AJ DEN HAAG, The Netherlands

Phone: (+31) – (0)70 – 888 85 00

Website: autoriteitpersoonsgegevens.nl

8. Cookie & Consent Management

Non-essential analytics and marketing cookies are blocked until explicit consent is provided. You can modify or withdraw consent at any time via the “Privacy Settings” link in our website footer.