Privacy Policy
This notice has been in force since 16 November 2021 · Version: 1.0
The company SOOMA.COM – WEB SERVICES, LDA. processes your personal data with respect, transparency and in compliance with the General Data Protection Regulation (GDPR). Your data is processed and stored on servers located in Portugal, and backups are kept in Berlin, Germany, always within the European Union.
1. Data Controller
SOOMA.COM – WEB SERVICES, LDA.
Rua Dom João I, 99
4450-143 Matosinhos
Portugal
Company number (NIPC): 515 060 445
Phone: 210 205 164 or 220 280 335
Email: hello@sooma.com
Website: sooma.com
Contact: Fernando Costa
Data Protection Officer: dpo@sooma.com
A Data Protection Officer has been formally appointed.
2. Personal Data We Collect
2.1. Data you provide to us directly
- Identification data: name, job title, company
- Contact data: email address, telephone number
- Account data: access credentials for the service and the administration panel
- Billing data: billing address, tax identification number (NIF/NIPC), payment details
- Communications: messages sent through the contact forms and support
2.2. Data processed as part of the email service
As an email service provider, Sooma stores and transmits, on behalf of the client, the content of messages, attachments, contacts and calendars in the mailboxes. This data:
- is processed exclusively to provide the contracted service;
- is not analysed for commercial, advertising or profiling purposes;
- is subject to confidentiality of communications under the law.
In relations with business clients, Sooma acts as a processor (Art. 28 GDPR) in respect of the personal data contained in the mailboxes, with the client being the controller. A data processing agreement (DPA) is available, annexed to the service contract and provided on request.
2.3. Data collected automatically
- Website usage data: pages visited, session duration
- Technical data and logs: IP address, browser type, connection and mail delivery logs (metadata), needed for operation, security and combating abuse
- Cookies and similar technologies: as set out in our Cookie Policy
3. Purposes and Legal Bases of Processing
| Purpose | Legal basis |
|---|---|
| Provision of email, calendar and contacts services | Performance of a contract (Art. 6(1)(b) GDPR) |
| Issuing of certificates and legal proof (Registered Email) | Performance of a contract; legal obligation (eIDAS; Decree-Law no. 12/2021) |
| Billing and financial management | Legal obligation (Art. 6(1)(c) GDPR) |
| Technical support and customer service | Performance of a contract / legitimate interest |
| Network and information security, prevention of abuse and fraud | Legitimate interest (Art. 6(1)(f) GDPR; Recital 49); compliance with cybersecurity obligations (Directive (EU) 2022/2555, NIS2) |
| Marketing communications (newsletter) | Consent (Art. 6(1)(a) GDPR) |
| Compliance with legal obligations and orders from authorities | Legal obligation (Art. 6(1)(c) GDPR) |
4. Data Retention
We keep each category of data only for as long as necessary for the purpose that justifies its processing or for the period required by law.
4.1. Account, contract and billing data
| Data | Purpose | Retention | Access |
|---|---|---|---|
| Name, email address, contact and account details | Performance of the contract and customer support | For the term of the contract and up to 10 years after it ends | Systems administration, customer support, management |
| Billing and payment data | Compliance with tax obligations | 10 years | Accounting, management |
| Communications with customer support | Proof and follow-up of the request | 2 years after the request is closed | Customer support, systems administration |
4.2. Service content
| Data | Purpose | Retention | Access |
|---|---|---|---|
| Content of mailboxes, calendars and contacts | Provision of the Service | Term of the service; deletion 60 days after termination | No access, except as strictly necessary to provide the Service or at the Client's request |
| Registered Email certificates and proofs | Legal proof of sending (eIDAS; Decree-Law no. 12/2021) | 10 years; made available to the Client in a dedicated folder in their mailbox | Systems administration |
4.3. Technical logs
We do not retain traffic data for criminal investigation purposes. The logs below are intended exclusively to ensure the operation of the Service, prevent misuse and respond to security incidents.
| System | Data logged | Purpose | Retention | Access |
|---|---|---|---|---|
| Webmail and administration panel | Date, time and IP address of access | Detection of unauthorised access | 14 days | Systems administration, customer support |
| SMTP servers and anti-spam filters | Sender, recipient, message identifier and size. Neither the content nor the subject is logged | Proving delivery or receipt in the event of a complaint; preventing abuse | 14 days | Systems administration, customer support |
| IMAP and POP3 servers | Account, date, time and IP address of the connection | Checking for unauthorised access | 14 days | Systems administration, customer support |
| sooma.com website | Web server access data | Website security and operation | 14 days | Systems administration |
Once these periods have elapsed, logs are deleted or anonymised, unless they need to be kept for the investigation of a specific security incident or to comply with a lawful order from a competent authority concerning specific data.
4.4. Other
| Data | Retention |
|---|---|
| Marketing communications | Until consent is withdrawn |
| Job applications | See section 9 |
5. Sharing Data with Third Parties
Sooma does not sell, rent or trade personal data. Data may be shared with:
- Qualified certification authorities (Asseco, Multicert): for issuing eIDAS certificates, only the data strictly required
- Payment institutions: the data strictly necessary to process payments is shared with partner banking and para-banking institutions established in the European Union
- Public authorities: where required by law or by a valid court order issued by a competent authority under Portuguese or European law
Sooma's servers are installed in data centres located in Portugal, under a housing (colocation) arrangement. The facility provider supplies only space, power, cooling and physical security, and has no access to the equipment or to the data stored on it. Backups are kept, encrypted, in a data centre located in Berlin, Germany, within the European Union.
5.1. What We Do Not Do
For the avoidance of doubt, we expressly declare that Sooma does not:
- sell, rent or transfer personal data to third parties;
- analyse the content of communications for commercial or advertising purposes;
- create user profiles (profiling) from the data processed;
- make automated decisions with legal or similarly significant effects on data subjects;
- use data for behavioural advertising purposes, whether its own or that of third parties.
6. International Transfers
Personal data is processed and stored exclusively on servers in the European Union: in Portugal and, for backups, in Berlin, Germany. We do not transfer personal data to third countries. Sooma is not subject to extraterritorial access legislation of third countries (such as the US CLOUD Act).
7. Your Rights
Under the GDPR: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21) and withdrawal of consent at any time.
Portability in practice: the content of mailboxes, calendars and contacts can be exported at any time by the Client themselves, using the open protocols IMAP, CalDAV and CardDAV, in commonly used and machine-readable formats, without any prior request. For all other data, simply send a request to the Data Protection Officer.
To exercise your rights: dpo@sooma.com. We respond within a maximum of 30 days. You also have the right to lodge a complaint with the Portuguese data protection authority, CNPD (Comissão Nacional de Proteção de Dados,cnpd.pt).
8. Data Security
Sooma has implemented appropriate technical and organisational measures (Art. 32 GDPR), including:
- TLS 1.3 encryption in transit and AES-256 encryption at rest
- FIPS 140-2 Level 3 certified Hardware Security Modules (HSM) for certification operations (Registered Email)
- Role-based access control and access logging
- Regular backups and redundant infrastructure
- Continuous security monitoring
Sooma is in the process of implementing and certifying an ISMS in accordance with ISO/IEC 27001, and of aligning with the requirements of Directive (EU) 2022/2555 (NIS2).
In the event of a personal data breach likely to result in a risk to data subjects, Sooma will notify the CNPD within 72 hours (Art. 33 GDPR) and the affected data subjects where legally required (Art. 34).
9. Job Applications
- Personal data sent by candidates, whether unsolicited or in response to a job advertisement, is processed exclusively for the purposes of the recruitment process, on the basis of pre-contractual steps taken at the data subject's request.
- If an employment contract is concluded, the data is kept in accordance with the applicable employment legislation.
- If no contract is concluded, the data is deleted within 6 months of the decision being communicated, unless the candidate expressly consents to it being kept for future opportunities.
10. Related Documents
This Policy should be read together with the Terms and Conditions of Use, the Anti-Spam Policy and the Cookie Policy, available at sooma.com. In relations with business clients and public bodies, the Data Processing Agreement (DPA) annexed to the service contract also applies.
11. Changes to this Policy
This policy may be updated. The version in force is always available at sooma.com, stating the date of the last update. Material changes will be communicated to clients.