GDPR Statement

Last updated: 25 March 2026

Email Migration Hub is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This statement provides a clear overview of how we handle your data.

1. Who We Are

Email Migration Hub is the data controller responsible for your personal data.

Business name: Email Migration Hub
Business type: Sole trader, registered in the United Kingdom
Website: emailmigrationhub.com
Contact email: support@emailmigrationhub.com

As a sole trader processing personal data in the course of providing our services, we are registered with the Information Commissioner's Office (ICO) as required.

2. Legal Basis for Processing

We process your personal data under the following legal bases defined in Article 6 of the UK GDPR:

Performance of a contract (Article 6(1)(b)): We process your data because it is necessary to provide the services you have requested, such as migrating your emails, transferring your files, or delivering files to your recipients.
Legitimate interests (Article 6(1)(f)): We process technical data such as IP addresses and server logs to maintain the security and integrity of our systems and to detect abuse.
Legal obligation (Article 6(1)(c)): We retain transaction records as required by UK tax and accounting regulations.

3. What We Process and Why

Data	Purpose	Retention
Name and email address	Account creation and service delivery	Until account deletion
OAuth tokens (Google, Dropbox, OneDrive)	Authenticate cloud service access during transfers	30–60 minutes (auto-deleted from Redis)
IMAP/Exchange credentials	Authenticate email migration	Not stored — used in memory only, then discarded
Uploaded files (Send service)	Deliver files to recipients	7–30 days, then permanently deleted
IP address and browser data	Security, abuse prevention	30 days
PayPal transaction details	Payment processing and accounting	Up to 7 years (legal requirement)

Important: Cloud-to-cloud file transfers are streamed through our server and no file data is stored on disk. Email migration data passes through our server during the transfer and is not retained.

4. Data Processors and Third Parties

We share personal data only where necessary to provide our services:

PayPal: Processes payments on our behalf. PayPal acts as an independent data controller for payment data. See PayPal's Privacy Policy.
Hosting provider: Our server infrastructure is hosted in a secure data centre. The provider manages physical infrastructure only.

We do not use third-party analytics, advertising networks, or tracking services. We do not sell or share your data with any other parties.

5. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

HTTPS/TLS encryption for all connections.
Automatic expiry and deletion of temporary data (OAuth tokens, uploaded files).
Virus scanning of all uploads using ClamAV.
Restricted server access limited to authorised personnel.
Credentials never stored on disk or in logs.

6. Your Rights

Under the UK GDPR, you have the right to:

Access your personal data — request a copy of what we hold about you.
Rectify your data — ask us to correct anything inaccurate.
Erase your data — ask us to delete your personal data ("right to be forgotten").
Restrict processing — ask us to limit how we use your data.
Data portability — receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests.

To exercise any of these rights, email us at support@emailmigrationhub.com. We will respond within one month as required by law. In certain circumstances, we may extend this period by a further two months, in which case we will inform you and explain the reason.

7. Complaints

We take your privacy seriously. If you have concerns about how we handle your data, please contact us first at support@emailmigrationhub.com and we will do our best to resolve the matter.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

8. Changes to This Statement

We may update this GDPR Statement from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this page periodically.