Effective date: November 25, 2022
Last updated: November 25, 2022
Introduction
Welcome to our products and services. We understand the importance of your personal information and highly value your trust. In compliance with legal and regulatory requirements, we implement appropriate security measures to keep your information secure and give you control over it. To this end, the Alibaba Mail service provider (or "we") has created this Alibaba Mail Privacy Policy ("this Policy"). This policy explains how we collect, use, share, store, and protect your personal information when you use our products and services. It also describes how you can manage your information to make informed choices.
Before you use our products and services, please read and understand this Policy. Pay close attention to the terms in bold or bold underline. Ensure you fully understand and agree to this Policy before you start using our services. We strive to explain the technical terms in this Policy in a simple and clear way. If you have any questions, comments, or suggestions about this Policy, contact us using the information at the end of this document.
This Privacy Policy will help you understand the following:
I. Scope
II. Information we collect and use
III. Partners, transfer, and public disclosure of personal information
IV. Your rights
V. Information storage
VI. Policy updates
VII. Protection of minors
VIII. Contact us
Appendix: Definitions
I. Scope
This Policy applies to all products and services that the Alibaba Mail service provider offers through clients, websites, and any new forms that emerge as technology develops. If we or our affiliated companies have a separate privacy policy for a specific product or service, that policy will apply instead.
This Policy does not apply to services provided by third parties other than the Alibaba Mail service provider. The collection and use of personal information by those third-party services are governed by their own privacy policies.
II. Information we collect and use
When you use our products or services, we need or may need to collect and use two types of your personal information:
1. To provide you with the basic features of our products and/or services, you must authorize us to collect and use necessary information. If you refuse to provide this information, you cannot use our products and/or services.
2. To provide you with additional features of our products and/or services, you can choose whether to agree to our collection and use of information. If you refuse, you cannot use the related additional features or achieve the features' intended functionality, but it will not affect your use of our basic features.
We want to remind you that we are committed to offering a variety of products and services to meet your needs. Because we offer many types of products and services, and different users choose to use different ones, the basic and additional features, along with the types and scope of personal information collected, will vary. Please refer to the specific product or service features for details.
We provide the following specific features and scenarios:
(I) Help you become our user and manage your account
1. Basic user service
We provide services based on your Alibaba Mail account. To create an Alibaba Mail account, you must provide us with your mobile phone number and create a mailbox address and password. If you refuse to provide this information, you cannot register an Alibaba Mail account and use our services.
2. Additional user service
After you register your account, you can set your nickname, profile picture, and email signature. Your nickname, profile picture, and email signature will be displayed to recipients when you send an email. Not providing this information does not affect your use of the basic features of Alibaba Mail.
Authorized logon: With your separate consent, we may provide your account information (profile picture, nickname, and other information prompted on the page) to a third party. This lets you easily register a third-party account or log on directly to the third-party service. In addition, with your separate consent, we may obtain your third-party account information from a third party and bind it to your Alibaba Mail account. This lets you log on directly to our products and/or services from the third party. We will use your information within the scope of your authorization.
(II) Provide you with email services
To provide you with email services, we collect and use your mailbox account and password information to add and log on to your mailbox account. We also collect contact information from your emails to create your email address book.
We also provide a feature to take photos and videos (video is supported on iOS only) and send them as email attachments. To use this feature, you must grant camera and microphone permissions (microphone is only for video recording). We also use the light sensor and accelerometer to enable features such as brightness adjustment and screen rotation.
To ensure you receive email push notifications and do not miss messages, our app may start automatically or trigger associated services to start.
(III) Customer service and dispute resolution
When you contact us or submit a request for pre-sales, after-sales, or dispute resolution services, we need you to provide necessary personal information to verify your identity to protect your account and system security.
To contact you, help you resolve issues quickly, or record the solutions and results, we may save records of our communications with you and related content. This includes account information, other information you provide to prove relevant facts, or your contact information.
To provide services and improve service quality, we may also use your other information. This includes information you provide when you contact customer service and your responses to our questionnaires.
(IV) Provide you with security protection
To fulfill our legal obligations for network security, we work to improve the security of services provided by us, our affiliated companies, and our partners. This helps protect you, other users, and the public from harm to personal and property safety by preventing risks such as phishing websites, fraud, network vulnerabilities, computer viruses, network attacks, and network intrusions. To more accurately identify violations of laws, regulations, or Alibaba Mail agreements and rules, we embed an application security software development kit (SDK) developed by our affiliated companies into our application. This SDK collects your device information and service log information. We may use or integrate your account information, device information, service log information, and information shared by our affiliated companies and partners with your authorization or as permitted by law. During this process, we may collect your MAC address, Android ID, SSID, BSSID, International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identity (IMSI), and other device IDs in the background for risk verification. This helps us assess your account and security risks, perform identity verification, detect and prevent security events, and take necessary recording, auditing, analysis, and disposal measures in accordance with the law.
(V) Other additional services we provide
1. Additional services based on system permissions
To provide you with more convenient and higher-quality products and/or services and to improve your experience, we may collect and use your personal information by enabling system permissions for the following additional services. If you do not agree to enable the relevant permissions, it will not affect your use of the basic services of Alibaba Mail. However, you may not be able to benefit from the user experience that these additional services provide.
You can decide to turn these permissions on or off at any time.
Note that when you enable any permission, you authorize us to collect and use the relevant personal information to provide you with the corresponding service. When you turn off any permission, you cancel your authorization. We will no longer collect and use the relevant personal information based on that permission and cannot continue to provide the service corresponding to that permission. Your decision to turn off a permission does not affect the information collection and use that occurred based on your previous authorization.
You can click here to view information about application permission requests and usage.
2. Services for Cookies and similar technologies
Cookies and similar device information identification technologies are common on the Internet. When you use our services, we may use these technologies to send one or more Cookies or anonymous identifiers to your device to collect, identify, and store information about your access and use of this product. We promise not to use Cookies for any purpose other than those described in this Privacy Policy. We use Cookies mainly to ensure the secure and efficient operation of our products and services. They help us confirm the security status of your account, troubleshoot crashes and delays, and reduce the need for you to repeatedly fill out forms and enter search content. Most browsers provide a feature to clear browser cached data. You can clear this data or modify your cookie settings to reject our Cookies. These changes may prevent you from using services or features that rely on Cookies.
III. Partners, transfer, and public disclosure of personal information
(I) Partners involved in data use
1. Basic principles
When we work with partners, we follow these principles:
1) Legality, legitimacy, and minimum necessity: Data processing must have a legal basis, a legitimate purpose, and be limited to the minimum scope necessary to achieve the purpose.
2) User's right to know and decide: We fully respect the user's right to know and decide about the processing of their personal information.
3) Security assurance: We take necessary measures to ensure the security of the personal information we process. We carefully evaluate the purposes for which our partners use data, assess their security capabilities, and require them to comply with our cooperation agreements.
2. Scope of partners
If specific features and scenarios involve services provided by our affiliated companies or third parties, our partners include our affiliated companies and third parties.
3. Delegated processing
We may delegate the processing of your personal information to authorized partners so they can provide certain services or perform functions on our behalf. We will only delegate the processing of your information for the legal, legitimate, necessary, specific, and explicit purposes stated in this Policy. Authorized partners can only access the information they need to perform their duties. We will require them through a formal agreement not to use this information for any other purpose beyond the scope of the delegation. If an authorized partner uses your information for a purpose we have not delegated, they will obtain your separate consent.
4. Joint processing
For scenarios involving joint processing of personal information, we will sign relevant agreements with our partners in accordance with legal provisions. These agreements will specify the rights and obligations of each party to ensure that the use of personal information complies with legal requirements and protects data security.
5. Cooperation scenarios
1) Security and statistical analysis
A. Ensuring security of use: We place great importance on the security of our products and/or services. To protect the legitimate rights and interests of Alibaba Mail users from illegal infringement, our partners may use necessary device, account, and log information.
B. Analyzing product status: To analyze the stability of Alibaba Mail products and/or services, partners who provide analysis services may need to use service status, device ID, and overall application installation and usage information.
C. Academic research: To enhance research capabilities in relevant fields and promote scientific and technological development, we may use de-identified or anonymized data with partners such as research institutes and universities, provided that data security and legitimate purposes are ensured.
2) Other cooperation scenarios
In addition to the scenarios above, we may also delegate the processing of information to other partners who support our business. This includes partners who provide technical infrastructure services, analyze how our services are used, provide merchant membership services, or offer other customer services.
To ensure the stable operation and functionality of our client and to allow you to use and enjoy more services and features, our application embeds SDKs or other similar applications from authorized partners. We conduct strict security checks on the application programming interfaces (APIs) and SDKs that our authorized partners use to obtain information. We also have strict data protection measures in place with our authorized partners, requiring them to process personal information in accordance with this Policy and any other relevant confidentiality and security measures. This does not apply if the authorized partner obtains your separate consent.
You can click here to view details about the SDKs we integrate.
(II) Transfer
If we need to transfer personal information due to a merger, division, dissolution, or declaration of bankruptcy, we will inform you of the recipient's name and contact information. The recipient will continue to fulfill this Policy and other legal obligations. If the recipient changes the original processing purpose or method, they will obtain your consent again.
(III) Public disclosure
We will only publicly disclose your personal information in the following situations:
1. We may publicly disclose your personal information based on your active choice and other separate consent.
2. If we determine that you have violated laws or regulations or seriously violated Alibaba Mail's agreements and rules, or to protect the personal and property safety of Alibaba Mail users or the public, we may disclose your personal information. This includes information about the violations and the measures Alibaba Mail has taken against you.
(IV) Stopping operations
If we stop operating our products and/or services, we will promptly stop collecting your personal information. We will notify you of the cessation of operations individually or by public announcement. We will delete or anonymize the personal information we hold that is related to the discontinued products and/or services.
(V) Cases where your authorization and consent are not required by law
Please note that in the following situations, according to laws, regulations, and national standards, our partners may use, or we may transfer or publicly disclose your personal information without your authorization and consent:
1. It is necessary to enter into or perform a contract at your request.
2. It is necessary to fulfill legal duties or obligations. We may share your personal information as required by laws and regulations, for litigation or dispute resolution, at the lawful request of administrative or judicial authorities, or as necessary to fulfill other legal obligations.
3. It is necessary to respond to a public health emergency or to protect the life, health, and property of a natural person in an emergency.
4. Personal information is processed within a reasonable scope for public interest activities such as news reporting and public opinion supervision.
5. Personal information that you have disclosed yourself or that has been legally disclosed from other sources (such as legal news reports and government information disclosures) is processed within a reasonable scope.
6. Other situations stipulated by laws and regulations.
IV. Your rights
You can access and manage your information in the following ways. We will respond to your requests in compliance with laws and regulations:
(I) Access, correct, and supplement
You have the right to access, correct, and supplement your information in the following ways:
1. Log on to the Alibaba Mail web version and click Settings > Account Settings.
2. Log on to the Alibaba Mail client, tap My > Settings, tap the mailbox account you want to set, and then tap Personal Settings.
(II) Copy
You can export your personal information by logging on to the Alibaba Mail client, tapping your profile picture, and going to Settings > Privacy Settings > Personal Information Access and Export.
(III) Delete
You can delete some of your information through the paths listed in "(I) Access, correct, and supplement your information" or request to close your account to delete all your information.
In the following situations, you can contact our customer service to request the deletion of your personal information:
1. If our processing of personal information is unlawful.
2. If we collect and use your personal information without your explicit consent.
3. If our processing of personal information seriously violates our agreement with you.
4. If the purpose of our processing has been achieved, cannot be achieved, or is no longer necessary.
5. If we stop providing products or services, or the retention period has expired.
If we decide to respond to your deletion request, we will also notify the entities that have received your personal information from us and request that they delete it promptly (unless otherwise required by law or if these entities have independently obtained your authorization).
After your information is deleted by you or at your request, we may not be able to immediately remove it from our backup systems due to legal and technical limitations. We will securely store your personal information and restrict any further processing of it until the backup can be purged or anonymized.
(IV) Change the scope of authorization
You can change or withdraw the scope of your authorization for us to collect and process your personal information in the following ways:
1. Manage the system permissions used by the app in My > Settings > Privacy Authorization Management.
2. If you cannot set the authorization yourself using the methods described above, you can contact customer service to request a change.
However, please note that for certain types of personal information—such as information necessary to provide the basic features of Alibaba Mail or information required for us to fulfill our legal and regulatory obligations—we may be unable to respond to your request to change the scope of your authorization. When you revoke your authorization, we will no longer process the corresponding personal information. However, your decision to revoke your authorization will not affect any personal information processing that was previously performed based on your authorization.
(V) Close account
1. Close a personal mailbox account
You can find instructions for closing your account in the Alibaba Mail client at My > Mailbox Account > Close Account. You can also follow the instructions in the Help Center (https://mailhelp.aliyun.com/freemail/detail.vm?knoId=1060213486) to close your account. After you close your account, we will stop providing you with products or services and will delete or anonymize your personal information as required by applicable law.
2. Close an enterprise mailbox account
If you want to close your enterprise mailbox account, contact your mailbox administrator.
(VI) Responding to your requests
For the above requests from you, your guardian, close relatives, or other authorized parties, and for your other personal information rights under the laws of the People's Republic of China and other applicable laws, you can contact us through customer service or file a complaint directly with our dedicated personal information protection department. We will respond within 15 days.
To protect your account and personal information, when you make the above requests, we may first verify your identity (such as by adding account verification, requiring you to provide a written request, or other reasonable means) before processing your request.
We generally do not charge a fee for your reasonable requests. However, for repeated requests that exceed a reasonable limit, we will charge a certain fee as appropriate. We may refuse requests that are not directly related to your identity, are unreasonably repetitive, require excessive technical means (such as developing a new system or fundamentally changing current practices), pose a risk to the legitimate rights and interests of others, or are impractical.
V. Information storage
(I) Retention period
We will only retain your personal information for the period necessary to achieve the purposes described in this Policy, unless there is a mandatory retention requirement by law. For example, the Cybersecurity Law requires network operators to retain relevant network logs for at least six months.
We determine the storage period for personal information based on the following criteria:
1. To maintain business records related to you to respond to your possible inquiries or complaints.
2. To ensure the security and quality of the services we provide to you.
3. Whether you agree to a longer retention period.
4. To comply with statute of limitations requirements.
5. Whether there are other special agreements or legal regulations regarding the retention period.
After the retention period, we will delete or anonymize your personal information as required by applicable law.
(II) Storage location
The personal information we collect and generate during our operations in the People's Republic of China will be stored within the territory of China. We will not provide any of your personal information to overseas entities unless we obtain your separate consent, need to fulfill a contract with you, or are required to comply with legal obligations.
(III) Storage security
1. Technical data protection measures
We have taken reasonable and feasible security measures that comply with industry standards to protect your information and prevent unauthorized access, public disclosure, use, modification, damage, or loss of personal information. For example, we use encryption technology to enhance the security of personal information. Data exchanged between your browser and our servers is protected by SSL protocol encryption. We provide secure browsing through the HTTPS protocol. We use trusted protection mechanisms to prevent malicious attacks on personal information. We deploy access control mechanisms to ensure that only authorized personnel can access personal information. Our important information systems have passed the Level 3 or higher assessment for Classified Protection of Cybersecurity.
2. Organizational data protection measures
We have established an advanced, data-centric security management system that covers the entire data lifecycle. We enhance the security of personal information through organizational structure, system design, personnel management, and product technology. We have set up a dedicated department for personal information protection. We continuously strengthen our employees' awareness of the importance of protecting personal information through training courses and examinations.
3. Response to personal information security incidents
If our physical, technical, or administrative protection facilities are damaged, leading to unauthorized access, public disclosure, tampering, or destruction of information that harms your legitimate rights and interests, we will promptly activate our emergency plan and take reasonable and necessary measures to minimize the impact on you. In the event of a personal information security incident, we will inform you of the basic situation and possible impact of the incident, the measures we have taken or will take, suggestions for you to prevent and reduce risks, and any remedial measures available to you, as required by law. We will inform you through text messages, phone calls, push notifications, and other reasonable channels. If it is difficult to inform everyone individually, we will issue a public announcement in a reasonable and effective manner. At the same time, we will report the handling of the personal information security incident to the regulatory authorities as required.
4. Prevention of account security risks
You should protect your personal information and only provide it to others when necessary. This helps prevent theft of your information and protects you from telecommunication and network fraud. If you are concerned that your personal information, especially your account or password, has been leaked, contact our customer service immediately so we can take appropriate measures based on your request.
VI. Policy updates
To provide you with a better product and service experience, we continuously work to improve our products, services, and technology. When new services and business processes change, we may update our Privacy Policy to inform you of the specific changes. However, we will not limit your rights under this Policy without your explicit consent. We will post any changes to this Policy on a dedicated page. For major changes, we will provide a more prominent notice (including notifications via a red dot or a pop-up window).
Major changes referred to in this Policy include but are not limited to:
1. A major change in the product's business model, such as the purpose of processing personal information, the type of personal information processed, and the way personal information is used.
2. A change in the entity responsible for the Privacy Policy due to business adjustments or mergers and acquisitions, where the new entity changes the original processing purpose or method.
3. A change in the main recipients of shared or publicly disclosed personal information.
4. A major change in the rights of users regarding their personal information and how they can exercise those rights.
5. A change in the contact information of the person responsible for personal information protection and the complaint channels.
6. A personal information protection impact assessment report indicates that the product has a significant impact on personal rights and interests.
We will also archive old versions of this Policy on a dedicated page for your review.
VII. Protection of minors
Our services are primarily intended for adults. If you are a minor, we require that you ask your parents or other guardians to read this Policy carefully and use our services or provide us with information only with their consent.
If you are a child under the age of 14, you and your guardian should read this Policy carefully before using our services. You may only use our services under the guidance of your guardian after they have consented to this Policy, to ensure your safety while using our services.
If you are a parent or other guardian of a child, please ensure that the child is using our services only with your authorization and consent. If you have questions about a child's personal information, contact our dedicated personal information protection department.
VIII. Contact us
You can contact us in the following ways. We will respond to your request within 15 days:
1. If you have any questions, comments, or suggestions about this Policy, you can contact us through Alibaba Cloud's ticket system, suggestion submission platform (https://connect.aliyun.com/), the client's My > Help and Feedback, or by calling our customer service at 4008013260.
2. We have also established a dedicated personal information protection department. You can contact them at pipwg@service.alibaba.com (please mention that your inquiry is related to Alibaba Mail and provide specific details). The office address is: Legal Service Desk, 1st Floor, Building 4, No. 969 West Wenyi Road, Yuhang District, Hangzhou. Note that we may not respond to questions unrelated to this Policy or your personal information rights.
If you are not satisfied with our response, especially if you believe that our processing of your personal information has harmed your legitimate rights and interests, you can also seek a solution by filing a lawsuit with a court that has jurisdiction in the defendant's place of residence.
Appendix: Definitions
Alibaba Mail: Refers to the Alibaba Mail web version (domain names: https://mail.aliyun.com/ or https://qiye.aliyun.com/) and the Alibaba Mail client.
Alibaba Mail service provider: Refers to Alibaba Cloud Computing Co., Ltd., the provider of Internet information and software technology services for Alibaba Mail.
Affiliated Companies: Refers to the affiliated companies of the Alibaba Mail service provider as disclosed in the latest annual report of Alibaba Group Holding Limited.
Personal information: Any kind of information related to an identified or identifiable natural person that is recorded electronically or otherwise, excluding anonymized information.
Sensitive personal information: Personal information that, if leaked or used illegally, could easily lead to the violation of a natural person's dignity or harm to their personal or property safety. This includes biometric data, religious beliefs, specific identities, medical and health information, financial accounts, and location tracking information, along with the personal information of minors under the age of 14.
Children: Refers to minors under the age of 14.
Device information: Includes device IDs (IMEI, identifier for advertisers (IDFA), Android ID, MAC address, Open Anonymous Device Identifier (OAID), IMSI, and other device-related information), application information (application crash information, notification switch status, application installation list, and other application-related information), device parameters and system info (device type, device model, operating system, and hardware-related information), and device network environment context (IP address, SSID, BSSID, Wi-Fi information, base station information, and other network-related information).
Sensors: Gyroscope, gravity sensor, accelerometer, ambient sensor, and optical heart rate sensor. The actual data collected is subject to the specific product.
Service log information: Includes mailbox logon records, email sending and receiving records, calendar event sending and receiving records, search query records, IP address, type of the browser, ISP, language used, and access date and time.
De-identification: The process of processing personal information so that it cannot be used to identify a specific natural person without the use of additional information.
Anonymization: The process of processing personal information so that it cannot be used to identify a specific natural person and cannot be restored.