Mailgun

Changes to retention commitments, data sharing permissions, data subject rights, and notice provisions; 6 changes reported.

• Account deletion retention: the policy previously committed to delete personal data within a maximum of 90 days after account deletion; now it ties retention to the duration of the business relationship without specifying a post-deletion timeline. (Table row "Administering, and entering into the contractual relationship", previously Section 7)
• Data sharing – partners for integrated services: the policy adds a new sharing category "Partners of integrated solutions and services" allowing transfer to third-party partners when a customer chooses to use integrated features. (Section 3)
• Permission for third-party data use with consent: the policy changed from "In no case do we sell, share or rent out your contacts to third parties" to "does not allow third parties to use your personal data for their own business interests, without explicit consent", thereby permitting such use if consent is obtained. (Section 3 introductory text)
• Email address validation retention: the policy introduces a new activity "Email address validation" with a retention period of 30 days for one-way encrypted email addresses derived from delivery events. (Section 2 table)
• Advance notice of changes: the previous policy stated "Any changes we make will take effect 30 days after the update date noted above."; the new policy removes that commitment, referring instead to a changelog. (Section 11 old, no equivalent in new)
• Right of choice before new purposes: the policy adds a new data subject right requiring Sinch to provide an opportunity to choose before using personal data for a materially distinct purpose from the original collection. (Rights section, bullet 8)

Further changes include new processing activities for opt-out administration, legally required reporting, tax calculation, threat protection, and updated contact details for privacy inquiries.