Protecting your personal data
0rd Mail Archive is the email archiving service of Ordinal B.V. This page explains how we process your personal data.
When you create an account and use our Service, we process personal data. We aim to collect and process as little as possible, but some data is necessary to provide the Service (archive, sync, search), secure your account, process payments, and provide support.
An overview of parties that process personal data on our behalf (processors / gegevensverwerkers) is maintained in Dutch only in our Help Center: https://chat.0rd.eu/hc/0rd-eu-archive/nl/articles/gegevensverwerkers (Same referral approach as our Terms: Dutch on the website, English here; the processors table itself stays Dutch on HC.)
Privacy principles
- You are in control — access, correction, and deletion where possible via account/support.
- Plain language — no unnecessary jargon.
- No more data than needed — only what the Service requires.
- Minimal logging — logs only as long as needed for security, debugging, and operations.
- Personal data is not for profit — we earn from the paid archive service (Budget), not from selling data.
- Purpose limitation — processing limited to the purposes explained here.
- We play fair — no sneaky ad tracking or sale of your data.
Changes to this privacy statement
We may change this privacy statement. We publish updates on https://0rd.eu/privacy (Dutch primary) and update this Help Center English version accordingly. If we substantially change processing purposes that rely on your consent, we will ask for consent again for those new purposes.
We show Last updated below. There is no separate history page.
1. Who processes your personal data?
The controller is:
Ordinal B.V.
Keizersgracht 520 H
1017 EK Amsterdam
The Netherlands
- Chamber of Commerce (KvK): 78198488
- VAT (BTW): NL861299486B01
- Contact / privacy requests: contact@ordinal.nl
Phone and bank details are published where Dutch law requires them on the website / ordinal.nl; they are omitted from this privacy statement.
Ordinal has not appointed a Data Protection Officer (DPO / FG). Privacy and GDPR rights requests go to contact@ordinal.nl.
2. What personal data do we process?
Account and communication
- Your email address (account and communication).
- First name, last name, organisation, and billing address (required; among other things under Dutch law).
- Data you put in your account or support requests.
- Authentication data: hashed account password; optional 2FA (authenticator / passkey).
Archive content
- Email content and attachments (and related metadata) you connect for archiving, so you can search and retain them.
- IMAP credentials:
- For ownership verification only, we do not keep the IMAP password.
- For ongoing synchronisation (connected mailboxes), we store IMAP credentials encrypted in the archive vault — not in plaintext. Technically: AES-GCM encryption (not hashing — sync must be able to decrypt).
- Age framing: you act with permission of the rightful owner of the banking information used to pay.
Payment and invoicing
- Data needed for payment and invoicing via the methods offered (including iDEAL, SEPA, Bancontact, credit cards, and PayPal — see Terms).
- Payment-specific data is stored with the payment service provider (PSP) only; other account/billing data with 0rd.eu.
- Ordinal does not publish its own IBAN in the Terms; payments run through the offered methods.
Support
- If you request support (via the Account or, if login is unavailable, by email), your question and correspondence are recorded in a ticket.
- Tickets without your feedback auto-close after 72 hours; closed tickets are not deleted (retained indefinitely / “forever”, matching the Terms).
Technical / website
- Technical logs (access, errors, security/audit) — see §5.
- Session and authentication data for logged-in access.
- Anonymous website statistics — see §9 (no IP addresses).
What we do not do
- We do not sell your personal data.
- We do not use third-party advertising tracking cookies or pixels.
3. Why do we process personal data?
Legal basis for the service purposes below: performance of the contract (GDPR art. 6(1)(b)), unless otherwise stated.
Service delivery (contract)
- Providing 0rd Mail Archive (sync, storage, search, account management).
- Invoicing and handling Budget payments/top-ups.
- Transactional communication about the Service.
- Company news about Ordinal / 0rd (no separate marketing newsletter beyond company news).
Security and systems
- Securing accounts and systems (authentication, abuse detection, logging).
- Technical operation, debugging, and performance improvement.
Support
- Answering support requests you submit.
Legal obligations
- Where the law requires — including retaining administrative/fiscal records (at least 7 years for invoices under Dutch law).
- If competent authorities require disclosure under a lawful order, we assess the request and cooperate as legally required (see also Terms).
4. We work with other parties
We use services of other parties. Where a party processes personal data on our behalf, we enter into a processor agreement where required. They may process the data only for our purposes.
The current processors overview is maintained in Dutch only in the Help Center: https://chat.0rd.eu/hc/0rd-eu-archive/nl/articles/gegevensverwerkers
Some parties (for example a payment provider for the payment transaction itself) may be independent controllers for (parts of) the processing.
We do not engage parties to trade your data for advertising profiling.
5. How long and where do we keep your data?
We do not keep data longer than needed for the purposes above, or as long as a legal retention duty applies.
Archive and account (Budget model)
Under our Terms, among other things:
- While your Account is active and Budget allows, we keep archived data so you can use the Service.
- After Budget exhaustion: features stop (including export); the Account generally remains for 30 days without working functionality.
- Archived data is deleted ninety (90) days after Budget exhaustion.
- The Account itself is deleted one (1) year after Budget exhaustion.
Invoices / administration
- Invoices and administrative records are kept for at least seven (7) years, as required by Dutch law.
Logs
For technical debugging, security, and performance improvement we keep technical logs. That includes:
- access and application logs (for example HTTP requests: time, path/URL, status, and where applicable an IP or peer address);
- security and audit logs of relevant account events (such as login, failed attempts, and important archive, payment, or account actions), including time, event type, and where needed IP address or user-agent;
- operational archive logs around sync and export jobs (status, errors; short progress lines).
We do not use these logs for advertising profiling. We keep logs only as long as needed for debugging, security, performance, and operational necessity, and discard them afterwards. We do not publish fixed day-count retention periods for these logs.
Website visit statistics: see §9.
Support tickets
- Indefinitely (not deleted).
Location
- Ordinal stores and processes personal data in the European Union / European Economic Area (EU/EEA).
- For processors, the locations listed in the Dutch processors overview in the Help Center apply: https://chat.0rd.eu/hc/0rd-eu-archive/nl/articles/gegevensverwerkers.
6. Security of your data
Ordinal takes appropriate technical and organisational measures to protect personal data against loss or unlawful processing.
- Traffic to the Service uses HTTPS. Connections to source mailboxes via IMAP use TLS/SSL.
- Account passwords are hashed with bcrypt (not stored in readable form). You can enable two-factor authentication (authenticator app and/or passkey).
- IMAP credentials for ongoing synchronisation are stored encrypted in the archive vault (AES-GCM), not in plaintext. For ownership verification only, we do not keep the IMAP password.
- Archived messages (EML) are stored encrypted at rest in object storage.
- Support access to your account or archive requires your explicit, time-limited consent.
- Staff access is limited to what is needed for their role (need-to-know). Staff who work with personal data are bound by confidentiality (NDA).
- Production personal data is stored and processed in the EU/EEA.
7. Your rights
Under the GDPR you have, among others, the right to:
- Access the personal data we process about you;
- Rectification of inaccurate data;
- Erasure, where applicable and not conflicting with a retention duty or processing necessary for the Service;
- Restriction of processing in the cases the law provides;
- Portability of data you provided to us, where the GDPR grants that right;
- Object to processing based on legitimate interest, where applicable;
- Withdraw consent, if processing is based on consent.
To exercise these rights: email contact@ordinal.nl or use your Account where the product allows. We may ask for additional information to verify your identity.
Complaint
If you have a complaint about how we handle your data, contact us first at contact@ordinal.nl.
8. Profiling and automated decision-making
We do not do that. We do not take decisions with legal or similarly significant effects based solely on automated processing, and we do not profile you.
9. Cookies and measurement tools
Necessary cookies / storage
We use cookies or similar techniques required for the website and Service to work (for example session/login, security, preferences such as display mode).
Statistics (local, anonymous)
On https://0rd.eu we measure visits in a local, GDPR-aligned way via stats.0rd.eu: anonymous page/view metrics. We do not record IP addresses. There is no cookie consent banner for this anonymous measurement.
We do not use third-party advertising tracking cookies or pixels.
Contact
Privacy questions: contact@ordinal.nl
General questions: contact@ordinal.nl Support preferably via your Account (see Terms).
Processors (Dutch): https://chat.0rd.eu/hc/0rd-eu-archive/nl/articles/gegevensverwerkers
Last updated: 28 September 2026