GDPR and Your Right to Digital Privacy

What is GDPR?

GDPR (General Data Protection Regulation) is the EU's data protection regulation that came into effect on May 25, 2018. The regulation is one of the world's most comprehensive privacy laws and gives citizens within the EU and EEA powerful rights regarding how their personal data is collected, processed, and stored.

GDPR applies to all organizations that handle personal data from EU citizens, regardless of where the company is based. This means that an American company with European customers must follow the same rules as a Swedish company. Violations of GDPR can result in fines of up to 20 million euros or 4% of global annual revenue, whichever is higher. This legislation is particularly relevant when discussing email and digital privacy.

Your rights under GDPR

GDPR gives you as a private individual a number of concrete rights that companies are obligated to respect. Knowing these rights is the first step toward taking control of your digital privacy.

Right of access: You have the right to request a copy of all personal data a company stores about you.
Right to erasure: Also called the "right to be forgotten" – you can request that your data be permanently deleted.
Right to data portability: You can request to receive your data in a machine-readable format to transfer it to another service.
Right to object: You can object to your data being used for direct marketing.
Right to restriction: You can request that the processing of your data be restricted for a certain period.
Right to information: Companies must inform you about how your data is used before it is collected.

These rights are not just theoretical. You can actively exercise them by contacting companies directly, which we cover further down in the article.

How companies collect your data via email

Your email address is one of the most valuable pieces of personal data for companies. When you sign up for a service with your real email, you increase more than just your inbox. Many companies use tracking pixels in their newsletters, small invisible images that report back when you open a message, what device you're using, and where you are located.

Your email address is often sold or shared with third-party companies for targeted advertising. Data brokers collect email addresses from various sources and build detailed profiles that include purchasing habits, interests, and demographic information. A single email address can spread to dozens of companies within a few months, leading to an avalanche of spam and unwanted mailings.

Data minimization – a core principle of GDPR

One of GDPR's most central principles is data minimization, found in Article 5.1(c). The principle means that organizations may only collect personal data that is strictly necessary for the stated purpose. If you sign up to read an article on a website, your email address, full name, and phone number are not really needed.

The free inbox is active for 10 minutes. It then stops receiving messages and keeps existing email for another 10 minutes so you can extend the same inbox. Extending resets the session to 10 minutes and moves its deletion deadline. Without an extension, the free inbox, messages and address-related technical data are removed by server cleanup, normally within one minute after the deadline. Starting Stripe Checkout reserves existing messages for 30 minutes; the server checks payment before deletion. Account and Premium-linked inboxes are excluded from free cleanup. Premium sessions last 60 minutes.

Temporary email and data minimization

The service processes temporary addresses, incoming messages and technical information, including IP addresses. Your browser stores an access token and your address to reopen the inbox. Disposable email hides your regular address from the recipient; it does not make you anonymous online. See the privacy policy for details.

GDPR provides rights including access, correction and erasure. Rights have conditions and exceptions; deletion is not unconditional. Organizations need a valid legal basis for processing, but that basis is not always consent. See the data protection authority’s guidance for your situation. IMY.

How to exercise your GDPR rights

Knowing your rights is one thing, but actually exercising them is another. Here are practical steps you can take to regain control over your data:

The service processes temporary addresses, incoming messages and technical information, including IP addresses. Your browser stores an access token and your address to reopen the inbox. Disposable email hides your regular address from the recipient; it does not make you anonymous online. See the privacy policy for details.
Request deletion: Contact companies you no longer use and ask them to delete your account and all associated data.
Unsubscribe from newsletters: Use the "unsubscribe" link in every unwanted newsletter. Under GDPR, this option must be available.
Use temporary email in the future: For new registrations where you don't need permanent contact, use Temp-Mail.se to avoid future data collection.
Report violators: If a company refuses to cooperate, you can file a complaint with the data protection authority in your country.

Temp-Mail.se and GDPR compliance

Our privacy policy is transparent and easy to read, and our service is operated by GIT Webb & App Studio AB, a Swedish company subject to Swedish law and EU data protection regulations. We believe that privacy services should practice what they preach. Do you have questions about how we handle data? Visit our FAQ page or read our guide on online privacy.