This notice explains the limited processing for which JD Media determines the purposes and means itself, including delivery, suppression lists, abuse prevention and protection of the sending infrastructure.
Version 0.6 · Last updated 22 September 2026
1. Controller
The controller for the own processing described below is:
JD Media GmbH
Nördliche Münchner Straße 9c, 82031 Grünwald, Germany
E-mail: datenschutz@jd-media.net
Telephone: +49 89 250039400
You can contact our external data protection officer by e-mail at datenschutzbeauftragter@er-secure.de.
As a rule, the company identified as the sender in the message is responsible for selecting the message and its content, the recipient list used and the decision to dispatch it. JD Media predominantly processes recipient data for that sender as a processor. This notice concerns the limited processing for which JD Media itself determines the purposes and means, in particular platform-wide suppression lists, abuse prevention, spam-trap analysis and protection of the sending infrastructure.
2. Sources and categories of data
We receive recipient data in particular
- from the respective sender who maintains them in JD Mail or uses them for a campaign booked via JD Partner,
- through your response to a message, in particular an unsubscribe request, objection, complaint, opening or link access,
- from receiving e-mail systems through delivery and error messages,
- from suppression, complaint and spam-trap reports by delivery service providers and the inspection bodies used for this purpose.
Depending on the process, the data include in particular the e-mail address, deterministic MD5 or SHA-256 values derived from it, domain, sender and advertising space, campaign and message identifiers, dispatch, delivery, opening, click, unsubscribe, complaint and error times, IP address and technical information about the accessing system as well as the reason and source of a suppression or abuse report. Hash values are not anonymous data and are protected in the same way as the underlying e-mail address.
3. Platform-wide suppression lists and objections
If you object to further advertising, withdraw consent, unsubscribe, or an address is identified as permanently undeliverable or as a spam trap, we may retain a platform-wide suppression record limited to what is necessary. It serves exclusively to prevent further unlawful or technically harmful dispatches; it is not used for advertising or to create an interest profile.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests and those of senders and recipients consist in permanently observing objections and withdrawals, preventing unwanted messages, protecting deliverability and preventing abuse. Where you object to direct marketing, the data concerned are no longer used for direct marketing.
4. Delivery, security and abuse prevention
For technical delivery, error analysis and protection of the sending infrastructure, we process delivery reports, complaints, unusual access patterns and reports from receiving systems. In particular, we identify permanently undeliverable addresses, unusual accumulations of complaints, automated access and spam traps. This information may result in an address being suppressed or a customer’s dispatch being restricted.
The legal basis is Art. 6(1)(f) GDPR. The legitimate interest consists in secure and trouble-free operation, preventing unlawful or abusive dispatches and protecting recipients and the reputation of our sending addresses.
5. Opening and click measurement
Where a message contains measurement functions, retrieval of a tracking pixel or link may result in the processing of the time, IP address, technical identifiers of the retrieving program, the address accessed and the associated message and campaign identifier. The respective sender provides information about the purpose, legal basis and scope of this measurement in its privacy notice. As a rule, JD Media processes these data on the sender’s behalf.
For our own purposes, we use measurement data only to the extent required to identify automated access, prevent abuse and technically safeguard billing. The legal basis is Art. 6(1)(f) GDPR; the legitimate interests are identifying manipulation, transparent billing between the companies involved and protecting the platform. An objection is decided by a human; the recipient is not subject to a solely automated decision producing legal or similarly significant effects.
6. Recipients of the data
| Recipient | Purpose |
|---|---|
| The sender identified in the message and its authorised users | Dispatch and handling of unsubscribe requests, objections, access requests and complaints |
| easyname GmbH and Nessus GmbH, Vienna, Austria | Housing of the systems and operation of the data centre and network |
| IONOS SE, Germany | Backup copies |
| Receiving e-mail and target systems | Delivery of the message initiated by the sender or access to a selected destination |
| Legal advice, courts, authorities, delivery and complaint bodies | where required to clarify a matter, defend legal claims or comply with a statutory obligation |
Where service providers process data on our behalf, the requirements of Art. 28 GDPR apply.
7. Transfers outside the EU and the EEA
Our own systems are located in Vienna, Austria; the agreed infrastructure and backup service providers process within the EU or the EEA. Where a sender initiates delivery to a receiving e-mail system or another destination outside that area, recipient data may be transferred to that destination. As a rule, the sender is responsible for selecting the recipient and for the lawfulness of this target transfer. Where we ourselves use a service involving third-country processing, this takes place only subject to the requirements of Art. 44 et seq. GDPR.
8. Storage period
Within our own responsibility, we store dispatch, delivery and measurement data only for as long as they are required for abuse prevention, technical error analysis, objections or the assertion and defence of claims. They are then deleted or restricted to the extent necessary for a continuing suppression purpose.
Suppression records relating to objections, withdrawals, complaints, permanently undeliverable addresses and spam traps may be stored for as long as renewed dispatch must be prevented. They are deleted when that purpose ceases to apply. Statutory retention and accountability obligations remain unaffected.
9. Your rights
Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing and data portability.
You may object to processing based on legitimate interests on grounds relating to your particular situation. Where data are processed for direct marketing, you may object at any time without stating reasons; the data will then no longer be used for direct marketing. To do so, use the unsubscribe link in the message, contact the sender identified there or write to datenschutz@jd-media.net.
You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
10. Changes to this notice
We update this notice if the processing described or the legal position changes. The version published on the recipient, unsubscribe or access page at the relevant time applies.
As of: 22.09.2026