MEGA Privacy Policy - MEGA changes — 20240301_rev01

42

### **Account Data**

43

44

8. This is the section of this Policy that covers account information you give us, and metadata and records of financial transactions that we generate in relation to Your Files, Your Chats and your account. The following specific terms apply:

45

1. When you sign up for particular services you will need to give us the details required in our registration form and will need to keep that information up to date, including any payment account details (e.g. online payment provider account information).

46

2. You do not need to give us any information other than an email address to use a free MEGA account, but the volume of Your Files that you can store and some other functionality is limited with such accounts. Where you wish to access greater storage and other functionality under a paid plan, you will need to give us (including our [related or affiliated entities](https://mega.io/contact), payment processors and [resellers](https://mega.io/resellers)) the information that is required under the particular plan and our [Terms](https://mega.io/terms) in relation to those services (such as tax identification and payment information). For paid plans MEGA and any of its [related or affiliated entities](https://mega.io/contact), payment processors and [resellers](https://mega.io/resellers) that you use to make payments, retain account and payment information including a record of all transactions on your account.

47

3. When you use our services, our systems retain the following metadata in unencrypted form:

48

1. Browser type and operating system of the devices from which you have logged in to MEGA;

49

2. IP address and port information for logins, API usage, file uploads, chats, folder and album creations and link exports;

50

3. The country that we expect you are accessing our services from (inferred by matching your IP address to a public IP address database);

51

4. File sizes, versioning order, timestamps and parent-child file relationships;

52

5. File deletion timestamps;

53

6. The email address of anyone you have specifically made a contact using MEGA's systems. Note that Your Files, including your folders and albums, can be shared privately by invitation to specified MEGA accounts identified by email addresses or shared more generally by creating and sharing a file, folder or album link and decryption key;

54

7. Contact email addresses of chat participants, chat commencement time, chat duration and moderation activity;

55

8. Takedowns and account suspensions;

56

9. Our communications with you; and

57

10. Your account settings, including any avatar picture.

48

1. A unique device ID for the device used to log in to MEGA (that doesn't include the serial number, brand or model of your device);

49

2. Browser type and operating system of the devices from which you have logged in to MEGA;

50

3. IP address and port information for logins, API usage, file uploads, chats, folder and album creations and link exports;

51

4. The country that we expect you are accessing our services from (inferred by matching your IP address to a public IP address database);

52

5. File sizes, versioning order, timestamps and parent-child file relationships;

53

6. File deletion timestamps;

54

7. The email address of anyone you have specifically made a contact using MEGA's systems. Note that Your Files, including your folders and albums, can be shared privately by invitation to specified MEGA accounts identified by email addresses or shared more generally by creating and sharing a file, folder or album link and decryption key;

55

8. Contact email addresses of chat participants, chat commencement time, chat duration and moderation activity;

56

9. Takedowns and account suspensions;

57

10. Our communications with you; and

58

11. Your account settings, including any avatar picture.

58

59

4. From time to time we may need to communicate with each other directly. We will use MEGA's chat facility, internal messaging system or the email or SMS address you have included in the settings information in your account and may also give notices to you and other users via popups or other notices prominently displayed on our website. Any communication to you will be deemed to be received by you in accordance with the electronic communication provisions of the [New Zealand Contract and Commercial Law Act 2017](https://www.legislation.govt.nz/act/public/2017/0005/21.0/DLM6844033.html), no matter whether you are actively monitoring the account or its email address or not. You can communicate with us using the appropriate address on our [contacts page](https://mega.io/contact) and your email will be deemed to be received by us. Examples of direct communications include copyright or other enforcement emails, notifications under our [Takedown Guidance Policy](https://mega.io/takedown), system update information, data breach notifications, notification of major changes to our [Terms](https://mega.io/terms), any Policy and billing information.

59

60

5. Access to your account is by way of nominated email address and password. It is your responsibility to keep these safe and secure as MEGA stores the email address but does not store the password. **If you forget your password you will lose access to all your data unless you have exported and retained a Recovery Key**.

60

61

6. We will collect, store, use and otherwise process Account Data so that we can provide the services you have contracted to obtain from us under our [Terms](https://mega.io/terms). We also have a legitimate interest in processing Account Data so that we can maintain and improve our systems and services and communicate with you as referenced in this Policy.

61

62

7. We retain Account Data as long as your account is active. After account suspension or termination, including where the administrator of a Business Account, within which you have used the services, terminates that Business Account (see clause [13]() below), we may, but are not obliged to, retain all Account Data if enforcement action is likely or commenced under our [Terms](https://mega.io/terms), our [Cookie Policy](https://mega.io/cookie), or [Takedown Guidance Policy](https://mega.io/takedown) or for 12 months, whichever is longer, or in the case of records of financial transactions relating to your account for such period of time as we are legally required to retain such information. Users sometimes request that an account be re-activated so we keep Account Data for 12 months for that purpose. Where there is no enforcement action likely or commenced and the 12 month period has expired, or after such longer period as is applicable in the case of records of financial transactions relating to your account that we are legally required to retain, Account Data that identifies you will be anonymised, and we will never re-identify that data, but where you are a contact of, have had a folder or album shared with you by, or have chatted with, another MEGA user, those details will continue to be retained to allow services to continue for those other users.

62

63

8. You can download your Account Data at [https://mega.nz/fm/account/security](https://mega.nz/fm/account/security) while you are logged into your account. This will provide your Account Data but not Your Files or Your Chats. You can request correction of Account Data if it is considered incorrect, in accordance with the [New Zealand Privacy Act 2020](https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.html) and the GDPR. Any requests for access to, or correction of, Account Data that is not available to you when you are logged into your account, or if you cannot log in to your account, should be made to [privacy@mega.nz](mailto:privacy@mega.nz) specifying the information in question. The information will be provided promptly, and at least within one month, without charge unless the request is manifestly unfounded or excessive. Corrections will be promptly considered and actioned if appropriate.

63

64

9. If We have disclosed your Account Data to any third party (such as a compliance authority), we will inform them of any correction where possible and will also inform you about the third parties to whom the data has been disclosed where lawful and appropriate.

 ### **Account Data**
 . This is the section of this Policy that covers account information you give us, and metadata and records of financial transactions that we generate in relation to Your Files, Your Chats and your account. The following specific terms apply:
 . When you sign up for particular services you will need to give us the details required in our registration form and will need to keep that information up to date, including any payment account details (e.g. online payment provider account information).
 . You do not need to give us any information other than an email address to use a free MEGA account, but the volume of Your Files that you can store and some other functionality is limited with such accounts. Where you wish to access greater storage and other functionality under a paid plan, you will need to give us (including our [related or affiliated entities](https://mega.io/contact), payment processors and [resellers](https://mega.io/resellers)) the information that is required under the particular plan and our [Terms](https://mega.io/terms) in relation to those services (such as tax identification and payment information). For paid plans MEGA and any of its [related or affiliated entities](https://mega.io/contact), payment processors and [resellers](https://mega.io/resellers) that you use to make payments, retain account and payment information including a record of all transactions on your account.
 . When you use our services, our systems retain the following metadata in unencrypted form:
+. Browser type and operating system of the devices from which you have logged in to MEGA;
+. IP address and port information for logins, API usage, file uploads, chats, folder and album creations and link exports;
+. The country that we expect you are accessing our services from (inferred by matching your IP address to a public IP address database);
+. File sizes, versioning order, timestamps and parent-child file relationships;
+. File deletion timestamps;
+. The email address of anyone you have specifically made a contact using MEGA's systems. Note that Your Files, including your folders and albums, can be shared privately by invitation to specified MEGA accounts identified by email addresses or shared more generally by creating and sharing a file, folder or album link and decryption key;
+. Contact email addresses of chat participants, chat commencement time, chat duration and moderation activity;
+. Takedowns and account suspensions;
+. Our communications with you; and
+. Your account settings, including any avatar picture.
+. A unique device ID for the device used to log in to MEGA (that doesn't include the serial number, brand or model of your device);
+. Browser type and operating system of the devices from which you have logged in to MEGA;
+. IP address and port information for logins, API usage, file uploads, chats, folder and album creations and link exports;
+. The country that we expect you are accessing our services from (inferred by matching your IP address to a public IP address database);
+. File sizes, versioning order, timestamps and parent-child file relationships;
+. File deletion timestamps;
+. The email address of anyone you have specifically made a contact using MEGA's systems. Note that Your Files, including your folders and albums, can be shared privately by invitation to specified MEGA accounts identified by email addresses or shared more generally by creating and sharing a file, folder or album link and decryption key;
+. Contact email addresses of chat participants, chat commencement time, chat duration and moderation activity;
+. Takedowns and account suspensions;
+. Our communications with you; and
+. Your account settings, including any avatar picture.
 . From time to time we may need to communicate with each other directly. We will use MEGA's chat facility, internal messaging system or the email or SMS address you have included in the settings information in your account and may also give notices to you and other users via popups or other notices prominently displayed on our website. Any communication to you will be deemed to be received by you in accordance with the electronic communication provisions of the [New Zealand Contract and Commercial Law Act 2017](https://www.legislation.govt.nz/act/public/2017/0005/21.0/DLM6844033.html), no matter whether you are actively monitoring the account or its email address or not. You can communicate with us using the appropriate address on our [contacts page](https://mega.io/contact) and your email will be deemed to be received by us. Examples of direct communications include copyright or other enforcement emails, notifications under our [Takedown Guidance Policy](https://mega.io/takedown), system update information, data breach notifications, notification of major changes to our [Terms](https://mega.io/terms), any Policy and billing information.
 . Access to your account is by way of nominated email address and password. It is your responsibility to keep these safe and secure as MEGA stores the email address but does not store the password. **If you forget your password you will lose access to all your data unless you have exported and retained a Recovery Key**.
 . We will collect, store, use and otherwise process Account Data so that we can provide the services you have contracted to obtain from us under our [Terms](https://mega.io/terms). We also have a legitimate interest in processing Account Data so that we can maintain and improve our systems and services and communicate with you as referenced in this Policy.
 . We retain Account Data as long as your account is active. After account suspension or termination, including where the administrator of a Business Account, within which you have used the services, terminates that Business Account (see clause [13]() below), we may, but are not obliged to, retain all Account Data if enforcement action is likely or commenced under our [Terms](https://mega.io/terms), our [Cookie Policy](https://mega.io/cookie), or [Takedown Guidance Policy](https://mega.io/takedown) or for 12 months, whichever is longer, or in the case of records of financial transactions relating to your account for such period of time as we are legally required to retain such information. Users sometimes request that an account be re-activated so we keep Account Data for 12 months for that purpose. Where there is no enforcement action likely or commenced and the 12 month period has expired, or after such longer period as is applicable in the case of records of financial transactions relating to your account that we are legally required to retain, Account Data that identifies you will be anonymised, and we will never re-identify that data, but where you are a contact of, have had a folder or album shared with you by, or have chatted with, another MEGA user, those details will continue to be retained to allow services to continue for those other users.
 . You can download your Account Data at [https://mega.nz/fm/account/security](https://mega.nz/fm/account/security) while you are logged into your account. This will provide your Account Data but not Your Files or Your Chats. You can request correction of Account Data if it is considered incorrect, in accordance with the [New Zealand Privacy Act 2020](https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.html) and the GDPR. Any requests for access to, or correction of, Account Data that is not available to you when you are logged into your account, or if you cannot log in to your account, should be made to [privacy@mega.nz](mailto:privacy@mega.nz) specifying the information in question. The information will be provided promptly, and at least within one month, without charge unless the request is manifestly unfounded or excessive. Corrections will be promptly considered and actioned if appropriate.
 . If We have disclosed your Account Data to any third party (such as a compliance authority), we will inform them of any correction where possible and will also inform you about the third parties to whom the data has been disclosed where lawful and appropriate.

Privacy Policy - MEGA

Full text changes — 20240101_rev01 to 20240301_rev01