Telegram messenger Inc. uses and protects the user’s personal data. Telegram’s privacy policy puts forward how they use and protect users’ personal data, which user provides them or is obtained by telegram, in relation to requirements of their cloud-based services.

Telegram claims that they follow two principles for collecting and processing private data:

• The first principle is that they don’t use users’ data to show them ads.
• Second is, telegram only stores the data which telegram requires for its secure and feature efficient functioning.

Telegram says that its privacy policy forms part of its terms of service. So, the privacy policies are read along with the terms of services.

Who are the representatives of the Telegram in the European economic area and outside the European economic area?

In the European economic area (EEA), the services are provided by telegram.

Outside the European economic area, the telegram has one of its EEA-based grouped companies, Telegram UK Holdings Ltd. (71-75 Shelton Street, Covent Garden, London, England, WC2H 9JQ), as a representative for handling user’s personal data.

What are the legal grounds on which telegram processes users’ personal data?

Telegram processes the user’s personal data on the necessity of legitimate interests. Which are:

• To provide effective services to the users.
• To prevent or detect fraud or any security-related issues.

*Only if these interests are not overridden by the user’s interest or fundamental rights and freedoms, which require the protection of personal data.

What is the personal data used by telegram?

1. Initial account data: Mobile number, profile name, profile picture, and about information.
2. Telegram intends to make it easier for the user’s contacts to reach them: For that purpose user’s screen name, profile picture and username are always public on telegram.
3. User’s E-mail Address: Telegram uses the user’s email address to set up a password recovery email. They use it to send the user a password recovery code if users forget it.
4. User’s messages: Telegram has various features to messaging service. Such as:
   1. Cloud Chats: Telegram being a cloud service stores messages, photos, videos, and documents from a user’s cloud chats on their servers. So that user can access their data anytime without relying on third-party backups. All users’ data is stored with encryption and the encryption keys are stored in various data centers positioned in different jurisdictions. In this manner, telegram prevents local engineers or physical intruders from getting access to user data.
   2. Secret Chats: The secret chats in telegram use end-to-end encryption. Which encrypts the data and the key to such encryption is with the user and the receipt of the chat. Such encryption obstructs anyone without direct access to seeing the content shared in the chat. Telegram does not store the user’s secret chats on their servers. Neither do telegram maintains any log for the messages, so after a while telegram does not know to whom and when the message is sent. Secret chats are not available in the cloud, users can only access them from the device they were sent from.
   3. Media in Secret Chats: When a user sends media (photos, videos, or files) through secret chats. Such data is encrypted before being uploaded, with a separate key, unknown to the server. After uploading this key and the file’s location is encrypted again, with a secret chat’s key and then sent to the recipient. The recipient can then download and decipher the file. The file is stored in the servers of telegram but they cannot decipher it. They have no idea about the data or chat.
   4. Public Chats: Telegram supports public groups as well. These chats are cloud chats. These chats are completely encrypted, in storage and transit. Everything posted in public becomes accessible to everyone.                
5.   Phone Number and Contacts: Telegram uses phone numbers as unique identifiers. They ask the user’s permission before syncing their contacts. They store user’s contact to notify them as soon as any of their contacts joins the telegram. Users can always stop syncing contacts or delete them from telegram’s servers through Settings > Privacy & Security > Data Settings. The user’s using Android, Telegram asks them for permission to access the user’s phone call logs. If the user grants such permission. Telegram will be able to call for verification of accounts.                                                                            
6. Cookies: Telegram uses cookies to operate and provide services on the web, rather than profiling and advertising. Such cookies can be controlled by the user through the browser, the user can accept or remove or block them.

How does telegram keep users’ personal data safe?

• Storage of data: When the user signs up for telegram from the United Kingdom and EEA, his data is stored in the data centers of the Netherlands. These data centers are rented by telegram. The servers and network in these data centers are owned by telegram. Telegram does not share the user’s personal data with these data centers.

All data of the user is heavily encrypted, which cannot be accessed by the local telegram engineers and intruders.

• End-to-End Encrypted Data: User’s messages, media, and files from secret chats, as well as the contents of user’s calls and the data user stores in their Telegram Passport can be processed only on user’s and the recipient device. Because this data is end to end encrypted with a key known to the user and recipient only. Telegram has no way of deciphering the actual information. Due to which telegram can neither store nor process a user’s personal data.
•  Retention: Telegram only stores personal data as long as it is necessary to fulfill their obligations in respect of the provision of the services. Unless it is stated otherwise in the privacy policy.

How does telegram process users’ personal data?

• For their Services: Telegram processes user’s data to deliver user’s cloud chat history (messages, media, and files), to any device user chooses without using third party backup or cloud storage.
• For Safety and Security: To manage the security of the user’s account, prevent spam, abuse, and violations of the telegram’s terms of services. Telegram collects Metadata such as the user’s IP address, devices and telegram apps that the user has used, history of the username changes, etc.

If any such Metadata is collected, it can be kept for 12 months at most.

• Spam and Abuse: The moderators of telegram may check messages which are reported to them by their recipients, to prevent phishing, spam, and other kinds of abuse thereto. If such spam report is confirmed by the moderators, then the user’s account is limited from contacting strangers temporarily or permanently. The user can send such an appeal through @spambot.

If the violations are extremely serious, the user’s account may be banned by telegram.

• For advancing features: Telegram uses users’ data to build useful features.
• Not used for Ads: Telegram claims of not using data for commercial purposes. It only stores the information to function as a secure and feature-advancing cloud service.

WHAT ARE BOT MESSAGES?

Bots are apps that look like telegram users. Users can chat with them from their chat list or add them to groups or use their features. By using any of these features or performing such actions, the user happens to share some of their data with the third-party bot developers.

How can bots receive data?

User happens to share their data with bot developers when they interact with them. By:

• Sending messages to a bot.
• Using an inline bot.
• Participating in a group with a bot.
• Pressing buttons in messages sent by a bot.
• Paying for goods and services through bots.

What is the Data received by Bots?

The developers of the bot receive the public account data of the user such as the user’s screen name, username, and profile picture. Telegram only maintains its bots. Other bots are completely independent of them.

When the user interacts with the bot, they receive the following data:

• User’s messages when the user sends them something.
• User’s IP address, If the user clicks on links or buttons provided by the bot. (only if it controls the website to which the link leads).
• When a user starts his message with the username of an inline bot (e.g. @gif).

Third-party payment services?

Telegram works with payment providers, which are completely independent of telegram. Telegram does not process payments from users. It instead relies on various payment providers. It is the payment providers that handle and store users’ credit card details. Neither Telegram nor bot developers have access to this information.

* These payment providers don’t adhere to telegram’s privacy policies.

For the same reason, telegram does not handle any Payment Disputes. Any disputed payments are the responsibility of the bot developers, payment providers, and banks who participated in the exchange.

Who else might telegram share users’ personal data with?

• Other Telegram Users: While entering into the terms and services and choosing to communicate with other telegram users. Users automatically instruct telegram to transfer their personal data, on their behalf with those other users, following the privacy policy.
• Telegram’s Group Companies:

 (1) Parent company, Telegram Group Inc., located in the British Virgin Islands.

(2) Telegram FZ-LLC, a group member located in Dubai.

 To help provide, improve and support our Services.

 Telegram implements appropriate safeguards to protect the security and integrity of that personal data.

• Law Enforcement Authorities: If Telegram receives a court order that gives a confirmation that the user is a terror suspect. Telegram may disclose a user’s IP address and phone number to the relevant authorities.

*telegram says that it has not happened yet.

What are the rights of the user regarding the personal data that the user provides to telegram?

User’s Rights

Telegram Under applicable data protection legislation, in certain circumstances, provides rights to the user concerning their personal data. User has the right to:

 (1) Request a copy of all his personal data that the telegram stores and to transmit that copy to another data controller.

(2) Delete or amend their personal data.

(3) Restrict, or object to, the processing of their personal data.

(4) Correct any inaccurate or incomplete personal data telegram hold on the user. 

(5) Lodge a complaint with national data protection authorities regarding telegram’s processing of their personal data.

The user can exercise their rights by contacting @GDPRbot.

Users can use @GDPRbot to:

• Request a copy of all user’s data that Telegram stores.
• Contact telegram about Data Privacy.

Users can control how their data is used through Settings > Privacy & Security > Data Settings.

What is the status of messages after the user deletes them?

In cloud chats, supergroups and channels, users can choose to delete a message for all participants within at least 48 hours after sending. A copy of the message stays on the servers as a partner’s message history. After the partner deletes it too, it is deleted forever.

Self-Destructing of Messages is a feature of secret chats. Messages in secret chats can be set to self-destruct through settings. Such countdown starts soon after the message is read. After the timer expires the devices participating in chat are instructed to delete the message.

Telegram also has a feature of Account Self-Destruction, if the user does not use telegram for 6 months, their account is deleted along with all messages, media, contacts, and every other piece of data they have stored in the Telegram cloud. Users can go to settings to set the time period for inactivation for self-destruction as well.

Telegram reviews and may update its Privacy Policy from time to time.

REFERENCES

• Telegram privacy policy, TELEGRAM (Nov. 28, 2020, 11:00 PM), https://telegram.org/privacy#1-1-privacy-principles.
• Telegram FAQ, TELEGRAM (Nov. 28, 2020, 09:00 PM), https://telegram.org.faq

Disclaimer: “Vestralex assumes no responsibility or liability for any errors or omissions in the content of this Article. The information contained in this article is provided on an “as is” basis as sourced with no guarantees of completeness, accuracy, usefulness or timeliness. This article contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. This article and the information contained herein is not intended to be a source of advice or analysis with respect to the material presented, and the information and/or documents contained in this article do not constitute advice. All copyrights and trademarks contained herein are properties of their respective owners, any representation of such rights and marks is purely for informational purposes only. This article is not a substitute for professional legal advice. This article does not create an attorney-client relationship, nor is it a solicitation to offer legal advice.”