Privacy notice
This notice explains how we process personal data when you visit the website mailcertificata.eu, when you receive an email from an @mailcertificata.eu address and when you write to us. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR).
This English version is provided for convenience; the Italian version prevails.
Controller
Bandini S.R.L., Via Alessandro Volta, 22, fraz. Piandicontro – 63857 Amandola (FM) – Italy. Email: privacy@mailcertificata.eu.
Bandini S.R.L. provides online shops with a service for sending transactional emails, so we have two different roles:
- for the content of the emails we send on behalf of shops and the data the shop gives us for them, the shop that writes to you is the controller and we act as its processor: see Emails sent on behalf of shops;
- for the other processing described here (website logs, our mail server logs, including where they relate to those emails, messages you send us and abuse reports), we are the controller.
Emails sent on behalf of shops
When an online shop uses our service, it gives us the data needed to send you its emails: usually your email address, your name and the order or account details shown in the message.
The shop is the controller of this data, and we process it on the shop's behalf as a processor (Article 28 GDPR). The shop's privacy notice explains how it uses the data, how long it keeps it and who it shares it with.
To exercise your rights over this data (access, rectification, erasure, objection and so on), please contact the shop that wrote to you; its name is usually shown in the email. You can also write to privacy@mailcertificata.eu.
Data we process as a controller and why
For each purpose for which we are the controller, we list the data, the legal basis and how long we keep the data.
Visits to this website
- Data
- IP address, date and time, page requested, response status code, amount of data transferred, referring page (referrer), browser and operating system (user agent).
- Legal basis
- our legitimate interest in keeping the website secure and working (Article 6(1)(f) GDPR).
- Retention
- only for as long as needed to keep the website secure and to investigate problems or attacks; the logs are then deleted.
Mail server logs
- Data
- sender and recipient addresses, IP addresses of the mail servers involved, message identifiers, subject line, size, date and time, delivery status and any error messages (bounces).
- Source
- the shop that sends you the email through our service (recipient address) and the mail servers involved in delivery.
- Legal basis
- our legitimate interest in handling bounces, fixing technical problems with our service, preventing and detecting abuse, and keeping a good reputation for our servers with other email providers so that emails reach their recipients (Article 6(1)(f) GDPR).
- Retention
- only for as long as needed to handle bounces, fix technical problems and detect abuse; the logs are then deleted.
Messages you send us
- Data
- name, email address, company and role where relevant, content of your messages and of our replies.
- Legal basis
- our legitimate interest in answering enquiries and in managing relations with clients, suppliers and partners (Article 6(1)(f) GDPR); if the contract is with you, performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR). Keeping business correspondence is a legal obligation (Article 6(1)(c) GDPR; Articles 2214 and 2220 of the Italian Civil Code).
- Retention
- 10 years for correspondence relating to the business (Article 2220 of the Italian Civil Code); other messages, for as long as needed to handle your request and any follow-up.
Abuse reports and misdirected emails
- Data
- the message you forward to us, including its headers, and your contact details.
- Legal basis
- our legitimate interest in preventing abuse and running our email service securely (Article 6(1)(f) GDPR).
- Retention
- until the report is closed, and then only for as long as needed to recognise repeated abuse and to show how we handled it.
Legal claims
- Data
- the data needed, from the categories above.
- Legal basis
- our legitimate interest in establishing, exercising or defending legal claims if a dispute arises (Article 6(1)(f) GDPR).
- Retention
- for as long as the dispute lasts and until the time limits for an appeal have expired.
Do you have to give us your data?
No law requires you to give us personal data. Website log data is recorded automatically when you visit these pages. If you write to us, you decide what to tell us, but without an email address we cannot reply. If you are a client or supplier of ours, we need your contact details to conclude and perform the contract.
Cookies
This website does not use cookies or any other tracking tools, and it does not load content from other websites.
Who receives the data
- Namecheap, Inc., based in the USA, provides the servers for this website and for our email service, the DNS and the forwarding of the email we receive. It processes the data on our behalf as a processor (Article 28 GDPR).
- Email service providers acting as processors (Article 28 GDPR), which run the mailbox where we receive forwarded email.
- Public authorities, where the law requires it.
Transfers outside the EU/EEA
Namecheap, Inc. is based in the United States, so data may be processed outside the European Union and the European Economic Area (EEA).
The same may apply to the provider of the mailbox where we receive forwarded email.
To find out the legal basis for these transfers, write to privacy@mailcertificata.eu.
Your rights
For the data a shop gives us to send you its emails, you exercise your rights with the shop (see above). For the processing for which we are the controller, you have the right to:
- access your data and get a copy (Article 15 GDPR);
- have inaccurate data corrected (Article 16 GDPR);
- have your data erased (Article 17 GDPR);
- restrict processing (Article 18 GDPR);
- receive the data you gave us in a portable format (Article 20 GDPR).
Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Article 21(1) GDPR).
To exercise your rights, write to privacy@mailcertificata.eu. We reply within one month, as required by Article 12 GDPR.
Right to lodge a complaint
If you think we process your data in breach of the GDPR, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, Italy, www.garanteprivacy.it (Article 77 GDPR). You can also contact the supervisory authority in the country where you live or work.
Automated decisions
We do not make decisions based solely on automated processing, including profiling (Article 22 GDPR).
Last updated: 15 November 2026