Privacy notice — private area
Last updated 9 September 2026. This notice covers the reserved area at crm.mandati-internazionali.eu. Browsing mandati-internazionali.eu is covered by the privacy policy of the website.
Who is responsible
Luca Gabella — Mandati Internazionali, La Spezia, Italy. Write to lgabella@mandati-internazionali.eu for anything in this notice.
What is held here, and why
| Data | Why | Legal basis |
|---|---|---|
| Your name, job title, email, phone, address, and the same for your company | To answer your enquiry, send you documents and keep our correspondence in order | Performance of a contract or pre-contractual steps you asked for |
| The requests, quotations and meetings you took part in | To run the business relationship | Performance of a contract; legitimate interest in keeping a record of the work |
| Your sign-in details: email address and a password kept only as a hash | To let you into this area and no one else | Legitimate interest in keeping the documents protected |
| A record of the documents you download: date, time, IP address, browser, file, copy code | Shared documents are confidential; if one turns up where it should not, this is what says which copy it was | Legitimate interest in protecting confidential information |
| The corrections you make to your own details | To keep the record accurate and to know what changed and when | Legal obligation to keep data accurate; legitimate interest in an audit trail |
Documents carry your name
Every PDF downloaded from this area is stamped, at the moment you download it, with your name, your company, the date and a copy code, in the page footer and in the file properties. A copy passed to someone else remains attributable to the person who downloaded it. This is the point of the marking, and it is why the link and the account are personal.
Where it is kept, and for how long
Everything is on a single server in the European Union, run for Mandati Internazionali. There is no third-party CRM: your data is not sent to any external platform for this purpose. Email is delivered through Aruba S.p.A. (Italy), the mail provider for the domain.
- Contact and company details: for as long as the business relationship lasts, and up to 10 years afterwards where tax or contractual rules require it.
- Download records: 5 years, because that is how long a confidentiality question can take to surface.
- Sign-in sessions: 90 days; invitation links 21 days; password links 1 hour.
- An account you no longer want is closed on request, and closing it revokes every document link you hold.
Who else sees it
Nobody else, other than the technical suppliers who keep the service running (server hosting and email delivery), acting on instructions as data processors. Your details are not sold, not shared for marketing, and not passed to other clients or suppliers. Where a request of yours needs to reach a supplier or a buyer, only what that request requires is passed on, and you are told.
Artificial intelligence
When I draft an email to you from within the CRM, the record's fields and the recent messages of that conversation may be sent to Anthropic's API to produce the draft. Nothing is sent automatically: it happens only when I press the button, and nothing leaves until I do. Drafts are not used to train any model. If you would rather I did not use it for your correspondence, write to me and I will not.
Your rights
You may ask for a copy of your data, correct it (you can do most of it yourself from the "Your details" box), ask for it to be deleted, restrict or object to a processing based on legitimate interest, and ask for it in a portable format. Write to lgabella@mandati-internazionali.eu: I answer within 30 days. You may also complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).
Cookies
This area uses two cookies, both necessary and neither for statistics or advertising: one keeps you signed in, the other remembers whether you are reading in Italian or English. There is no tracking here.