GDPR & Data Protection
MailProfessionale (Eurhosting shpk) fully complies with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). This page explains how we collect, process and protect your personal data.
Data Controller
The data controller for personal data collected through MailProfessionale is:
Register of Processing Activities
Below is a summary register of the main personal data processing activities carried out by MailProfessionale.
| Activity | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Account & Billing Management | Creation and delivery of the customer account, invoicing, payments | Contract performance (Art. 6.1.b GDPR) | Duration of the contract + 10 years (tax obligations) |
| Email Mailbox Management | Delivery of the email service (sending, receiving, storing messages) | Contract performance (Art. 6.1.b GDPR) | Duration of the contract |
| SMTP/IMAP Logs | Security, abuse prevention, technical diagnostics of mail servers | Legitimate interest (Art. 6.1.f GDPR) | 90 days |
| Email Archiving for Compliance | Statutory retention for customers subject to regulatory archiving obligations | Legal obligation / Contract performance | As per the subscribed plan's policy |
| Customer Support | Handling technical and commercial support requests | Contract performance / Legitimate interest | 3 years from last interaction |
| Security & Fraud Prevention | Anti-spam, anti-virus monitoring, prevention of unauthorized access | Legitimate interest (Art. 6.1.f GDPR) | 12 months |
| Marketing (opt-in) | Sending commercial communications and newsletters | Consent (Art. 6.1.a GDPR) | Until consent is withdrawn |
Data Processor Agreement (DPA)
Business and Enterprise customers who need a Data Processor Agreement compliant with Art. 28 GDPR can request it by writing to privacy@mailprofessionale.com.
Sub-processors
To deliver the service we rely on the following sub-processors, selected for their security standards and GDPR compliance.
| Provider | Purpose | Data Location |
|---|---|---|
| Stripe | Payment processing and invoicing | European Union |
| Mistral AI | AI Assistant for Business/Enterprise plans (email summaries, reply drafts, smart spam filtering) | European Union (France) |
Your Rights
As a data subject, you have the right to:
Access
Obtain confirmation of processing and a copy of your personal data.
Rectification
Request correction of inaccurate or incomplete data.
Erasure
Request deletion of your data ("right to be forgotten").
Restriction
Request restriction of processing in certain circumstances.
Portability
Receive your data in a structured format and transfer it to another controller.
Objection
Object to processing based on legitimate interest or for marketing purposes.
Withdraw Consent
Withdraw previously given consent at any time.
To exercise any of these rights, write to privacy@mailprofessionale.com.
Data Breach
In the event of a personal data breach posing a risk to the rights and freedoms of data subjects, MailProfessionale will notify the competent supervisory authority within 72 hours of discovery, as required by Art. 33 GDPR, and will inform affected users when required by law.
Infrastructure Location
Unlike Google Workspace and Microsoft 365, MailProfessionale hosts 100% of data on servers located in Europe, outside the jurisdiction of the US CLOUD Act. No data ever leaves the European Union, guaranteeing full digital sovereignty over your data.
Supervisory Authority
You have the right to lodge a complaint with the data protection supervisory authority of your country of residence. The full list of European national data protection authorities (DPAs) is available on the website of the European Data Protection Board (EDPB) at edpb.europa.eu. For example, in Ireland the competent authority is the Data Protection Commission (DPC) at dataprotection.ie.
Contact
For any questions regarding the processing of your personal data or this GDPR notice, write to privacy@mailprofessionale.com.