Privacy policy

How personal data is handled under EU Regulation 2016/679 (GDPR).

Data controller

The data controller is Luca Gabella Mandati Internazionali, Via Ravenna 1, 19125 La Spezia, Italia, VAT number 01549960118. For any request concerning personal data you can write through the contact form, stating which right you wish to exercise.

Data collected

The contact form collects your first and last name, email address, company name if given, and the content of your message.

The site also hosts some forms that can only be reached from a link sent by email: supplier qualification, supply request, quotation submission, opportunity brief request and meeting booking. Whoever fills them in provides their own and their company's contact details, the technical and commercial information the request involves, and any attached documents. That data is processed for the purpose for which it is provided and for no other.

The site uses statistics cookies (Google Analytics 4) and marketing cookies (Google Ads, LinkedIn) only with your consent, collected through the banner shown on your first visit. Tools, durations and how to withdraw consent are described in the cookie policy.

Purpose and legal basis

Data is processed solely to answer the requests received and, where applicable, to carry out any professional relationship that may follow. The legal basis is the data subject's consent and the performance of pre-contractual measures.

Where data is stored

Data collected through the site and its forms is kept in an archive managed directly by the controller, on a single server located in the European Union. It is not transferred to third-party CRM platforms, nor used for marketing purposes, except for the LinkedIn campaign measurement described below, for those who have consented to it.

Some providers process data on the controller's behalf, as processors under Article 28 GDPR, each only for its own service:

• Aruba S.p.A. (Italy): server, email and certified email (PEC) for the domain;
• Zoho Corporation B.V. (Netherlands): electronic signature of documents, described below;
• Stripe Payments Europe, Limited (Ireland): card and digital wallet payments, partly as an independent controller, as described below;
• Anthropic PBC (United States): an AI-based writing tool that receives pseudonymised data only, as described below;
• Google Ireland Ltd (Ireland): statistics and advertising, only with the consent given in the cookie banner.

LinkedIn campaign measurement. If you have consented to marketing cookies and arrive from a LinkedIn ad, the form records the campaign you came from together with your enquiry. If the enquiry becomes a deal, the controller reports it to LinkedIn Ireland Unlimited Company (Ireland) through the Conversions API, with your e-mail address hashed with SHA-256, first and last name, company and the ad click identifier, so that LinkedIn can attribute the result to the campaign. The content of the enquiry is not shared. The legal basis is consent, which you can withdraw at any time through the «Manage cookies» link; withdrawal does not affect reports already made. Details in the cookie policy.

Reserved area

Anyone who fills in one of the forms may be offered, by email, access to a reserved area where they find the documents shared with them, the meetings arranged and their own details, which they can correct. Access is personal and password-protected; corrections made by the data subject are recorded with date and time.

Every PDF document downloaded from that area, or from a personal link received by email, is marked at the time of download with the recipient's name, the date and a copy code, and the download is logged together with the IP address and browser used. This protects the confidentiality of shared documents: the legal basis is the legitimate interest of the controller and its clients in knowing to whom a copy was issued. The full notice for the reserved area is available at crm.mandati-internazionali.eu.

Electronic signature

Offers, non-disclosure agreements and other documents to be signed may be sent for electronic signature with Zoho Sign. Signing involves processing your name, email address, role in your company, your mobile number if an SMS verification code is used, the document itself and the technical data of the signature (date and time of opening and signing, IP address), which are recorded in the completion certificate attached to the signed document. The data stays in Zoho's European data centres. The legal basis is the performance of a contract or of pre-contractual measures.

Invoicing and payments

To issue pro forma invoices, electronic invoices and credit notes, the controller processes the client's tax details (company name or first and last name, VAT number or tax code, registered address, certified email (PEC) address, recipient code), the content of the documents, amounts, due dates and payments received. Issuing, transmitting and keeping invoices is a legal obligation (Article 6(1)(c) GDPR); pro forma invoices, payment reminders and collections are needed to perform the contract (Article 6(1)(b) GDPR).

Exchange System (SdI). Electronic invoices are transmitted to the Sistema di Interscambio (SdI) of the Italian Revenue Agency, which processes them as an independent controller, through the controller's certified email account managed by Aruba S.p.A. A copy of the document may be sent by email and made available in the reserved area. Invoices and credit notes are kept for ten years from the date of the last entry (Article 2220 of the Italian Civil Code and Article 39 of Presidential Decree 633/1972), as also required for electronic invoices.

Card and digital wallet payments. Pro forma invoices and invoices can be paid by card, Apple Pay, Google Pay or the other methods Stripe displays, on the controller's page crm.mandati-internazionali.eu/pay/, which embeds the payment form of Stripe Payments Europe, Limited (Ireland), or on the payment page hosted by Stripe. Card details are entered directly into Stripe's fields: they do not pass through, and are not stored on, the controller's servers. The controller gives Stripe the amount, currency and document number and, if Stripe receipts are switched on, the client's email address; it receives from Stripe the outcome of the payment, the amount, currency, fee, date and the identifiers of the payment and of the payouts to its account.

Stripe carries out the payment on the controller's behalf, but processes part of the data as an independent controller: for fraud prevention, anti-money-laundering and other legal obligations, and for the operation of the payment networks, under its own privacy policy. Transfers to Stripe, Inc. in the United States rely on the EU-US Data Privacy Framework, to which Stripe adheres, and on the European Commission's standard contractual clauses. The technical cookies Stripe uses on the payment page are described in the cookie policy.

Artificial intelligence

In the controller's business software, Claude, the artificial intelligence model developed by Anthropic, is used as a writing tool: to draft messages and business documents (offers, non-disclosure agreements, operational notes, reports) and the descriptive lines of pro forma invoices and invoices, to rewrite or translate them, to tidy up notes and to answer questions about the data in the software. Data is sent only when the controller asks for it, never automatically, and every text produced is reviewed by the controller before it is used. The model takes no decisions concerning the data subject: there is no automated decision-making within the meaning of Article 22 GDPR. Nor does the model set prices: in the lines of pro forma invoices and invoices they appear only when the controller has given them.

Pseudonymisation. Before a request leaves the controller's server, the personal data it contains is replaced with neutral codes, for example [[NOME_3F2A9C]]. This applies to first and last names, company name and website, email addresses, phone numbers, postal addresses, VAT numbers, tax codes, IBANs and LinkedIn profiles. Anthropic receives only the codes and the business context of the request; the real data is put back in place on the controller's server when the reply arrives. The link between codes and data is never sent or stored: it exists only for the duration of a single request, and the codes are generated with a secret key that stays on the controller's server (Articles 4(5), 25 and 32 GDPR).

The replacement is automatic: it recognises data held in the archive and data with a recognisable format, such as email addresses, phone numbers, tax codes, IBANs and VAT numbers. A name mentioned in the text of a message that is not in the archive, or a detail that does not identify anyone on its own but might in combination with others, may not be replaced. For this reason the data sent is pseudonymised, not anonymous, and remains personal data protected by the GDPR.

Provider safeguards. Anthropic PBC processes the data as a processor under the data processing addendum included in its commercial terms. Transfers to the United States rely on the standard contractual clauses approved by the European Commission (Article 46 GDPR), contained in that addendum. Content sent through Anthropic's API is not used to train models and is deleted by the provider within 30 days, except in the cases set out in its terms, such as investigating unlawful use.

Legal basis and objection. This processing is based on the controller's legitimate interest in handling business correspondence and documents quickly and accurately (Article 6(1)(f) GDPR), with the safeguards described above. You may object at any time (Article 21 GDPR) by writing through the contact form: from then on your data and your correspondence will no longer be processed with this tool.

Retention

Data is kept for as long as necessary to handle the request and, in the case of a professional relationship, for the period required by accounting and tax obligations. The download log for shared documents is kept for five years. Signed documents and their completion certificate are kept for the duration of the contract and for ten years thereafter. Invoices and credit notes are kept for ten years from the last entry.

Your rights

You may exercise at any time the rights provided by Articles 15-22 of the GDPR, including access, rectification, erasure, restriction, portability and objection to processing. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

Last updated: 5 October 2026.