Privacy policy

Who processes the data

The controller of the data collected through this website and for managing contractual relationships is TritoTech S.r.l., registered office at via S. Pertini 31, 20041 Bussero (MI), Italy, VAT number and tax code 09927240961, certified email (PEC) tritotech@pec.it. For any privacy request you can write to support@smtp365.it.

For the data that customers process through the service (for example the addresses of the recipients of messages sent by their devices), TritoTech S.r.l. acts as processor on behalf of the customer, who remains the controller. This relationship is governed by the data processing agreement that forms part of the terms of service.

What data we process

• Account data: name, email address and identifiers of the Microsoft 365 account used to sign in, company name, billing details.
• Connected mailboxes: addresses of the Microsoft 365 mailboxes enabled for sending and the technical references needed to send on their behalf. We do not know the password of your Microsoft 365 account.
• Device credentials: assigned name, username and an irreversibly encrypted version of the password.
• Sending metadata: date and time, credential and device used, originating IP address, sender, recipients, size and delivery outcome.
• Browsing data from the website, collected by the servers for security and operation.

We do not store the content of messages: subject, body and attachments pass through our servers only for the time needed to hand them over to Microsoft 365 and are not saved.

Why we process it

• To provide the service requested and perform the contract (Art. 6(1)(b) GDPR).
• To comply with legal obligations, for example tax and accounting obligations (Art. 6(1)(c)).
• For the security of the service and to prevent abuse, such as sending spam with stolen credentials (legitimate interest, Art. 6(1)(f)).
• To send you service alerts: a mailbox to reconnect, a quota running out, notices about your subscription.

How long we keep it

• Sending metadata remains available for the period set by the active plan (30 days or 90 days), then it is deleted.
• Account and mailbox data is kept for the duration of the contract and deleted within [period to be defined] of the account being closed.
• Billing data is kept for the period required by law (ten years).

Where it is stored and who sees it

The servers of the service are located in the European Union. The data can only be accessed by authorised staff of TritoTech S.r.l. and by the suppliers who help us provide the service, appointed as processors:

• Microsoft, which receives the messages to be delivered through the customer's Microsoft 365 mailbox;
• the provider of the cloud infrastructure the service runs on: [provider name to be added], with servers in [EU country to be added];
• the payment services provider: Stripe Payments Europe Ltd. (Ireland);
• 16bit S.r.l., via Bellincione 10, 20134 Milan, Italy, VAT number 09662570960, which develops and maintains the service.

If a supplier processes data outside the European Economic Area, the transfer takes place on the basis of an adequacy decision or of the standard contractual clauses approved by the European Commission.

Your rights

You can at any time request access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest, by writing to support@smtp365.it. If you believe the processing breaches data protection law, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

Cookies

This website only uses technical cookies needed for it to work. We do not use profiling cookies or third-party analytics tools. [To be checked before publication.]