Dottor Mail
Regulation (EU) 2016/679

GDPR Compliance Statement

How Dottor Mail SRL upholds European data privacy standards, enforces Zero-Retention list processing, and empowers enterprise teams to maintain GDPR compliance.

Effective Date: September 1, 2026Last Updated: September 7, 2026Entity: Dottor Mail SRL (Italy)
Privacy PolicyTerms of ServiceCookie PolicyGDPR Compliance

01.EU-Native Platform & Jurisdiction

European by Design: Unlike offshore email tools, Dottor Mail SRL is founded and headquartered in Turin, Italy. GDPR compliance is our baseline operational standard, not an afterthought.

Dottor Mail SRL is an Italian company headquartered in Turin, Italy (Strada Val S. Martino, 111, 10131 Turin). Our cloud servers, primary database infrastructure, and operational engineering teams operate within the European Economic Area (EEA).

We are committed to operating in full compliance with the General Data Protection Regulation (Regulation (EU) 2016/679 - “GDPR”) and the Italian Personal Data Protection Code (Legislative Decree no. 196/2003).

02.Adherence to Core GDPR Principles (Article 5)

1. Lawfulness, Fairness & Transparency

We process data only under verified lawful bases with transparent contracts and zero hidden tracking.

2. Purpose Limitation

Customer lists uploaded for verification or warmup are used solely to execute the requested operational tasks.

3. Data Minimization

We collect only what is strictly required to execute verification queries and deliver transactional invoices.

4. Storage Limitation (Zero Retention)

Uploaded contact lists are automatically purged 30 days after processing, or instantly upon manual customer deletion.

03.Technical & Organizational Measures (TOMs)

In compliance with Article 32 of the GDPR, Dottor Mail has implemented rigorous technical and organizational security measures to protect personal data against accidental loss, unauthorized access, or disclosure:

  • Cryptographic Standards: AES-256 encryption at rest for database records and secure token vaults; TLS 1.3 encryption in transit across all API endpoints and web connections.
  • Tenant Isolation: Logical and schema-level multi-tenant separation preventing any possibility of data crossover between accounts.
  • Access Control: Strict principle of least privilege, two-factor authentication (2FA) for engineering staff, and continuous access logging.
  • Infrastructure Resilience: Automated daily backups, DDoS mitigation, and redundant cluster hosting in Frankfurt and Milan data centers.

04.Zero-Retention Customer List Commitment

Customer Data Sovereignty Guarantee

Many legacy email verification platforms monetize customer lists by aggregating them into shared global databases or training commercial lead engines. Dottor Mail strictly rejects this practice.

When you upload an email list to Dottor Mail:

  • Your list is processed in isolated memory and stored in encrypted cache solely for your active session.
  • We never add your contacts to a master database or share them with any third party.
  • Verification results are permanently deleted 30 days after processing, or immediately upon your command via the “Scrub List Now” button in the dashboard.

05.Data Processing Addendum (DPA)

To satisfy Article 28 of the GDPR, Dottor Mail offers a pre-signed Data Processing Addendum (DPA) to all registered customers and enterprise accounts. Our DPA incorporates:

Standard Contractual ClausesEU SCCs (Module 2: Controller-to-Processor) for cross-border data transfer legal certainty.
Detailed TOMs AnnexComprehensive documentation of technical security controls and audit guarantees.
Subprocessor ApprovalsAdvance notification mechanism before engaging any new cloud infrastructure subprocessor.

To request a countersigned DPA for your enterprise compliance records, email dpa@dottormail.com.

06.Subprocessor Vetting & EU Data Residency

We maintain strict governance over third-party infrastructure providers. All subprocessors must:

  • Demonstrate SOC 2 Type II and ISO/IEC 27001 certifications.
  • Store and process core operational data within EU sovereign borders (Frankfurt, Milan, Dublin).
  • Agree to audit rights and stringent data confidentiality obligations.

07.Data Subject Requests (DSR) & Rights

We empower data subjects to seamlessly exercise their rights under GDPR Articles 15–22:

Self-Serve Data Export: Export your account history, invoices, and credit activity directly from your user profile.
1-Click Account Erasure: Delete your account and all associated tokens with a 30-day irrevocable data purge.

DSR requests submitted to dpo@dottormail.com are verified and processed within 30 days at zero charge.

08.Data Breach Protocol & 72-Hour SLA

In accordance with Articles 33 and 34 of the GDPR, Dottor Mail maintains a 24/7 Incident Response Team. In the event of a confirmed personal data breach posing risk to the rights and freedoms of individuals:

  • We will notify the competent supervisory authority (Italian Garante Privacy) within 72 hours of becoming aware of the incident.
  • Affected customers will be alerted without undue delay with mitigation steps and incident details.

09.Contact the Data Protection Office

Data Protection Officer: Dottor Mail Legal & Regulatory Affairs

Direct DPO Email: dpo@dottormail.com

Corporate Entity: Dottor Mail SRL

Headquarters: Strada Val S. Martino, 111, 10131 Turin, Italy

© 2026 Dottor Mail SRL. All rights reserved.

hello@dottormail.com•Contact Legal Team