Privacy policy: how we process personal data

Data controller

The data controller is Andrea Castellana Agenzia Pubblicitaria S.r.l. Società Benefit, registered office at Piazzetta Umberto Giordano 2, 20122 Milano (MI), Italia, VAT no. IT10177120960, Registro Imprese di Milano Monza Brianza Lodi n. 10177120960, REA MI-2511155, share capital € 10,000 fully paid, single-member company.

For any question about how your data is processed, or to exercise your rights, write to privacy@lubemy.com.

Requests via forms and email

When you fill in the contact or "Request activation" form, or write to info@lubemy.com or support@lubemy.com, we process the data you provide: full name, email address, company (optional), subject and text of the message, the service or domain you are interested in and the language of the page you write from.

We use it to reply, assess the request and, if you ask, prepare a quote. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, for general enquiries, our legitimate interest in replying to you (Art. 6(1)(f)). The confirmation box in the form records that you have read this notice.

Name, email and message are needed to reply: without them we cannot handle the request. We do not use this data for newsletters or promotional messages.

We keep the correspondence for as long as needed to handle the request and any quote. If no contract follows, we delete it within 24 months of the last contact; if a contract follows, we keep it for the duration of the relationship and afterwards for the periods required by law, for example 10 years for accounting records (Art. 2220 of the Italian Civil Code).

Domain availability checks

The domain search sends our server only the name and extension you type. The server queries the official registries for that extension through the RDAP protocol or, for some extensions such as .it and .eu, the registry's WHOIS service.

The query to the registries comes from our server: your IP address is not passed on to the registries. We do not link the search to your identity and we keep the result for a few minutes only, to avoid repeated queries.

Technical logs and security

Like any web server, ours automatically records some technical information about the requests it receives: IP address, date and time, requested page, response code, browser type and referring page.

We process it to keep the website secure, prevent abuse and diagnose faults, on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Logs are kept for a short period, with automatic rotation and deletion; we keep them longer only when they are needed to investigate a security incident or to protect a legal right.

To limit automated submissions, the contact form and the domain search use an anti-abuse counter based on a cryptographic fingerprint (hash) of the IP address, valid for one hour: the IP address itself is not stored in clear.

Cookies and analytics

The website uses no profiling cookies, no third-party cookies and no cookie-based analytics. Fonts and graphic assets are served from our own server, with no requests to external services while you browse. Details are in the cookie policy.

Who processes data on our behalf

Data is processed by authorised staff bound by confidentiality. To run the website we rely on providers appointed as processors under Article 28 GDPR:

• Oracle, provider of the Oracle Cloud Infrastructure cloud platform (Milan region, Italy, EU), which hosts the website, the mailboxes and the technical logs;

• the same provider's email sending service (OCI Email Delivery), used to relay outgoing email, including our replies.

We may also share data with professional advisers, such as our accountant or lawyer, where necessary, and with the authorities where required by law. We do not sell or transfer personal data to third parties for their own purposes.

Where data is stored

Data is stored on infrastructure located in the Milan region, in the European Union. Any access by the provider from countries outside the EU, for example for technical support, is governed by its data processing agreement and by the safeguards set out in Chapter V of the GDPR.

Your rights

Under Articles 15-22 GDPR you can request access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest. We do not take decisions based solely on automated processing that produce legal effects concerning you.

To exercise your rights write to privacy@lubemy.com. We reply within one month of the request, a period that may be extended by two further months for complex requests, in which case we will let you know. We may ask for the information needed to verify your identity.

Complaints to the supervisory authority

If you believe the processing infringes the GDPR you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the supervisory authority of the EU country where you live, work or where the alleged infringement took place (Art. 77 GDPR).

Customers of our services

For customers who activate a service, the notice covering contract-related processing (customer records, invoicing, support and, for domains, disclosure of data to registries and registrars) is provided with the quote.

For the data customers upload to the services, such as websites, databases and email, lubemy acts as a processor on the customer's behalf: the agreement under Article 28 GDPR is part of the contractual documentation.

Updates to this notice

The date at the top shows the version in force. If we introduce new processing, for example when the online customer area opens, we will update this notice before it starts.