GDPR compliance

GDPR-compliant B2B databases: how we handle every record

Bancomail applies legitimate interest to the collection, updating and transfer of data, formalised in a LIA and overseen by the DPO. The regulatory analysis is carried out by its in-house Legal department and kept up to date with the Authority's decisions. All records receive the same treatment, with the highest level of protection, even when the law does not require it. Every record is traced, and on over 11,000,000 records Bancomail guarantees information, access, rectification, erasure and objection.

A record's journey

What we guarantee at every step

1
CollectionSource and date recorded
2
Privacy noticeGiven to everyone, companies included
3
Objection and removalAnyone who objects is removed
4
TransferTraced: to whom, when

11 millionrecords in the Database

75%companies, associations and organisations

25%contacts attributable to a natural person

Full traceabilitysource, date, privacy notice, transfers

Why we are compliant, in brief

We make no difference in treatment: every record, whether it belongs to a company or a natural person, receives the highest level of protection, with a documented legal basis.

We treat everyone the same way

75% of records are companies and organisations, which the Regulation excludes; 25% identify a natural person. Out of professional ethics and for protection, the privacy notice and rights apply to all.

A documented legal basis

Legitimate interest for collection, updating and transfer, put in writing in the LIA with an objective balancing test, based on the analysis of our in-house Legal department.

Traced and supervised

For every record we document source, collection date, privacy notice given and transfers. A DPO oversees the procedures.

Constant in-house control over compliance

Compliance is overseen in-house: the analysis of the regulatory framework is carried out and kept up to date by our Legal department.

In-house Legal department

An in-house Legal department oversees our compliance

Together with our Legal department and in agreement with the most authoritative players in the Direct Marketing sector, we carry out and keep up to date a precise and thorough analysis of the GDPR framework for our field, in the light of the Authority's decisions.

In-house Legal department
Dialogue with Direct Marketing players
Updated with the Authority's decisions

Our legal basis: legitimate interest

We apply it to the collection, updating and transfer of data, with a privacy notice to data subjects and guaranteed rights.

Recital 47

The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.

For contacts attributable to a natural person it is the basis of our processing: the data remain personal data, with a privacy notice and guaranteed rights.

Original text of Recital 47 (conclusion)

The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.

The point of view

Whoever publishes contact details wants to be contacted

When a company publishes the contact details of one of its representatives, on a website, in a directory, in an advertisement or on a professional profile, it does so in order for that person to be contacted about the company's business. This choice defines the purpose for which the data was provided and the reasonable expectation of whoever published it: to be reached by those who deal with that business, customers and suppliers included.

The legitimate interest assessment rests on three checks

Purpose

Putting businesses with complementary interests in touch.

Necessity

We only process professional contact data that are already public or have been provided.

Balancing

Contact details are published in order to be contacted. The data subject is informed and can object at any time.

A clarification

Legitimate interest is the basis on which we process and transfer data. It is not a green light to send promotional emails: whoever writes to the contacts follows the rules of the channel. You will find the recommendations in the box “Using our contacts”.

What the Database contains: two cases

Over 11,000,000 records of companies, associations and freelancers. The law frames them differently, but we make no distinction: we treat them the same way, with the highest level of protection.

Clear-cut case: companies and organisations Mixed case: contacts attributable to a natural person

75%Clear-cut case

Companies, associations and organisations

Corporations, limited companies, partnerships and other legal forms, with generic (info@) or department (marketing@, sales@) addresses. Professional partnerships fall into this group.

25%Mixed case

Contacts that identify a natural person

Two patterns: [email protected] and [email protected]. The second is typical of self-employed professionals working on their own.

What the law says, what we do

	Clear-cut case · 75%	Mixed case · 25%
GDPR protection	Not applicable: the Regulation does not cover legal persons' data (Recital 14)	Yes: they are personal data (Art. 4 GDPR), even if published as a business contact
Basis for processing	Not applicable: legal persons' data fall outside the Regulation	Legitimate interest (Recital 47)
Privacy notice	Given to every record, including the companies the Regulation excludes, out of professional ethics and for protection (for natural persons, under Art. 14 GDPR)
Rights guaranteed	Information, access, rectification, erasure and objection, for all records
Traceability	Full traceability: source, collection date, privacy notice given and transfers documented for every record
How we treat them	The same way: same privacy notice, same rights, same objection, same traceability

Recital 14: why companies fall outside the Regulation

The Regulation protects natural persons and does not cover the processing of legal persons' data, including their name, legal form and contact details. This exclusion was already provided for by the revision of the Italian Privacy Code (the “Salva Italia” decree). It concerns data protection, not the rules on sending communications, which are a separate matter. Out of professional ethics and for greater assurance, our procedures have always guaranteed these entities too the rights of information, access, rectification, erasure and objection.

The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.

Mixed case: legitimate interest and channel rules

The legitimate interest in processing rests on the purpose for which the data were provided and on the reasonable expectation of whoever publishes the contact details (see The point of view, above), without the data leaving the Regulation's protection: they remain personal data, with a privacy notice and guaranteed rights.

The rules on the communication channel are a separate level and concern whoever writes: a request for information and a commercial offer are not the same thing, and the latter, towards a contact attributable to a natural person, follows the rules on promotional communications.

The Garante's position and the approach we follow

Positions on this topic can vary, and it is a matter open to different readings. The one we set out here is the position that the Italian Data Protection Authority (Garante) has made operational through its decisions, and it is the criterion we align with: respecting the purpose for which the data was made public, assessing each situation on its merits, with consistency between how the data was made public and how it is used.

What we do to stay compliant

Seven concrete commitments, from the data's origin to its transfer. This page is an extract from our analysis, which refers to the Italian legal framework (Italian Privacy Code and GDPR).

Data origin

Three categories of sources, all declared

Italian and foreign companies and professionals who have provided their contact details directly or in public sources. Details of sources and checks are below.

Privacy notice

A privacy notice for every record

Companies' records included. It states the controller, data source, purpose, legal basis, recipients and how to exercise one's rights, and it is given periodically.

Objection

Anyone who objects is removed

We remove anyone who objects from the database and make sure the objection is always respected: they never come back, not even if they reappear in a new source.

Rights

The same rights for everyone

Information, access, rectification, erasure and objection, on all 11 million records, even where the law does not require them.

Traceability

Full traceability

Since Bancomail was founded we have traced the data we transfer. Every record carries its acquisition data (date, source) and the name and date references of whoever received it.

DPO

A DPO, even though not mandatory

The Regulation does not require it of us, but we have appointed a Data Protection Officer to oversee our procedures and flag any issues. Write to [email protected].

LIA

Legitimate interest is put in writing

The Legitimate Interest Assessment is an internal audit: it records the assessment by the Database team and the DPO of our legitimate interest and that of our customers, with an objective balancing test that checks that individual interests do not prevail.

Full traceability: for every record we can document

Source
Collection date
Privacy notice given
Transfers made

Tracing the source and collection date meets the accountability principle (Art. 5(2) GDPR) and allows us to state the origin of the data to any data subject who asks (Art. 14(2)(f) and Art. 15(1)(g) GDPR).

Where the data come from and how we check them

Voluntary provision

By the informed data subject, through sign-up forms.

Verified suppliers

Transfer from suppliers that meet the legal requirements.

Public sources

Chamber of Commerce registers, professional registers, trade associations, open data and listings that businesses themselves publish on directories and platforms in order to be contacted.

From listings published on online directories and platforms we accept only businesses that have their own website, from which we add email addresses and social profiles. Once in, every record is classified, geocoded, normalised and cross-checked against public sources such as the Chambers of Commerce, keeping its own source and collection date. Email addresses are validated periodically and their deliverability is contractually guaranteed for 60 days from delivery.

With your purchase

The compliance dossier

The process is described in our compliance dossier, signed by our CEO and approved by the DPO. It covers controller and DPO, sources and validation, privacy notice, register of objections, legal basis with a summary of the legitimate interest assessment, and transfer, with a checklist that answers the most common checks. We send it with your purchase, or on request.

Signed by the CEO
Approved by the DPO
With a checklist of checks

For senders

Using our contacts

We guarantee the processing of the data; the rules on sending depend on the channel and the country and remain with the sender. Four recommendations:

Introduce yourself before making an offer: the first contact is a transparent privacy notice, with no requests for consent and no offers.
Permission comes later: promotional email in Italy requires prior consent, even towards companies. Consent cannot be transferred with the list.
Check the recipients' country: the rules change from country to country.
Your privacy notice is still yours to give: with the transfer you become the new controller. Ours does not replace yours, which you must give to the recipients; on request we certify for your order that ours was sent before the transfer.

Permission marketing rules Privacy notice templates

Frequently asked questions about our compliance

What is the legal basis for transferring the data of a B2B email database?

Legitimate interest (Recital 47), formalised in a LIA under the DPO's supervision.

Are companies protected by the GDPR? Legal persons' data in B2B databases

No: Recital 14 excludes the data of legal persons. We nevertheless guarantee them information, access, rectification, erasure and objection too.

Is an email address such as [email protected] personal data under the GDPR?

Yes, if it identifies a natural person, even when it is used as a business contact. We handle it as professional personal contact data: legitimate interest, privacy notice under Art. 14 and right to object.

Does a GDPR-compliant B2B database treat companies and natural persons differently?

No. The Regulation excludes legal persons, but out of professional ethics and for protection we treat all records the same way: a privacy notice for everyone, the same rights, the same objection, the same traceability.

What happens if a contact objects to the processing of their data?

It is removed from the database and never comes back, not even if it reappears in a new source. Every sending of the privacy notice is logged for each record, with date and outcome.

What GDPR compliance documentation do I receive when I buy a B2B database?

With your purchase we provide the compliance dossier, signed by our CEO and approved by the DPO, with a checklist of the most common checks.

Who ensures Bancomail's GDPR compliance: Legal department and DPO?

An in-house Legal department carries out and keeps the regulatory analysis up to date, together with the leading Direct Marketing players. The DPO oversees the processing procedures: [email protected].

Can I email the contacts of a purchased B2B database right away?

It depends on the channel and the country. Promotional email in Italy requires prior consent, even towards companies: see the box “Using our contacts”.

This page describes Bancomail's procedures and gives a general overview: it does not constitute legal advice. Laws evolve and every country has its own specific rules; the choice of channel and sending methods lies with the sender, who must check the rules of the recipients' country.