GDPR & Data Protection Policy
Business Name: Commailer
Website: https://commailer.store
Contact Email: support@commailer.store
Business Address: NO315, Bauri Para, Mangalpur, Raniganj, Paschim Bardhaman, West Bengal 713347, India
Effective Date: October 22, 2026
Last Updated: October 22, 2026
1. Introduction
Commailer respects privacy and is committed to handling personal information responsibly. This GDPR & Data Protection Policy explains how we approach the collection, use, storage, disclosure, and protection of personal data in connection with our website and business services.
Commailer provides services relating to custom mail server setup, business email infrastructure, email campaign creation and management, email marketing strategy, and email deliverability guidance.
This policy is intended to explain our data protection practices and the rights that may be available under the European Union General Data Protection Regulation (EU GDPR), the UK GDPR, and other applicable data protection laws.
The GDPR does not automatically apply to every website or business. Its application depends on factors such as where individuals are located, the services offered, and the nature of the processing. Where the GDPR or UK GDPR applies to our activities, we will comply with the relevant requirements.
2. Who Is Responsible for Personal Data?
Commailer is responsible for personal data that it collects and processes for its own business purposes, where applicable.
Business: Commailer
Website: https://commailer.store
Email: support@commailer.store
Address: NO315, Bauri Para, Mangalpur, Raniganj, Paschim Bardhaman, West Bengal 713347, India.
For certain services, Commailer may process personal data on behalf of a business customer. In those circumstances, the customer may be the data controller, deciding why and how the data is processed, while Commailer may act as a data processor, handling data under the customer's documented instructions.
The actual roles of the parties depend on the service arrangement and the decisions each party makes about processing.
3. What Is Personal Data?
Personal data means information relating to an identified or identifiable individual. Depending on the circumstances, this may include:
Name and business contact details.
Email address and telephone number.
Business domain or account-related information associated with an individual.
Messages and service inquiries.
Technical information, such as IP addresses and online identifiers.
Website usage and cookie-related information.
Email campaign recipient information, where processed as part of an agreed service.
Service records, support communications, and relevant technical logs.
We aim to collect only information reasonably necessary for the relevant business purpose.
Please do not send passwords, authentication codes, payment card details, or unnecessary sensitive information through ordinary website contact forms.
4. How We Collect Personal Data
Depending on how our website and services are configured, personal data may be collected:
Directly when you complete a contact form or email us.
When you request information, a consultation, or a service.
During the delivery of an agreed business email or campaign-related service.
Automatically through website hosting logs, security tools, or technical systems.
Through cookies or analytics technologies, where these are used and legally permitted.
From business customers who lawfully provide information required to deliver a requested service.
We do not intend to collect personal data secretly or use it for purposes incompatible with the information provided to individuals.
5. Purposes of Processing
Where applicable, we may process personal data for the following purposes:
Responding to inquiries and communicating with customers.
Providing requested services and technical assistance.
Planning or configuring business email infrastructure.
Creating or managing email campaigns under an agreed engagement.
Investigating email deliverability or technical problems.
Maintaining website functionality and security.
Processing payments and maintaining appropriate business records.
Improving website performance and user experience.
Preventing fraud, misuse, unauthorized access, and unlawful activity.
Meeting legal obligations and resolving disputes.
We will not knowingly use personal data for a materially different purpose without an appropriate legal basis and any notice or consent required by law.
6. Lawful Bases for Processing
Under Article 6 of the GDPR, personal data must be processed on an applicable lawful basis. Depending on the specific activity, Commailer may rely on one or more of the following:
6.1 Consent
We may rely on consent where an individual has freely agreed to a clearly explained purpose, such as certain non-essential cookies or direct marketing where consent is required.
Consent can be withdrawn at any time. Withdrawal does not make processing carried out lawfully before withdrawal unlawful.
6.2 Contractual Necessity
Processing may be necessary to provide a service requested by an individual or business, take steps before entering into a contract, or administer an existing service agreement.
6.3 Legitimate Interests
We may process certain information for legitimate business purposes, such as website security, service administration, fraud prevention, or responding to relevant business communications, where those interests are not overridden by an individual's rights and freedoms.
Where required, we assess the necessity and proportionality of the processing.
6.4 Legal Obligations
We may process or retain information where necessary to comply with applicable legal, accounting, tax, regulatory, or lawful recordkeeping obligations.
The lawful basis used will depend on the particular processing activity. We will not treat every processing activity as relying on the same legal basis.
7. Email Marketing and Campaign Data
Commailer may provide email campaign creation, management, strategy, or deliverability guidance to business customers.
Where these services involve personal data about recipients, the customer is generally responsible for ensuring that the recipient information was collected lawfully and that a valid legal basis exists for the intended use.
Customers must, where applicable:
Provide appropriate privacy information to recipients.
Obtain consent where legally required.
Use accurate sender identification.
Ensure campaign content is lawful and not deceptive.
Provide a valid and effective unsubscribe mechanism where required.
Honor objections and opt-out requests.
Maintain suppression lists to prevent further marketing where appropriate.
Avoid unlawful scraping, harvesting, or use of recipient information.
Commailer will not knowingly support phishing, unlawful unsolicited bulk email, impersonation, or campaigns intended to evade privacy or anti-spam requirements.
Where Commailer processes recipient data solely on a customer's behalf, the customer's instructions and the applicable data processing agreement will govern the permitted processing.
8. Data Controller and Data Processor Responsibilities
Where applicable, the GDPR distinguishes between a controller and a processor.
Data controller: Determines the purposes and essential means of processing personal data.
Data processor: Processes personal data on behalf of a controller and follows the controller's documented instructions.
When acting as a processor, Commailer will, where required by Article 28 GDPR and the applicable agreement:
Process personal data only on documented instructions.
Ensure authorized personnel are subject to appropriate confidentiality obligations.
Implement appropriate security measures.
Assist the controller with relevant data subject requests, taking account of the nature of processing.
Provide reasonable assistance with security incidents, data protection impact assessments, and regulatory consultations where required.
Delete or return personal data at the end of the service, as specified by the agreement, unless applicable law requires retention.
Make information available to demonstrate compliance with applicable processor obligations.
Notify the controller of relevant personal data breaches without undue delay as required by law and contract.
Use subprocessors only under the applicable authorization and contractual safeguards.
The exact responsibilities will be documented in a separate data processing agreement when required.
9. Data Sharing and Recipients
We may share personal data only where reasonably necessary, lawful, and consistent with the relevant purpose. Depending on our actual operations, recipients may include:
Website hosting and infrastructure providers.
Business email and communications providers.
Technical support and security service providers.
Payment processors, if applicable.
Analytics or cookie service providers, if used and permitted.
Professional advisers and auditors.
Authorities or other recipients where disclosure is legally required.
Business successors in connection with a lawful restructuring or transfer.
We do not sell personal data for monetary consideration. Any sharing, sale, or targeted advertising activity must be assessed according to the actual practices and applicable laws.
We will not claim that a particular provider receives personal data unless that provider is actually used.
10. International Data Transfers
Commailer is based in India, and certain service providers or business customers may be located in other countries. Depending on the services used, personal data may be transferred to or accessed from outside the European Economic Area or the United Kingdom.
Where GDPR or UK GDPR transfer restrictions apply, we will use an appropriate legal transfer mechanism where required. Depending on the circumstances, this may include an adequacy decision, approved Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another permitted safeguard.
We will consider the nature of the data, destination country, applicable legal requirements, and any supplementary safeguards needed for the transfer.
Individuals may contact us to request further information about relevant transfer safeguards, subject to lawful restrictions.
11. Data Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, subject to legal obligations and contractual requirements.
Retention periods may depend on:
The type and sensitivity of the information.
The duration of a service or customer relationship.
Applicable accounting, tax, or legal recordkeeping requirements.
Security and fraud-prevention needs.
The resolution of disputes or legal claims.
Instructions from a customer when Commailer acts as a processor.
When information is no longer needed, we will take reasonable steps to delete it, anonymize it, or securely dispose of it, unless continued retention is legally required or otherwise permitted.
Where Commailer acts as a processor, the applicable customer agreement will govern deletion or return of data at the end of the engagement, subject to legal retention obligations.
12. Data Security
Commailer aims to implement technical and organizational measures appropriate to the risks associated with personal data processing.
Depending on the systems and services actually used, these measures may include:
Access controls and restricted permissions.
Appropriate account and credential management.
Software updates and security maintenance.
Secure transmission methods where available.
System monitoring and security logs.
Backup and recovery arrangements where appropriate.
Confidentiality obligations for authorized personnel.
Appropriate assessment of service providers.
No website, email system, or internet transmission method can be guaranteed completely secure. We cannot promise absolute security, but we aim to take reasonable measures to protect information from unauthorized access, alteration, loss, or disclosure.
13. Personal Data Breaches
A personal data breach may involve accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.
If a breach occurs, we will assess the incident and take appropriate steps to contain, investigate, and mitigate its effects.
Where GDPR or UK GDPR requirements apply, we will notify the relevant supervisory authority within the legally required timeframe when the breach is reportable. Where required, affected individuals will also be informed without undue delay.
When acting as a processor, Commailer will notify the relevant controller without undue delay in accordance with applicable law and the service agreement.
14. Your Rights Under the GDPR
Where the GDPR or UK GDPR applies, individuals may have the following rights, subject to the applicable legal conditions and exceptions.
14.1 Right of Access
You may request confirmation of whether we process your personal data and, where applicable, receive access to that data and relevant information about the processing.
14.2 Right to Rectification
You may request correction of inaccurate personal data or completion of incomplete data.
14.3 Right to Erasure
You may request deletion of personal data in certain circumstances, including where the data is no longer necessary for its original purpose or where consent has been withdrawn and no other lawful basis applies.
This right is not absolute. We may retain information where permitted or required by law.
14.4 Right to Restrict Processing
You may request restriction of processing in certain circumstances, such as while the accuracy of information is being contested or an objection is being assessed.
14.5 Right to Data Portability
Where the legal requirements are met, you may request personal data you provided to us in a structured, commonly used, machine-readable format and request its transmission to another controller where technically feasible.
This right applies only to specified categories of processing and does not apply to all information.
14.6 Right to Object
You may object to processing based on legitimate interests where the relevant legal conditions apply.
You have an absolute right to object to processing of your personal data for direct marketing, including related profiling, where the GDPR applies.
14.7 Right to Withdraw Consent
Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before consent was withdrawn.
14.8 Rights Relating to Automated Decisions
Where applicable, you may have rights relating to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.
Commailer will assess any such processing according to the applicable legal requirements. We do not claim that such automated decision-making occurs unless it is actually used.
15. How to Exercise Your Rights
To make a data protection request, contact:
Email: support@commailer.store
Business: Commailer
Address: NO315, Bauri Para, Mangalpur, Raniganj, Paschim Bardhaman, West Bengal 713347, India.
Please describe your request clearly and provide enough information for us to locate the relevant data. We may request reasonable additional information to verify your identity and protect personal data against unauthorized disclosure.
We will respond within the time limits required by applicable law. Under the GDPR, this is generally within one month, subject to permitted extensions for complex or numerous requests. If an extension is needed, we will provide the required notice.
Requests will be handled without charge unless applicable law permits a reasonable fee or refusal in exceptional circumstances.
If we process your information only on behalf of a business customer, we may refer your request to that customer or assist the customer in responding, as required by our role and applicable law.
16. Complaints to a Supervisory Authority
If you believe our processing of your personal data violates applicable data protection law, you may contact us so we can review your concern.
Where the GDPR or UK GDPR applies, you also have the right to lodge a complaint with the competent data protection supervisory authority, particularly in the EU or UK country where you live, work, or believe an infringement occurred.
You do not have to contact us first before lodging a complaint where applicable law gives you the right to complain directly to an authority.
17. Cookies and Online Tracking
Our website may use essential cookies or similar technologies required for basic functionality and security. Other cookies, such as analytics or advertising cookies, will be used only if actually deployed and in accordance with applicable consent requirements.
Where required, we will provide clear cookie information and a mechanism to accept, reject, or manage non-essential cookies.
Please review our separate Cookie Policy for information about the technologies actually used on the website and how preferences can be managed.
18. Children's Data
Our website and business services are intended primarily for business users and are not directed at children.
We do not knowingly collect children's personal data in circumstances where doing so would violate applicable law. If you believe a child has provided personal data to us inappropriately, contact us so we can review the situation and take appropriate action.
19. Third-Party Websites and Platforms
Our website may link to third-party websites or services. Those services operate under their own privacy policies and practices.
Commailer does not control independent third-party websites and is not responsible for their data protection practices. Please review the relevant provider's privacy information before sharing personal data with it.
20. Updates to This Policy
We may update this policy to reflect changes to our services, data processing practices, technology, or legal obligations.
The updated version will be published on this page with a revised “Last Updated” date. Where required, we will provide additional notice or obtain consent before introducing new processing that requires it.
21. Contact Us
For questions about this policy, personal data processing, or GDPR rights, please contact:
Commailer
Website: https://commailer.store
Email: support@commailer.store
Address: NO315, Bauri Para, Mangalpur, Raniganj, Paschim Bardhaman, West Bengal 713347, India.
We will review privacy inquiries and respond in accordance with applicable law.
Important information: This policy is a general template, not legal advice or a guarantee of GDPR compliance. Before publishing, verify your actual website forms, hosting logs, email platforms, analytics, cookies, tracking tools, retention periods, and data-sharing arrangements. If you regularly offer services to people in the EU or UK and GDPR applies to you, assess whether you must appoint an EU or UK representative, maintain records of processing, or take other specific compliance measures.