Privacy policy
Last updated: 26/10/2026
How Digital Dept processes the personal data of people who visit limepanel.it, buy a license or use the LimePanel software.
This is a translation of the Italian text; the Italian version prevails in case of discrepancy.
Information provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR").
1. Controller
Digital Dept S.r.l.s., owner of the LimePanel brand, registered office at S.P. 350, 26 - 73057 Taviano (LE), Italy, VAT number IT04884840754. Privacy contact: privacy@digitaldept.it. General enquiries: info@limepanel.it.
Digital Dept has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR are not met. For any matter concerning personal data, write to privacy@digitaldept.it.
2. What data we process
| Category | Data | Source |
|---|---|---|
| Customer and billing data | name or company name, VAT number or tax code, address, e-invoicing recipient code or PEC, email, order and payment details | the customer, at purchase and in the customer area |
| Payment data | card type, last digits, payment outcomes (full card data is processed only by Stripe) | Stripe |
| Customer area account | email, sign-ins (date, time, IP) | the customer |
| License server data | installation identifier, hashed machine fingerprint, public IP address, panel host name, panel version, operating system, number of hosting accounts, administrator email when the trial starts, call log (date, outcome, IP) | the LimePanel software installed on the server |
| Optional anonymous statistics | web server, PHP and database versions, number of domains and mailboxes, days of uptime, server cores and memory | the software, only if the administrator turns them on |
| Support | ticket content, attachments, email and name of the sender | the customer |
| Contact form | name, email, message | whoever fills in the form |
| AI assistant | technical data of the request and the question written by the user, in transit; log of date, user, type of feature, amount of data processed and cost | the LimePanel software, only when the user uses the assistant |
| Technical browsing data | IP address, date and time, requested page, browser | the web server's technical logs |
We do not process the data hosted on our customers' servers (sites, mail, databases, their own customers' data): the LimePanel software runs on the customer's server and does not send that data to Digital Dept, with the sole exception of the data sent by the AI assistant at the user's request. For the data the panel processes on the customer's server on behalf of the customer's own end users, the controller is the customer, as owner of the server; Digital Dept acts as a processor (Article 28 GDPR) only for the transit of that data to the artificial intelligence service provider.
AI assistant. When the user uses the assistant, the panel sends to the artificial intelligence service provider (Anthropic, PBC, USA, transfer based on standard contractual clauses) the technical data needed for the request: domain names, software versions, error log lines, excerpts of files flagged as malicious, public DNS records, and the question written by the user. Before sending, the panel automatically removes passwords, keys and tokens, email addresses (only the domain is kept), visitors' IP addresses, payment card and phone numbers, IBANs and tax codes. The text of requests and answers is not stored on our servers; we only log the date, user, type of feature, amount of data processed and cost, for security, spending control and audit purposes, for 12 months. The daily summary for server administrators is kept for 7 days. Legal basis: performance of the contract (a feature requested by the user). The customer may at any time ask for the assistant to be disabled for their account; a reseller can disable it for themselves and for all their customers.
3. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Concluding and performing the contract: order, license, customer area, renewals | performance of a contract (Article 6(1)(b) GDPR) |
| Verifying the license, applying plan limits, managing trials and IP moves | performance of a contract (Article 6(1)(b)) |
| Preventing free-trial abuse and fraud | legitimate interest in protecting the service (Article 6(1)(f)) |
| Invoicing and tax and accounting obligations | legal obligation (Article 6(1)(c)) |
| Answering support requests and the contact form | performance of a contract or pre-contractual steps (Article 6(1)(b)) |
| Service messages (activation, expiry, payments, security) | performance of a contract (Article 6(1)(b)) |
| AI assistant: sending the request to the artificial intelligence service provider | performance of a contract, a feature requested by the user (Article 6(1)(b)) |
| AI assistant: usage log for security, spending control and audit | legitimate interest (Article 6(1)(f)) |
| Anonymous usage statistics | the administrator's consent, which can be withdrawn at any time (Article 6(1)(a)) |
| Security of the website and the license server | legitimate interest (Article 6(1)(f)) |
| Defending our rights in a dispute | legitimate interest (Article 6(1)(f)) |
Marketing. We do not send promotional messages without your explicit consent. If you give it, you can withdraw it at any time through the link in every message or by writing to privacy@digitaldept.it.
Providing contract and billing data is necessary to buy: without it we cannot conclude the contract or issue an invoice.
The free-trial anti-abuse rules (for example one trial per email, per VAT number and per server) run automatically, but they produce no legal effects and do not significantly affect the person: anyone who cannot start a trial can still buy a license or contact us.
4. Who we share data with
Data is processed by authorized Digital Dept staff and by these suppliers, appointed as processors (Article 28 GDPR), except as stated for Stripe:
| Supplier | Service | Location |
|---|---|---|
| Hetzner Online GmbH | hosting of the website, the license server and our mail servers | Germany (EU) |
| Stripe Payments Europe Ltd. | payments and subscription management | Ireland (EU), with possible transfers to the United States |
| Invoicetronic, the intermediary used by our e-invoicing platform Fluxia | transmission of electronic invoices to the Exchange System (SdI) | Italy (EU) |
| Anthropic, PBC | processing of requests to the panel's AI assistant | United States, with transfer based on standard contractual clauses |
Fluxia is Digital Dept's own e-invoicing platform: invoices are issued by us and transmitted to the Exchange System through Invoicetronic. Transactional emails (confirmations, license keys, expiry notices, payments) are sent from our own mail servers, located in the European Union.
Stripe processes payment data as a processor on our behalf and, for some purposes of its own (fraud prevention, compliance with regulatory and financial obligations), as an independent controller, under its own privacy notice available at stripe.com/privacy.
Invoices are transmitted to the Italian Revenue Agency through the Exchange System (SdI), which processes them as an independent controller under a legal obligation. Data may also be disclosed to tax and legal advisers bound by confidentiality, and to authorities where the law requires it.
5. Transfers outside the European Union
Our servers are in Germany. A transfer to a third country can only occur:
- through Stripe, which relies on the EU-US adequacy decision (Data Privacy Framework) or on the standard contractual clauses approved by the European Commission;
- to Anthropic, PBC (United States), for requests to the AI assistant, on the basis of the standard contractual clauses approved by the European Commission, and only after the automatic removal of personal data described in section 2.
6. How long we keep data
| Data | Retention |
|---|---|
| Tax and accounting records (invoices, orders, payments) | 10 years from issue, as required by law |
| License server events (call log) | 24 months |
| Support tickets and contact form messages | 36 months from the last reply |
| Customer area accounts and licenses | for the duration of the relationship; then anonymized, except data that must be kept for tax purposes |
| Anonymous statistics | not personal data |
| AI assistant: log of date, user, type of feature, amount of data processed and cost | 12 months |
| AI assistant: daily summary for server administrators | 7 days |
| AI assistant: text of requests and answers | not stored on our servers |
| Technical access logs of the website and servers | 30 days |
When you ask for deletion we anonymize the account, keeping only tax data for the mandatory period.
7. Your rights
You may at any time exercise the rights under Articles 15-22 GDPR: access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, and withdrawal of consent, without affecting processing carried out before withdrawal.
From the customer area you can download your data and request deletion of your account. For any other request write to privacy@digitaldept.it. We reply within one month.
You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the country where you live or work.
8. Cookies and tracking
The website uses only technical cookies and no third-party tracking tools: no external analytics, advertising or profiling. Details are in the Cookie policy.
9. Security
We apply appropriate technical and organizational measures: encrypted connections, access to the back office restricted to staff with two-factor authentication, access and activation keys stored only in encrypted or hashed form, encrypted backups.
10. Changes
We may update this policy. Material changes are notified to customers by email and published on this page with the date of the update.