Informativa privacy

1. Controller and contacts

The controller is [LEGAL NAME OF THE OPERATOR], [ADDRESS], [NIPT / P.IVA], e-mail support@preventiv.app.

Data protection officer: [NAME AND CONTACTS, if appointed].

Representative in the European Union (GDPR art. 27): [NAME AND CONTACTS, if required]. Representative in Albania (Law 124/2024): [NAME AND CONTACTS, if required].

[[REVIEW: R-16 Whether a DPO is required, and whether an EU representative (GDPR art. 27) or an Albanian representative (Law 124/2024) must be appointed, depending on where the operator is established.]]

2. When we are controller and when processor

We are controller for data about our customers and their Users (account, billing, support, security and service communications) and for visitors of this website.

We are processor, on behalf of the business that uses Preventiv, for the personal data that the business enters or collects through the Service: its clients, site contacts, suppliers, subcontractors, website visitors who use its widget and recipients of its documents. For that data the business is the controller: please read its privacy notice and address your requests to it. If you contact us, we will forward your request to the business.

3. Data we process as controller

• Account data: name, e-mail, telephone, language, role, password (managed in hashed form by the authentication service), two-factor settings.
• Company data: company name, NIPT / P.IVA, tax code, address, PEC, SDI code, IBAN, logo.
• Billing data: plan, invoices, payment status; card data is handled by Stripe and never reaches us.
• Usage and security data: log-ins, IP address, browser and device, audit log of actions, error logs, API usage.
• Communications: support requests and e-mails exchanged with us.
• Website data: technical data needed to deliver pages and remember language and display preferences (see the Cookie policy).

4. Purposes and legal bases

• Providing the Service, creating and managing accounts, support: performance of the contract (GDPR art. 6(1)(b)).
• Billing, accounting and tax compliance: legal obligation (art. 6(1)(c)).
• Security, fraud and abuse prevention, audit logs, backups: legitimate interest in protecting the Service and our customers (art. 6(1)(f)).
• Service e-mails (security notices, changes to terms, billing): contract and legitimate interest.
• Product news and marketing e-mails: consent, or for existing customers our legitimate interest in promoting similar services, with an opt-out in every message.
• Defending legal claims: legitimate interest.

Providing account data is necessary to use the Service. We do not use profiling or automated decisions that produce legal effects.

[[REVIEW: R-17 Legal basis for marketing to existing customers (Italian Privacy Code art. 130 para. 4 "soft opt-in"; Albanian rules) and legitimate-interest assessments for security logging.]]

5. Recipients and sub-processors

We share personal data only with providers that help us run the Service, bound by data processing agreements:
- Supabase, Inc.: database, authentication and file storage, hosted in the EU region eu-west-1 (Ireland).
- Vercel Inc.: hosting of the web application, EU region (Dublin, Ireland).
- Stripe Payments Europe, Ltd. (Ireland): payment processing and subscription billing; for some purposes (e.g. fraud prevention) Stripe acts as an independent controller.
- [E-MAIL PROVIDER]: delivery of transactional e-mails, [REGION].
- Cloudflare, Inc.: Turnstile anti-abuse check on widget forms.
- OpenStreetMap Foundation (United Kingdom): Nominatim geocoding of project addresses and map tiles shown on project maps.
- Anthropic, PBC (United States): only when the business has enabled AI assistance; the text submitted for the function is processed to return the result.
- Web push services of browser vendors: only for users who enable push notifications; content is end-to-end encrypted.

We may also disclose data to authorities when required by law, and to professional advisers bound by confidentiality. The up-to-date list of sub-processors is kept in the Data processing agreement.

6. International transfers

Customer and account data is stored in the European Union. Some providers listed above are established in, or may access data from, third countries (for example the United States or the United Kingdom). In these cases transfers rely on an adequacy decision (for example the EU-US Data Privacy Framework for certified companies, or the decision on the United Kingdom) or on the European Commission's Standard Contractual Clauses (Decision 2021/914) with additional safeguards where needed.

Transfers from Albania to the EU and to other countries take place in accordance with Law 124/2024.

[[REVIEW: R-18 Transfer mechanisms between the EU and Albania (Albania has no EU adequacy decision): if the operator or staff with access are in Albania, SCCs module 2 or 3 are needed; check the adequacy list of the Albanian Commissioner for transfers out of Albania.]]

7. Retention

• Account and company data: for the duration of the contract, then deleted 30 days after the account is closed.
• Invoices and accounting records: 10 years, as required by Italian civil code art. 2220 and Albanian accounting law.
• Security and access logs: [12 months].
• Audit log of actions inside a company: for the life of the company account.
• Support requests: [24 months] after closure of the request.
• Backups: overwritten on a rolling cycle of up to [NUMBER] days; deleted data disappears from them at the end of the cycle.

Data processed for a business as processor is kept according to that business's instructions and deleted at the end of the contract as described in the Data processing agreement.

[[REVIEW: R-19 Confirm each retention period, in particular log retention and the accounting retention period in Albania.]]

8. Security

We protect data with encryption in transit (HTTPS) and at rest, row-level access control isolating each company, two-factor authentication, role-based permissions, audit logs, signed links for files and shared documents, rate limiting and regular backups. Access by our staff is limited to what is needed to operate and support the Service.

In case of a personal data breach we notify the competent authority within 72 hours where required and, where the risk is high, the persons concerned.

9. Your rights

You have the right to access your data, to rectify it, to erase it, to restrict or object to processing, to data portability and to withdraw consent at any time without affecting earlier processing. Account owners can export company data and request deletion directly from Settings, Privacy. Other requests: support@preventiv.app. We answer within one month.

You may lodge a complaint with a supervisory authority, in particular in the country where you live or work:
- Italy: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it.
- Albania: Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale (IDP), Rr. Abdi Toptani, Nd. 5, 1001 Tirana, www.idp.al.

10. Cookies and similar technologies

We use only technical cookies and local storage that are strictly necessary for signing in, security, language and display preferences. We do not use analytics or advertising cookies. Details are in the Cookie policy.

11. AI assistance

AI assistance is optional and switched on per business. When used, the text that the user submits (for example a work description to turn into estimate lines, or a text to translate) is sent to the AI provider to produce a suggestion. Suggestions are always reviewed and confirmed by the user. Under the provider's commercial terms submitted data is not used to train its models.

[[REVIEW: R-20 AI assistance: contractual guarantees from the AI provider (no training, retention, region), transfer to the United States, and transparency duties under the EU AI Act (Regulation 2024/1689).]]

12. Minors

The Service is intended for businesses and professionals and is not directed at children. We do not knowingly collect data of persons under 16.

13. Changes to this policy

We may update this policy. The version and date of the last update are shown at the top; material changes are notified to account owners by e-mail or in the application.