Personal Data Processing Policy

Pursuant to articles 13 and 14 of EU Reg. 2016/679 (GDPR) — Last updated: October 2026

1. Data Controller

The data controller is NetSasa di Gianpiero Macrì, VAT number IT08801610018, reachable at info@spolu.it.

2. What data we process and why

  • Account — name, email and password (stored only in encrypted form). Used to create and manage the account and to send you service emails. Legal basis: performance of a contract (art. 6(1)(b) GDPR).
  • Company data — company name, VAT number, address, website, sector, processes, certifications and the link between account and company. Used to show the profile to other registered companies, to verify who represents the company and to compute matches. Legal basis: performance of a contract.
  • Subscriptions and invoicing — payments are handled by Stripe: we do not receive or store card details, only the subscription status and the data needed for invoicing. Legal basis: contract and tax obligations (art. 6(1)(c)).
  • Informational emails — we may write to you about new Spolu features and services similar to those you use. Legal basis: legitimate interest (art. 6(1)(f) GDPR and art. 130(4) of the Italian Privacy Code). You can object at any time, including via the link in every email.
  • Technical and security data — server logs (IP address, date and time, requested pages, errors). Used to protect the service from abuse and to fix malfunctions. Legal basis: legitimate interest.
  • Browsing statistics — only if you accept it in the cookie banner, we use Google Analytics on the site's public pages. Legal basis: consent (art. 6(1)(a)), which you can withdraw at any time via "Cookie settings" at the bottom of the page. Details in the Cookie Policy.

3. Companies added from public sources

To make the network useful from the start, Spolu also contains company profiles taken from publicly accessible industry directories. We only collect business data: company name, address, sector and website. This is normally business data, but for sole proprietorships the company name may include the owner's name. Legal basis: legitimate interest in letting companies in the same supply chain find each other (art. 6(1)(f)).

Any company can claim its profile, ask for it to be corrected, or object and ask for its removal by writing to info@spolu.it: in that case the profile is deleted and the company is not added again.

4. Who we share data with

We do not sell or hand over data to third parties. The company profile is visible to other registered companies, as the service requires. Otherwise, data is processed on our behalf and only for the stated purposes by these providers (data processors):

  • Microsoft Azure — hosting of the website and database, in data centers in the European Union.
  • Brevo (France) — email delivery.
  • Stripe — payment processing.
  • Google — browsing statistics (Google Analytics), only with your consent.
  • OpenStreetMap (Nominatim) — conversion of company addresses into geographic coordinates; it receives only the business address.

Data may also be disclosed to authorities when required by law. Stripe and Google may transfer data to the United States: such transfers are covered by the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. Nominatim operates in the United Kingdom, which the European Commission recognises as adequate.

5. How long we keep data

  • Account and company data: as long as the account is active; after closure they are deleted within 30 days.
  • Invoicing data: 10 years, as required by Italian law (art. 2220 of the Civil Code).
  • Technical logs: 90 days.
  • Google Analytics statistics: 14 months.
  • Companies added from public sources: as long as they are useful to the service or until removal is requested; in that case we keep only what is needed not to add them again.

6. Your rights

Under articles 15–22 of the GDPR you can request access to your data, rectification, erasure, restriction of processing and portability; you can object to processing based on legitimate interest and withdraw any consent at any time. Write to info@spolu.it: we reply within 30 days.

You can also lodge a complaint with the Italian Data Protection Authority: www.garanteprivacy.it.

7. Cookies and updates

The use of cookies is described in the Cookie Policy. This policy may be updated: the date of the last change is shown at the top of the page, and important changes are notified by email to registered users.