Privacy Policy

1. Who the controller is

The controller of the data described in this policy is CIRCULARWARE S.R.L., with its registered office at Via dell'Ospedale 16, 12062 Cherasco (CN), Italia, VAT no. 04067220048.

For any request about your personal data, write to info@circularware.it or to the PEC address (Italian registered email) circularwaresrl@pro-pec.it.

We have not appointed a data protection officer (DPO). [[TO BE VERIFIED: Art. 37 GDPR, item 16]]

2. Who this policy is for

This policy covers:

• people who visit the public website and those who take the free test;
• people who sign up, accept an invitation or work on SCDD for a company or for a consultancy firm;
• people who receive an invitation by email;
• people who enter billing details and pay for a plan.

It does not cover the personal data that companies upload to SCDD for their own activity, such as documents with their workers' data: for those the controller is the company, which must inform the people concerned, and we process the data on its behalf (section 4).

3. Which data we process

We process this data:

• account data: first name, last name, email address, chosen language, date and version of the terms accepted, date of the specific approval of the clauses, date of first sign-in, the help boxes you closed, the companies you belong to with your role and, for security, failed sign-in attempts. Of the password we only keep a hash that cannot be converted back into the password;
• company data: company name, country, VAT number or tax identifier, number of employees, production sites with their address and answers to the questions about the company. If the company is a sole proprietorship, this is also your data;
• the campaign you signed up from: if the link you used contained the parameters of a campaign (utm_source, utm_medium, utm_campaign), we save them with the company data when you sign up. We save nothing else about the path you took on the website;
• what you do in the company's area: who uploaded a document, submitted a self-assessment, answered a question, created a question or a checklist, archived a checklist or requested it from a supplier, granted a share or a delegation, wrote a justification or closed an action, and when; the improvement plan actions you are responsible for;
• the content of the dossier and of production capacity, when it contains data about you;
• invitations, delegations and sharing: the email address of the person invited and who invited them, the companies linked as clients, suppliers or consultancy firms, and the access log of shared dossiers, which says which person at a client, by first and last name, opened a dossier or the result of a checklist, or downloaded a file or a report, and when;
• billing and payment data: company name, VAT number, tax code, recipient code or PEC address (Italian registered email), registered address, the email of the person paying, the plan chosen, the subscription status and, for each payment, net amount, VAT, total and a copy of the billing details at that moment. Card details do not pass through us: Stripe handles them;
• visits to the public website, only as counts aggregated by day: the page viewed, the language, the domain of the site you come from (not the full address) and, if the link contains them, the campaign parameters (utm_source, utm_medium, utm_campaign). We do not store IP addresses or other identifiers and we do not use cookies: we cannot recognise you from one visit to the next. For the free test we only count that it was completed;
• the IP address, to limit repeated attempts on the sign-in, sign-up and free test forms: we use it in memory for one minute, without saving it. It may appear in the server's technical logs [[TO BE COMPLETED with the Aruba server configuration: which logs and for how long]];
• the emails you write to us, for example to ask for support.

The answers to the free test on the website are not saved.

4. Data that companies upload for their own activity

Companies upload other people's data to SCDD: above all the documents required by the framework with data of their workers (payslips, ID documents and work permits, medical check-ups, contracts, attendance records, disciplinary measures, complaint logs), but also names of people in other documents, in notes, in orders and in answers to checklists.

For this data the controller is the company that uploads it. We are the processor: we process it only on its behalf and following its instructions, to store it and show it to whoever the company authorises, as provided in the Data Processing Agreement. To exercise your rights over this data, contact the company; if you write to us, we forward your request to it.

Files of document types containing workers' personal data are never shown to the company's clients, who see only their existence, status and dates. They are seen by the company's people and by those of the consultancy firms to which the company has given a delegation.

Uploading them is not mandatory: for these documents the company may declare that it has them and show them only during an audit, which is the choice SCDD suggests.

5. Why we process it and on what legal basis

We process data for these purposes:

• creating and managing the account and providing the service, including service emails such as address confirmation and new password: to perform the contract with you, if you are the customer (for example a sole proprietorship), or for the legitimate interest of ours and of the company you work for in performing the contract with it;
• sending an invitation that a company has addressed to you and recognising you if you accept it: legitimate interest of the inviting company and of ours in making invitations work. Your address is used only for this;
• showing a company which of its clients opened its shared dossier or the result of a checklist: legitimate interest of the company in knowing who sees its data and of ours in making sharing secure;
• handling payments and invoices and meeting tax and accounting obligations: performance of the contract and legal obligation;
• protecting the service from abuse and unauthorised access and fixing technical problems: legitimate interest;
• understanding how many people visit the public website and where they come from, with aggregated counts that identify no one, and which campaigns bring new sign-ups, by saving the campaign of the link you signed up from: legitimate interest;
• defending a right in legal proceedings, if needed: legitimate interest.

We do not sell data, we do not use it for advertising and we do not send you promotional emails.

The data marked as mandatory in the forms is needed to sign up and to pay: without it, we cannot provide you with the service.

6. Where the data comes from

Most of the data is entered by you. Some comes from others:

• your email address, if you are invited, is entered by whoever invites you, together with the name of their company;
• the data of a company created by a consultancy firm is entered by the firm;
• the access log is written by SCDD when a person at a client opens a dossier or the result of a checklist, or downloads a file or a report;
• Stripe tells us the status of payments, subscriptions and invoices.

7. Who we share it with

We share data only in these ways:

• with the people in your company: colleagues see your name, your role and what you did in the company's area;
• with other companies, if the company you work for so decides: a client to which the dossier is shared sees the data it is entitled to; a consultancy firm with a delegation sees what a colleague with the chosen role sees; the load on the production lines is seen only by the clients to which the company chooses to show it, as a weekly percentage and with the reason for justified overloads, without orders, client names or notes. The company that shares the dossier sees the first and last name of the client's people who open it;
• with providers that help us run the service, as processors: Aruba S.p.A. for the servers SCDD runs on, Microsoft (Azure) for the archive of uploaded files, Twilio SendGrid for sending emails and Stripe for payments. Stripe receives the company name, registered address, VAT number and the email of the person paying, in addition to the data you enter on its pages. For some processing, such as fraud prevention and anti-money-laundering obligations, Stripe is an independent controller: the rules are in its privacy policy;
• with the accountant who issues the electronic invoices, who receives each month the list of payments with billing details [[TO BE DECIDED: as processor or as independent controller, item 14]];
• with the CircularWare people who run the service, who are authorised and bound by confidentiality: whoever administers the platform sees payments, billing details and aggregated statistics, not companies' dossiers;
• with authorities, when required by law.

8. Transfers outside the European Economic Area

Twilio SendGrid is part of Twilio Inc., in the United States: service emails (address, subject and text) pass through its servers in the United States. The transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework and on the standard contractual clauses of the agreement with Twilio. [[TO BE VERIFIED: Twilio's participation in the Data Privacy Framework and the clauses in its DPA]]

Stripe provides us with the service through Stripe Payments Europe, Limited, in Ireland; some data may be processed by Stripe, Inc. in the United States, with the same safeguards. [[TO BE VERIFIED in Stripe's DPA]]

SCDD data is stored on servers of Aruba S.p.A., in a data centre in [[TO BE CONFIRMED: location of the data centre; if it were outside the EEA, the Chapter V safeguards would be required]]; the files uploaded to the dossier on Microsoft Azure, in a data centre in the region [[TO BE CONFIRMED: Azure region, in the EEA; check in Microsoft's DPA the safeguards for any access from the United States]].

SCDD is also available to companies in Albania, Tunisia and Turkey: if your company works with them, what it decides to show, including the names in the access log, reaches those countries.

9. How long we keep it

We keep data for these periods [[TO BE DECIDED: proposals, item 13]]:

• account data: as long as the account exists; after closure we delete it within 30 days. We keep for 10 years only the email address with the date and version of the terms accepted, as proof of the contract;
• company data and dossier content: for the duration of the contract, then as set out in section 19 of the terms (30 days to ask for a copy, deletion within the following 30 days);
• invitations not accepted: 90 days from expiry or revocation;
• access log of shared dossiers and checklists: 24 months from the access;
• registration campaign: as long as the company exists;
• billing and payment data: 10 years from the last payment, as required by tax and civil law rules;
• support emails: 24 months from the last message;
• server technical logs: [[TO BE COMPLETED with the Aruba server configuration, proposal 90 days]];
• backups: [[TO BE COMPLETED: where they are made (with Aruba or elsewhere), proposal 30 days on a rolling basis]].

Visit counts are not personal data and we keep them for statistics.

If you ask for deletion, we delete the data that we are not required by law to keep.

10. Scores and automated decisions

SCDD automatically calculates a company's scores, bands and audit readiness from the answers and documents the company enters, and shows them to the clients with which it shares the dossier; for a client's checklist, with the rules chosen by that client. They concern the company, not people. We do not make decisions about you: decisions are made by the company and its clients, under their own responsibility. How they are calculated is explained in the guide.

11. Your rights

You can request access to your data, rectification, erasure, restriction of processing and portability, and you can object at any time to processing based on legitimate interest. Write to info@circularware.it: we reply within one month.

For data that a company has uploaded for its own activity, rights are exercised towards the company (section 4).

If you think your rights are not being respected you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of the country where you live or work.

12. How we protect data

The site uses only encrypted connections (HTTPS) and of passwords we only keep a hash. You can only sign in with a confirmed email address, and after 5 wrong attempts sign-in is blocked for 15 minutes.

Each company's data is kept separate from the others', uploaded files are not public and can only be downloaded by authorised people, and clients' access to shared dossiers and checklists is logged.

SCDD emails do not record whether you open them or what you click on.

13. Cookies, statistics and changes

SCDD only uses technical cookies: the details are on the Cookies page. The visit statistics use none and store nothing on your device; the campaign of the link you arrive from also stays only in the page address, until you sign up.

If we change this policy materially, we tell you by email before it takes effect. The version in force is shown at the bottom of the page; the one you accept when signing up is saved with your account.

Version 2026-10-16.