Notice on the processing of personal data

1. Who processes the data

The data controller is Orlando Engineering and Consulting, Via Antonio Pacinotti 17, 20094 Corsico (MI), Italy, VAT number 12625200964. For any matter concerning personal data, write to techsupport@orlandoeandc.com.

No data protection officer has been appointed, the conditions required by law not being met.

2. Two different roles, worth telling apart from the start

Easy Nonconformity is software that companies use to manage non-conformities, complaints and quality events. Two distinct relationships coexist on this surface.

As regards the data of those who sign in — name, email address, settings — the controller is Orlando Engineering and Consulting.

As regards the content entered into the service — issues, content added over time, attachments — the controller is the client company that enters it, and Orlando Engineering and Consulting acts as a data processor under art. 28 GDPR, on the basis of the contract signed with that company.

The distinction has a practical consequence: if data concerning you has ended up inside an issue, the party to address in order to exercise your rights is the company that entered it. We assist them, but we cannot decide in their place.

3. What data we process

Data of those who use the service. Name, email address, preferred language, organisation, account status, date of creation and of last change. If the second authentication factor is enabled, the data needed to verify it and the recovery codes. We record the outcome of service messages — delivered, bounced — so that we can tell why a message did not arrive.

Company data. Company name, sector, email address, tax code (codice fiscale), VAT number, country. For a sole trader the tax code is personal data, and we treat it as such.

Content entered by users. The text of issues, the content added over time and the attached files. This content is free-form: it may contain names of people, assessments of suppliers, photographs. It is the category to which the relationship described in point 2 applies.

We do not process special categories of data for our own purposes, we do not profile anyone, and we do not take automated decisions producing effects on people.

4. Why we process it, and on what legal basis

• To provide the service — creating accounts, signing people in, storing and displaying issues: performance of the contract (art. 6(1)(b) GDPR).
• For the security of access — second factor, device recognition, session tracking: legitimate interest in protecting the service and the data it holds (art. 6(1)(f)).
• For service messages — invitations, password resets, digests: performance of the contract. They are not marketing messages and cannot be turned off, because they are what makes the service work.
• For legal, tax and accounting obligations: legal obligation (art. 6(1)(c)).

5. Cookies and tracking

Inside the application there is no tracking at all. No profiling cookies, no third-party analytics tool, no advertising pixel or SDK. The token that keeps the session open is held in the browser’s local storage and is sent to no one other than our own server.

On the public presentation page — the site’s main address, the one that opens without signing in — we use Google Analytics to know how many people visit it. It processes a device identifier and the IP address, and writes cookies to the browser.

That service starts only after it has been accepted: on the first visit a notice appears with two equivalent choices, accept or refuse. Until it is accepted no request is sent to Google and no cookie is written. The legal basis is consent (art. 6(1)(a) GDPR), which can be withdrawn at any time from the control at the foot of that page: on withdrawal, the cookies already written are deleted.

The mobile application requires a single system permission on Android — network access — and on iOS access to the camera, requested only at the moment one chooses to attach a photograph. It contains no analytics tools.

6. Who else processes it, and where it is held

We rely on Amazon Web Services for the infrastructure, in the eu-west-1 (Ireland) region: the application server, the storage of attached files and the sending of service email. AWS acts as a sub-processor.

The data stays within the European Economic Area: there is no transfer to third countries.

We do not sell, transfer or disclose personal data to third parties for marketing purposes.

7. How long we keep it

Account data is kept for the whole duration of the relationship and thereafter for 24 months.

Content entered by companies is kept while the contract is in force; on termination we proceed as provided by the contract itself: ** return within 30 days** of the end of the contract and deletion within 60.

Data processed to comply with a legal obligation is kept for as long as the law requires.

8. How it is protected

Traffic between your devices and our servers is encrypted. Access to data is governed by a role system on three levels, so that each person sees what pertains to them. A second authentication factor is available, and an organisation can make it mandatory for its own users. Deletions are logical, which makes it possible to remedy a mistake without losing the rest.

9. Your rights

You may request access to your data, its rectification, erasure, restriction of processing, portability, and you may object to processing based on legitimate interest (arts. 15-22 GDPR). Requests are sent to the address given in point 1 and you receive an answer within one month.

If you believe the processing infringes the Regulation, you may lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali).

If your request concerns data held inside an issue, we forward it to the company that is the controller and assist them in following it up — see point 2.

10. Changes to this notice

If the way we process data changes, this page changes too, and the date at the top says so. Substantial changes are notified to data subjects through the service.