Privacy Policy

Privacy Policy — notice under artt. 13 and 14 GDPR

Table of contents

1. Data controller and contacts

2. Categories of data processed

3. Purposes and legal bases of processing

4. Provision of data and consequences of refusal

5. Processing methods and security measures

6. Storage period

7. Recipients and categories of recipients

8. Transfers of data outside the EU

9. Rights of the Data Subject

10. Automated assistant, automated decision-making and profiling

11. Data breach

12. Amendments to the notice

13. Specific clauses

1. Data controller and contacts

1.1 The Data Controller is Smoves di Francesco Nigro, sole proprietorship, VAT No. 14838460963, with registered office in Viale Bligny 19A, 20136 Milan (MI), Italy (hereinafter, "Controller" or "Smoves").

1.2 Contact email for the exercise of rights and privacy matters: info@smoves.it.

1.3 The Controller has not appointed a Data Protection Officer (DPO), since the requirements of art. 37 GDPR are not met (absence of large-scale processing of special categories of data, systematic monitoring and public authority activities). The appointment may be made in case of changes in operating conditions.

2. Categories of data processed

2.1 Smoves processes, including through automated tools, the following categories of personal data:

• identification and contact data: name, surname, email address, telephone number, data of any representatives or referents in charge of attending Pickup or Redelivery;

• call-back preferences: the time slot in which the Data Subject asks to be called back and the website page the request was made from;

• logistical and operational data relating to the Service: Pickup and Redelivery addresses, floor, presence of a lift and other information on access to the property, geographic coordinates, times, operational instructions, notes entered by the Data Subject;

• administrative, tax and invoicing data: tax code, VAT number, billing address and further data required by applicable law;

• payment and anti-fraud data: metadata relating to transactions, payment identifiers, last digits and expiry date of the registered card, outcome of operations, anti-fraud and risk verification information provided by payment service providers. Smoves does not receive or store the complete card data;

• data relating to the stored Goods: inventory, description, photographs and videos of the Goods and of their packaging at Pickup, in storage and at Redelivery, declared value, anomalies detected;

• Pickup Reports and Redelivery Reports: identification data and handwritten signature of the Data Subject or their representative, reservations and statements recorded therein;

• data relating to use of the Service: history of quotes and bookings, interactions with customer service, complaints, reviews and communications;

• content of chat conversations, including those with the automated assistant referred to in art. 10, and any attachments sent by the Data Subject;

• data relating to telephone calls with Smoves' switchboard: calling and called number, date, time, duration and outcome of the call, and audio recording of the conversation, under the terms set out in point 5.5;

• technical and navigation data: IP address, device ID, browser, operating system, language, date and time of access, referring page and campaign, application logs;

• data relating to consent: date, time, IP address and version of the accepted contractual documents; text, date and source of marketing consents given or withdrawn;

• data deriving from security checks, fraud prevention, operational risk management and judicial protection.

2.2 Smoves does not request and does not intentionally process special categories of personal data (art. 9 GDPR). The Data Subject is invited not to enter such data in communications, in the chat or in the description of the Goods.

2.3 Data of third parties. A Data Subject who communicates to Smoves the data of other persons (for example, a representative for Pickup or Redelivery) warrants that they have been informed and that the Data Subject is entitled to communicate them.

2.4 Smoves reserves the right to carry out checks on the accuracy, completeness and consistency of the data provided by the Data Subject, including through automated controls, where necessary for security, fraud prevention, operational risk management, protection of company assets or prevention of abusive use of the Service.

3. Purposes and legal bases of processing

3.1 Personal data are processed for the following purposes:

• drawing up quotes, conclusion and performance of the contract, operational management of the Service, inventory of the Goods, payments and authorised charges, Customer support (art. 6(1)(b) GDPR);

• telephone call-back at the request of the Data Subject through the website's forms, in the indicated time slot, and calling back those who left their contact details in an incomplete quote, once only and for the sole purpose of assisting them in completing it (art. 6(1)(b) GDPR: pre-contractual measures taken at the request of the Data Subject);

• responding to requests made in chat, including through the automated assistant referred to in art. 10 (art. 6(1)(b) GDPR);

• sending by email of a promotional code requested by the Data Subject through the website, and verification of its use (art. 6(1)(b) GDPR);

• compliance with obligations provided by national and European law, in particular accounting and tax obligations (art. 6(1)(c) GDPR);

• recording of telephone calls, photographic documentation of the Goods, retention of the Reports and of the proof of acceptance, for the purposes of service quality, management of complaints and disputes and protection of the Controller's rights (art. 6(1)(f) GDPR);

• verification of the Data Subject's identity, prevention of fraudulent or abusive use or use contrary to the Terms and Conditions, physical and IT security, debt recovery and defence in court (art. 6(1)(f) GDPR);

• aggregated statistics on the use of the website and on the performance of the Service, quality control and improvement of internal processes (art. 6(1)(f) GDPR);

• invitation to leave a review at the end of the Service, on the website or on third-party platforms such as Google and Trustpilot, to which Smoves does not communicate any data of the Data Subject: it is the Data Subject, if they wish, who publishes the review (art. 6(1)(f) GDPR, subject to opt-out);

• sending of commercial communications relating to services similar to those already purchased by the Data Subject, pursuant to art. 130, paragraph 4, of Italian Legislative Decree 196/2003 ("soft spam"), subject to opt-out, exercisable at any time through the link included in each communication;

• sending of marketing and newsletter communications, subject to optional consent that may be withdrawn at any time through the unsubscribe link included in each communication (art. 6(1)(a) GDPR). Smoves keeps a register of consents given and withdrawn;

• analysis of the browsing experience on the site through measurement tools, heatmaps and recording of the browsing session: in anonymous form, without persistent identifiers or IP address, in the absence of consent (art. 6(1)(f) GDPR, legitimate interest in improving the service); in full form subject to the Data Subject's consent (art. 6(1)(a) GDPR). Modes, data collected and exclusions are described in the Cookie Policy. When the Data Subject submits a contact request form, the anonymous technical identifier of their browsing session is stored together with the contact details provided, for the sole purpose of reconstructing the journey that preceded the request and improving the service (art. 6(1)(f) GDPR); where the Data Subject gives consent, such data is linked to their identity and retained in non-anonymous form, together with the email address, name and telephone number;

• measurement of the results of advertising campaigns and personalisation of advertisements on third-party platforms, subject to the Data Subject's consent (art. 6(1)(a) GDPR): see the Cookie Policy;

• management of extraordinary corporate transactions, due diligence, transfer of business, branches of business or assets (art. 6(1)(f) GDPR).

3.2 Where processing is based on the Controller's legitimate interest, the Data Subject may object at any time pursuant to art. 21 GDPR, by writing to info@smoves.it.

4. Provision of data and consequences of refusal

4.1 The provision of the data necessary for the execution of the contract and for compliance with legal obligations is mandatory: refusal entails the impossibility of concluding the contract or performing the Service.

4.2 The provision of data for promotional purposes and for measurement and advertising tools is optional. Refusal does not affect the use of the Service.

5. Processing methods and security measures

5.1 Processing takes place with electronic tools and, for Pickup Reports and Redelivery Reports, also with paper-based tools, with logic correlated to the purposes.

5.2 Smoves adopts adequate technical and organisational measures, in compliance with art. 32 GDPR, to ensure the confidentiality, integrity and availability of the data (access control, authentication, encryption in transit, periodic backups, internal training).

5.3 Access to data is limited to the Controller and to authorised parties, instructed in compliance with art. 29 GDPR. Operators in charge of Pickup and Redelivery access only the data necessary to perform the task assigned to them.

5.4 Smoves may use automated tools for monitoring, logging, tracking and analysis of accesses and operations performed on company systems, where necessary for security, fraud prevention, technical troubleshooting, audit, judicial protection and continuity of the Service.

5.5 Recording of telephone calls. Incoming and outgoing calls to and from Smoves' switchboard are recorded for the purposes of service quality, internal training, complaint management and protection of the Controller. Callers are informed by a voice message at the start of the call; those called are informed by the operator. A Data Subject who does not wish to be recorded may contact Smoves in writing at info@smoves.it or through the website's chat. The recordings are accessible only to the Controller and to the parties authorised by it.

5.6 Chat conversations and email communications with customer service are archived for the same purposes.

6. Storage period

6.1 Personal data are stored for the time necessary to pursue the purposes indicated in this notice and, in any case, within the limits permitted by applicable law. In particular:

• contractual, administrative and tax data, Pickup Reports and Redelivery Reports, proof of acceptance of the contractual documents: up to 10 years from the termination of the relationship;

• telephone call recordings: up to 6 months from the call, save for further retention of the individual recording necessary for the management of a complaint or dispute;

• chat conversations: up to 24 months from the last message, unless they relate to a contract, in which case they follow the term for contractual data;

• technical logs, security data, anti-fraud systems and operational records: up to 24 months, save for further retention necessary for security or judicial protection;

• inventory, photographs and videos of the Goods: up to 24 months from the conclusion of the Service;

• documentation relating to complaints, disputes, claims or controversies: up to 10 years from the final closure of the controversy;

• data used for marketing purposes: until withdrawal of consent or objection, and in any case for a maximum period of 48 months from the last contact; proof of consent and of withdrawal is kept for the time necessary to demonstrate them;

• data collected through the website's call-back, quote and promotional-code forms: up to 24 months from the request, where no contract follows;

• data relating to anti-fraud checks, security and abnormal use: up to 10 years in cases of defensive or investigative necessity.

6.2 At the end of the storage period, data are deleted or anonymised, subject to further legal obligations.

6.3 The Controller may store the data for a further period in addition to that indicated above where necessary:

• to comply with regulatory obligations;

• to exercise or defend a right in court;

• upon request of competent Authorities;

• in the presence of litigation, investigations or assessments.

7. Recipients and categories of recipients

7.1 The data may be communicated to the following recipients, who process them as data processors pursuant to art. 28 GDPR or, where indicated, as autonomous controllers:

• Stripe Payments Europe Ltd and Stripe, Inc.: management of payments and retention of the Stored Payment Method, as processor for the activities carried out on behalf of Smoves and as autonomous controller for its own legal obligations;

• Supabase Inc.: database and authentication of the reserved area, with data stored on servers located in the European Union (Ireland);

• Vercel Inc.: website hosting and aggregated browsing statistics;

• Resend Inc.: sending of service emails and, where permitted, promotional emails;

• Zadarma (Zadarma OOD, Bulgaria): telephone switchboard, recording and retention of calls;

• Google Ireland Ltd: address autocomplete and distance calculation (Google Maps Platform), measurement of advertising campaigns subject to consent (Google Ads), including through the transmission of the email address and telephone number in encrypted form and of the IP address recorded when the contractual documents were accepted;

• Meta Platforms Ireland Ltd: measurement of advertising campaigns subject to consent, including through the transmission of the email address and telephone number in encrypted form, and WhatsApp messaging when the Data Subject chooses that channel to contact Smoves;

• PostHog Inc.: browsing analysis on a European instance; where consent is given, including the identification and contact data of the Data Subject;

• providers of artificial intelligence models for the chat's automated assistant (Groq Inc., Cerebras Systems Inc., OpenRouter Inc.), to which only the text of the conversation is transmitted, under the terms set out in art. 10;

• operators in charge of Pickup and Redelivery, carriers and porterage companies, limited to the data necessary to perform the task;

• parties that manage the storage premises used by Smoves, limited to the data necessary for operational management;

• professional consultants: accountant, labour consultant, lawyer, appointed as processors where the requirements are met, or as autonomous controllers within the limits provided by their respective codes of conduct;

• competent Authorities in case of legal obligations.

7.2 The updated list of data processors pursuant to art. 28 GDPR is available upon written request to info@smoves.it.

7.3 Personal data may be communicated to parties involved in extraordinary transactions (transfer of business or of a branch of business, contribution, merger), within the limits of the purposes indicated in this notice and in compliance with applicable law. The data are not disclosed or transferred to third parties for their own marketing purposes.

8. Transfers of data outside the EU

8.1 Some of the providers indicated in art. 7 (in particular Stripe, Vercel, Resend, Google, Meta and the providers of artificial intelligence models) are based, or have infrastructure, in the United States of America, and their use may involve the transfer of personal data outside the European Economic Area.

8.2 Transfers take place on the basis of one or more of the following instruments provided by Chapter V of the GDPR:

• adequacy decision, where applicable, in particular Implementing Decision (EU) 2023/1795 relating to the EU-US Data Privacy Framework;

• standard contractual clauses (SCC) adopted by the European Commission;

• supplementary measures where necessary in light of the assessment of the third country.

8.3 A copy of the safeguards used may be requested by writing to info@smoves.it.

9. Rights of the Data Subject

9.1 The Data Subject, where the legal requirements are met, may exercise the following rights provided by artt. 15-22 GDPR:

• access to personal data (art. 15);

• rectification of inaccurate or incomplete data (art. 16);

• erasure of data ("right to be forgotten"), within the limits of art. 17;

• restriction of processing (art. 18);

• data portability (art. 20);

• objection to processing based on legitimate interest and, in any case, to processing for direct marketing purposes (art. 21);

• withdrawal of consent given for optional purposes, without prejudice to the lawfulness of prior processing;

• lodging a complaint with the Italian Data Protection Authority (Garante) (https://www.gpdp.it) or with the Authority of the Member State of residence.

9.2 Requests may be sent, also by ordinary email, to the address info@smoves.it. Smoves responds within 30 days, except for justified extension of up to 60 additional days.

9.3 Smoves may request information useful to confirm the Data Subject's identity, in compliance with the minimisation principle.

9.4 The exercise of the Data Subject's rights may not entail the deletion or anonymisation of data whose storage is necessary for legal obligations, for the establishment, exercise or defence of a right in court, or for the management of pending disputes, within the limits of art. 17(3) GDPR.

9.5 In the case of manifestly unfounded or excessive requests, in particular because of their repetitive character, Smoves may request a reasonable expense contribution or refuse the request, within the limits permitted by art. 12(5) GDPR.

10. Automated assistant, automated decision-making and profiling

10.1 Automated chat assistant. Questions asked in the website's chat are first answered by an assistant based on artificial intelligence models, which the interface identifies as such. The text of the conversation is transmitted to the providers indicated in art. 7 for the sole purpose of generating the reply. The assistant provides information on the Service and does not make decisions producing legal effects on the Data Subject: binding quotes, bookings, refunds and complaints are always handled by the website or by an operator. The Data Subject may at any time ask to speak with an operator and is invited not to enter unnecessary data in the chat.

10.2 Smoves may use automated tools for risk analysis, fraud prevention, anomaly detection, IT security and operational monitoring which do not produce legal effects on the Data Subject pursuant to art. 22 GDPR, but may contribute to operational assessments, always left to a person, relating to the provision of the Service.

10.3 Smoves does not carry out profiling of the Data Subject for marketing purposes without their consent.

11. Data breach

11.1 In the event of a personal data breach, Smoves promptly assesses the incident and, where the requirements are met, notifies the Italian Data Protection Authority (Garante) within 72 hours of becoming aware of the event, pursuant to art. 33 GDPR, and communicates the breach to the Data Subject without undue delay in the cases provided by art. 34 GDPR.

11.2 Smoves maintains an internal register of breaches and mitigation interventions.

12. Amendments to the notice

12.1 Smoves may modify or update this notice, including as a consequence of regulatory changes, technological developments, the introduction of new services or organisational changes. The amendments are effective from the date of publication on the website, indicated at the top of the document; substantial amendments are communicated to Data Subjects with an ongoing relationship at the email address associated with their account. Previous versions remain available in the website's archive of contractual documents.

13. Specific clauses

13.1 Evidentiary preservation. Smoves may store photographic documentation, Reports, operational logs, system recordings, communications and further evidentiary elements for the purpose of protecting its rights and managing disputes, also beyond the ordinary storage terms, within the limits of what is necessary and permitted by applicable law.

13.2 Aggregated and anonymised use of data. Smoves may use aggregated and anonymised data, not attributable to the Data Subject, for statistical, research, development, Service optimisation, business analysis and system improvement purposes.

13.3 Anti-fraud checks and operational suspension. Smoves reserves the right to carry out security checks and anti-fraud verifications, including automated ones, and to temporarily suspend the provision of the Service, subject to a human assessment, in the presence of:

• operational anomalies;

• inconsistencies in the data provided;

• suspected fraudulent activities;

• breaches of the Terms and Conditions;

• risks to the security of the Service or of third parties.