Integritet
Version: 1.2.0
Översättning av juridiska texter: REVIEW_REQUIRED. Ingen godkänd SV-version. Samtyckeslogiken oförändrad (integritet obligatorisk, auditbekräftelse obligatorisk, marknadsföring valfri, inte förkryssad). This legal document is provided in English (approved language). A local translation is not yet approved; consent logic is unchanged.
1. Data controller
Controller: UP 101 DI PIZZO MATTEO MARIO Trade name: UP101 Product: UP101 TravelOS VAT: 02815530064 (IT02815530064) Fiscal address: Corso Crimea 35 15121 Alessandria (AL) Italia Privacy contact: info@up101.dev PEC: matteomariopizzo@pec.it UP101 TravelOS is a product of UP 101 DI PIZZO MATTEO MARIO (trade name UP101). UP101 Tenerife is a historical operating name linked to Tenerife and does not denote a separate Spanish company.
2. Purposes of processing
We process personal data to: • Handle free audit requests, contact forms, and authorised commercial communications. • Prepare and manage commercial proposals, acceptances, manual payments, and the client portal. • Manage the B2B relationship with clients and qualified prospects. • Maintain system security, record consents, and comply with legal obligations. • Handle data subject rights requests (access, rectification, erasure, etc.). • Operate internal scoring and commercial eligibility rules without automated legal effects on you. • Measure the public journey with optional first-party funnel events only after statistics consent (no third-party cookies; no form bodies or credentials). • Keep contractual evidence and records needed for accountability and applicable accounting/tax duties.
3. Legal basis
Applicable bases include: • Art. 6(1)(b) GDPR — pre-contractual steps or contract at your request. • Art. 6(1)(a) GDPR — specific, informed, non-pre-ticked consent for marketing. • Art. 6(1)(c) GDPR — legal obligation. • Art. 6(1)(f) GDPR — legitimate interest in security and prudent B2B relationship management. For B2B prospect data obtained without a prior form, see /privacy-prospect (Art. 14 GDPR).
4. Categories of data
We may process: identity and contact data, business data, language preference, consent records, technical metadata (IP, user agent) for consent proof and security, and operational service data.
5. Retention
We keep data as long as needed for the stated purpose, the business relationship, and accountability obligations. Marketing consents are reviewed periodically. Expiry reviews are operator-assisted (rights queue + admin retention review): there is no automatic mass deletion of CRM data. Backups and security logs follow separate infrastructure policies and are not instantly wiped with the primary database.
6. Recipients
Data may be accessed by authorised UP101 staff and, where necessary, processors under contract (hosting, email, infrastructure). We do not sell personal data.
7. International transfers
We prefer providers within the EEA. Any future transfers outside the EEA will use appropriate safeguards under GDPR and an updated policy.
8. Your rights
You may exercise access, rectification, erasure, restriction, objection, portability, and withdrawal of consent by emailing info@up101.dev or using /privacy-rights. You may also use PEC matteomariopizzo@pec.it for certified communications. We respond within one month, extendable under GDPR. We do not require ID unless there is reasonable doubt about your identity.
9. Supervisory authority
You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): www.garanteprivacy.it — Piazza Venezia 11, 00187 Rome, Italy. If you habitually reside in another EU/EEA Member State, you may also contact your local supervisory authority (EDPB list). The Spanish AEPD (www.aepd.es) is not the sole authority merely because the service is also offered in Spain.
10. Marketing
Commercial communications require a valid legal basis. Marketing consent on forms is optional, specific, and not pre-ticked. You may opt out anytime via unsubscribe links or info@up101.dev.
11. Audit and contact forms
Public forms collect only necessary data. Privacy acknowledgement is required to submit and is distinct from optional marketing consent (not pre-ticked). Asking for a plan or audit does not create a subscription or a payment obligation. A saved request remains valid even if the notification email fails — do not resubmit the same request. Technical metadata (e.g. hashed IP for consent evidence) may be logged for accountability and security; it is not used as a marketing cookie.
12. Internal scoring and automated decisions
UP101 uses internal scores and eligibility rules. They do not produce legal effects or similarly significant automated decisions under Art. 22 GDPR: they do not deny public services or make binding decisions without human review.
13. B2B service
UP101 Tenerife provides B2B direct booking, automation, and growth services. UP101 TravelOS is a product of UP 101 DI PIZZO MATTEO MARIO (trade name UP101). UP101 Tenerife is a historical operating name linked to Tenerife and does not denote a separate Spanish company. Client contracts may include specific terms, DPAs (when UP101 acts as processor for the client), and retention policies.
Inte juridisk rådgivning. Sakgranskning återstår.