1. Data Controller
The Data Controller is OrientIA S.r.l.s., registered office at Via Nazionale 79, 81028 Santa Maria a Vico (CE), Italy — VAT/Tax ID IT04966350615, REA CE-369813, Share capital €4,900.00 fully paid.
Contact: info@orientia.it · PEC (certified email, IT only): orientia@pec.it
2. Data collected and purposes
We collect only data strictly necessary to provide the OrientIASales service.
| Category | Purpose | Legal basis |
|---|---|---|
| Name, email (account registration) | Account creation and management | Contract performance (Art. 6(1)(b) GDPR) |
| Company name, sector, business contacts | Tenant configuration and billing | Contract performance (Art. 6(1)(b) GDPR) |
| Usage data and application logs | Security, debugging, service improvement | Legitimate interest (Art. 6(1)(f) GDPR) |
| Email for service communications | Notifications, critical updates, support | Contract performance (Art. 6(1)(b) GDPR) |
| Technical cookies | Language preference, stored cookie choice | Legitimate interest / technical necessity |
We do not collect profiling data for marketing purposes without explicit consent. No data transfers outside the EEA without adequate safeguards.
3. Processing methods and security
Data is processed electronically on cloud infrastructure hosted in Europe (EU). We implement appropriate technical and organizational security measures, including:
- Encryption in transit (TLS 1.2+) and at rest
- Multi-factor authentication for administrative access
- Logical data separation per tenant (multi-tenant architecture)
- Automated daily backups with configurable retention
- Access to data limited to authorized personnel (least privilege principle)
4. Data retention
Data is retained for the duration of the contract and, thereafter, for the period required by applicable law (typically 10 years for fiscal and accounting data). Data no longer needed is deleted or anonymized. For free trial accounts not converted to paid plans, data is deleted within 90 days of trial expiry.
5. Sub-processors
We use third-party service providers that process data on our behalf, all bound by appropriate contractual guarantees (DPA):
- Hetzner / OVH — cloud infrastructure hosting (EU)
- Transactional email provider — service email delivery
- Firebase (Google) — mobile push notifications (minimal data, device token only)
6. Your rights
Under Arts. 15–22 GDPR you have the right to:
- Access — obtain confirmation and a copy of your data
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion ("right to be forgotten")
- Restriction — restrict processing in certain circumstances
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdrawal of consent — at any time, without affecting prior processing
To exercise your rights, write toinfo@orientia.it. We will respond within 30 days. You also have the right to lodge a complaint with the relevant supervisory authority in your EU member state.
7. Cookies
This website uses technical cookies necessary for its operation (language preferences) and, only with your explicit consent, statistical analytics cookies. No analytics or marketing cookie is set before you give consent in the banner.
| Category | Purpose | Provider | Consent |
|---|---|---|---|
| Technical | Store your cookie choice | OrientIA (own) | Not required |
| Analytics | Anonymous/aggregate website usage statistics, if enabled | Google Analytics 4 (Google LLC) | Required |
You can review or withdraw your choice at any time:
The OrientIASales application (the SaaS product, on a separate domain) uses technical session cookies (HttpOnly, Secure) for authentication — not covered by this policy, which applies only to this institutional website.
8. Changes to this Policy
We may update this Policy at any time. Substantial changes will be communicated to registered users via email at least 15 days before taking effect. The last updated date is shown at the top of this page.