Privacy notice
Controller: Tom Riby, Gaiole in Chianti (SI), Italia, hello@fascicolo.eu. Notice under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Last updated: 2026-08-31.
What we process
Contact and company data you give us (name, email, legal name, address, VAT number, headcount and turnover solely to check the micro-enterprise exemption). Packaging and supplier data you enter in the app, including supplier contacts' emails. Answers and attachments suppliers submit through the portal. Payment data, processed by Stripe: we never see or store card numbers. Strictly necessary technical data (IP addresses in server logs, functional cookies).
Why and on what basis
Contract performance (Art. 6(1)(b)): providing the service, generating documents, contacting suppliers on your behalf under Art. 16 of Regulation (EU) 2025/40. Legal obligation (Art. 6(1)(c)): invoicing and accounting retention. Legitimate interest (Art. 6(1)(f)): security, abuse prevention, essential service communications. Consent (Art. 6(1)(a)): sending the checklist and quote from the checker, withdrawable at any time.
Supplier data
When you add a supplier we process their contact's data on your behalf and ask you to confirm you are entitled to share it. Our request tells the supplier who is asking, why, and how long the data is kept. Suppliers can write to hello@fascicolo.eu to exercise their rights.
Who processes data for us
Supabase (database and file storage, EU region — Frankfurt). Netlify (hosting). Resend (email). Stripe (payments). Google (anonymous traffic statistics). Anthropic (assisted drafting and the site assistant: questions asked to the assistant are transmitted to generate the reply and kept by us for 12 months to improve the service; avoid entering unnecessary personal data; packaging data is transmitted to draft requests and documents; it is not used to train models). Our accountant for invoicing. Each acts as a processor under Art. 28 or as an independent controller for its own part; non-EU transfers rely on Standard Contractual Clauses.
How long
Technical documentation and declarations: 5 years from placing on the market (10 for reusable packaging), as required by Regulation (EU) 2025/40, or while you keep your account and per your instructions. Billing data: 10 years. Checker leads that don't become customers: 12 months. Technical logs: 90 days.
Your rights
Access, rectification, erasure, restriction, portability, objection and withdrawal of consent: write to hello@fascicolo.eu. You may complain to the Italian supervisory authority (garanteprivacy.it) or your local one. No automated decision-making with legal effects, no profiling.
Cookies and statistics
Functional cookies only: login session and language preference. For traffic statistics we use Google Analytics 4 in consent-denied mode: no cookies are written and the data sent is anonymous and aggregated (page views, referrer), with IP anonymisation and no advertising signals. No profiling cookies, no banner.
Security
Passwordless login via one-time email links, encryption in transit and at rest, data access restricted to the owning organisation. Supplier links are unique and unguessable.