PRIVACY POLICY - VEZPA APP

1. Data Controller / Organization

Vezpa di Paolo Vezzola
Registered office: Via San Zeno 67, 25015 Desenzano del Garda (BS), Italy
VAT: 04449070988 · Tax code: VZZPLA84C10D284C
Email: [email protected] · PEC: [email protected]

2. Scope of Application

This notice applies to the Vezpa App distributed through:

• Apple App Store (iOS, macOS) - Bundle ID: it.vezpa.pms
• Google Play Store (Android) - googleplay flavour
• Microsoft Store (Windows) - MSIX
• Direct sideload (Android APK, signed Windows installer) for use distributed directly by the Data Controller

Use of the app requires creating an account dedicated to the accommodation property. The app is intended for professional users over 18 years of age (property managers and their authorized personnel).

3. Data Collected by the App

3.1 User Data (Managers and Staff)

• Identity data: first name, last name, email, phone number
• Accommodation property data
• Credentials (password hashed on the backend, never transmitted in clear)
• Account identifiers (User ID)
• Assigned role (manager, assistant, housekeeper, observer)

3.2 Guest Data (Vezpa acts as Data Processor)

Important: Guest data belongs to the property. Vezpa acts as Data Processor under GDPR art. 28 (where applicable) and as service provider / third party under PIPEDA, governed by the DPA.

• Identity and contact data
• Identity documents scanned or photographed with the device camera, with OCR extraction of textual data to facilitate registration
• Stay and reservation data

3.3 Technical and Usage Data

• Device identifiers: model, operating system, app version
• Push notification tokens (FCM): unique identifier managed by Google Firebase for sending notifications
• SHA-256 hash of trusted device: generated locally to allow subsequent biometric login, 90-day expiry from last use
• Application and diagnostic logs: transmitted in batches to the backend via RemoteLogger for stability and security purposes; do not contain sensitive personal content
• IP address: collected by the backend for security purposes

4. Permissions Requested by the App

5. SDKs and Services Integrated in the App

Vezpa does not integrate behavioural analytics SDKs (e.g. AppsFlyer, Mixpanel, Facebook SDK), advertising SDKs or profiling SDKs. No cross-app tracking under Apple App Tracking Transparency (ATT).

6. Purposes of Processing

• Provision of the Vezpa App's features (GDPR art. 6.1.b / PIPEDA consent implied by service request)
• Legal compliance relating to guest registration, delegated by the property (art. 6.1.c)
• Security, fraud prevention, service stability (art. 6.1.f, legitimate interest)
• Subscription and payment management (art. 6.1.b and 6.1.c)

Data is not used for advertising, profiling or tracking purposes. We do not sell your personal information.

7. Processing Methods and Security

• Transmission via HTTPS/TLS 1.2+
• Rotating JWT authentication (15-min access, 180-day refresh with blacklist)
• System Secure Storage (Keychain / EncryptedSharedPreferences / DPAPI)
• Optional TOTP 2FA
• Backend servers located in the EU (Frankfurt) on DigitalOcean
• Application logs monitored to detect anomalous access

8. Retention and Deletion

User data is kept for the duration of the contract + tax obligations (10 years for invoicing; minimum 6 years for Canadian customers under CRA requirements).

The user may request account deletion through the dedicated feature in the app or by writing to the Data Controller. Some data may be retained for legal obligations (invoicing, security logs).

Guest data (for which Vezpa is Data Processor) follows the Data Controller's instructions as regulated in the DPA.

9. Disclosure of Data

Data is not sold or disseminated. It may be disclosed to the sub-processors listed at vezpa.it/subprocessors and, limited to reservation data, to the OTA channels activated by the property.

For data transmitted to public authorities (Questura, ISTAT, Feratel, SES, NTAK, eVisitor, SEF, UbyPort, eTurizem, and where applicable CRA and provincial authorities), please refer to the general Privacy Policy.

10. Cross-border Data Transfers

Communications with USA providers certified active under the DPF (Google/Firebase, Stripe, Microsoft, DigitalOcean) take place under the EU-U.S. Data Privacy Framework (Commission Decision (EU) 2023/1795). Apple does not participate in the DPF: the contractual relationship for EU users is with Apple Distribution International Ltd (Ireland), and any transfers to Apple Inc. (USA) are governed by Standard Contractual Clauses 2021/914. Communications with STAAH (channel manager) take place under the EU Adequacy Decision for New Zealand (Commission Decision (EU) 2013/65). Tuya (China, optional) is governed by SCC 2021/914. Canadian users are informed that their personal information may be transferred to, stored in, and processed in the EU, USA, New Zealand or other jurisdictions, and may be subject to lawful access by foreign authorities.

11. Rights of the Individual

Under GDPR arts. 15-22 (where applicable) and under PIPEDA / Quebec Law 25, the user may exercise rights of access, rectification, erasure, restriction, portability and objection. Requests may be submitted through the app or to [email protected].

Complaints to the supervisory authority: Italian Data Protection Authority (Garante per la Protezione dei Dati Personali). Canadian users may also file a complaint with the Office of the Privacy Commissioner of Canada - OPC (www.priv.gc.ca). Quebec residents may contact Commission d'acces a l'information (CAI, www.cai.gouv.qc.ca).

12. Minors

The App is intended exclusively for adult users (professional managers). It does not knowingly collect data from minors.

13. Changes to the Privacy Policy

This notice may be updated. Changes will be published on this page and, if material, communicated by email and dashboard with at least 15 days' notice.