PRIVACY POLICY – VEZPA APP

1. Data Controller (Business under CCPA)

Vezpa di Paolo Vezzola
Registered office: Via San Zeno 67, 25015 Desenzano del Garda (BS), Italy
VAT ID: 04449070988 · Tax Code: VZZPLA84C10D284C
Email: [email protected] · PEC: [email protected]

2. Scope

This notice applies to the Vezpa App distributed through:

• Apple App Store (iOS, macOS) — Bundle ID: it.vezpa.pms
• Google Play Store (Android) — googleplay flavor
• Microsoft Store (Windows) — MSIX
• Direct sideload (Android APK, signed Windows installer) for use distributed directly by the Data Controller

Use of the app requires creation of a property-specific account. The app is intended for professional users over 18 years of age (hospitality property operators and their authorized personnel).

3. Data Collected by the App

3.1 User data (Operators and Personnel)

• Identification data: first name, last name, email, phone number
• Property data
• Credentials (password hashed on backend, never transmitted in clear text)
• Account identifiers (User ID)
• Assigned role (director, assistant, housekeeper, observer)

3.2 Guest data (Vezpa acts as a Data Processor / Service Provider under CCPA)

Important: guest data is owned by the property. Vezpa acts as a Data Processor (Service Provider under CCPA; art. 28 GDPR where applicable), governed by the DPA.

• Identification and contact data
• Identity documents scanned or photographed via the device camera, with OCR extraction of textual data to facilitate registration
• Stay and booking data

3.3 Technical and Usage Data

• Device identifiers: model, operating system, app version
• Push notification token (FCM): unique identifier managed by Google Firebase for sending notifications
• SHA-256 hash of trusted device: generated locally to enable subsequent biometric access, expiring 90 days from last use
• Application and diagnostic logs: transmitted in batches to the backend via RemoteLogger for stability and security purposes; do not contain sensitive personal content
• IP address: collected by the backend for security purposes

4. Permissions Requested by the App

5. SDKs and Services Integrated in the App

Vezpa does not integrate behavioral analytics SDKs (e.g., AppsFlyer, Mixpanel, Facebook SDK), advertising SDKs, or profiling SDKs. No cross-app tracking under Apple App Tracking Transparency (ATT).

6. Purposes of Processing

• Provision of Vezpa App features (art. 6.1.b GDPR; business purpose under CCPA)
• Legal obligations relating to guest registration, delegated by the property (art. 6.1.c)
• Security, fraud prevention, service stability (art. 6.1.f, legitimate interest; security business purpose under CCPA)
• Subscription and payment management (art. 6.1.b and 6.1.c)

Data is not used for advertising, profiling, or tracking purposes.

7. Processing Methods and Security

• Transmission via HTTPS/TLS 1.2+
• Authentication with rotating JWT (access 15 min, refresh 180 days with blacklist)
• System Secure Storage (Keychain / EncryptedSharedPreferences / DPAPI)
• Optional TOTP 2FA
• Backend servers located in EU (Frankfurt) on DigitalOcean
• Application logs monitored to detect anomalous access

8. Retention and Deletion

User data is retained for the duration of the contract + tax obligations (10 years for invoicing).

The user may request account deletion through the dedicated feature in the app or by contacting the Data Controller. Some data may be retained for legal obligations (invoicing, security logs).

Guest data (for which Vezpa is a Data Processor) follows the Data Controller's instructions as regulated by the DPA.

9. Data Sharing

Data is not sold or publicly disclosed. It may be shared with sub-processors listed at vezpa.it/subprocessors and, limited to booking data, with OTA channels activated by the property.

For data transmitted to public authorities (Police Authority, ISTAT, Feratel, SES, NTAK, eVisitor, SEF, UbyPort, eTurizem), please refer to the general Privacy Policy.

10. International Transfers

Communications with US providers certified under the DPF (Google/Firebase, Stripe, Microsoft, DigitalOcean) occur on the basis of the EU-U.S. Data Privacy Framework (Commission Decision (EU) 2023/1795). Apple does not participate in the DPF: the contractual relationship for EU users is with Apple Distribution International Ltd (Ireland) and any transfers to Apple Inc. (USA) are governed by SCC 2021/914. Communications with STAAH (channel manager) occur on the basis of the EU adequacy decision for New Zealand (Commission Decision (EU) 2013/65). Tuya (China, optional) is governed by SCC 2021/914.

11. Your Rights

Under articles 15-22 GDPR (where applicable) and US state privacy laws including the CCPA/CPRA, users may exercise rights of access (right to know), rectification (right to correct), deletion, restriction, portability, objection, and opt-out of sale/sharing (Vezpa does not sell or share). Requests can be submitted through the app or to [email protected].

Complaints to the supervisory authority: Italian Data Protection Authority (Garante). US residents may also file complaints with their state Attorney General or the Federal Trade Commission (FTC) where applicable.

12. Minors

The App is intended exclusively for adult users (professional operators). It does not knowingly collect data from minors. In accordance with COPPA, we do not knowingly collect information from children under 13.

13. Changes to the Privacy Policy

This notice may be updated. Changes will be published on this page and, if material, communicated via email and dashboard with at least 15 days' notice.