1. Data Controller
Hestia Properties S.r.l.
Viale Certosa, 218 — 20156 Milano
Email: privacy@ordoapp.cloud
Certified email (PEC): hestiapropertiessrl@pec.it
2. Data Collected
Venue Operator Data (Business Account)
- First name, last name, email, phone number
- Venue name, VAT number
- Login credentials (email, encrypted password)
- Access logs (IP address, date/time, user agent)
Visit Statistics (Public Website)
- Aggregated statistics of public pages (page visited, source/referrer, utm campaign parameters) with approximate geolocation of the IP address for statistical purposes. Collection is server-side, without profiling cookies and without identifying the individual. Legal basis: legitimate interest (Art. 6.1.f GDPR).
End-Customer Data
- Device identifier (device_id)
- Email and name (if registered)
- Order history
- Marketing consent preferences
3. Purposes and Legal Basis
| Purpose | Legal Basis | Retention |
|---|---|---|
| Provision of the service | Performance of contract | Account lifetime + 10 years |
| Security and fraud prevention | Legitimate interest | 12 months |
| Service communications | Performance of contract | Account lifetime |
| Direct marketing | Explicit consent | Until withdrawal |
| Tax obligations | Legal obligation | 10 years |
4. Data Recipients
Data may be disclosed to:
- Hosting provider (Aruba S.p.A.)
- Payment services (Stripe)
- Competent authorities where required by law
We do not sell or transfer your data to third parties for commercial purposes.
5. Transfers Outside the EU
Some services (e.g. Stripe) may involve the transfer of data to non-EU countries. In such cases, the transfer takes place on the basis of Standard Contractual Clauses approved by the European Commission.
6. Rights of the Data Subject
Pursuant to Articles 15-22 of the GDPR, you have the right to:
- Access: obtain a copy of your data
- Rectification: correct inaccurate data
- Erasure: request the deletion of your data
- Restriction: restrict processing
- Portability: receive your data in a structured format
- Objection: object to processing
- Withdraw consent: withdraw your consent at any time
To exercise your rights, please write to: privacy@ordoapp.cloud
7. Complaint to the Supervisory Authority
You have the right to lodge a complaint with the Italian Data Protection Authority:
www.garanteprivacy.it
8. Data Security
We adopt technical and organisational measures to protect your data:
- Password encryption (bcrypt)
- HTTPS connections
- Restricted and logged access
- Periodic backups
9. Consent Register
We maintain a detailed register of all consents provided, including: date/time, version of the document accepted, IP address. This register is available on request.
10. Changes to this Policy
Any changes will be published on this page and communicated by email to registered users. The "last update" date indicates the current version.