Privacy Policy

Privacy Notice
(Art. 13 of Regulation (EU) 2016/679)

This notice on the processing of personal data, drawn up pursuant to Legislative Decree 196/2003, as
subsequently amended and supplemented by Legislative Decree 101/2018 (the “Privacy Code”), and to the EU General Data Protection Regulation 2016/679 (the “GDPR”), sets out the manner in which Klaaryo S.r.l. (hereinafter the “Data Controller” or the “Company”) will process the Personal Data of customers who have entered into the agreement for the use of the
“klaaryo” software and for the provision of the SaaS services, as identified in the agreement (the “Agreement”), to which
this notice is annexed.

1. DATA CONTROLLER
   The Data Controller is Klaaryo S.r.l., with registered office at Via Luigi Luzzati 15, Bari (BA), VAT No.
   02872710906. Any requests, clarifications or information regarding the processing of your Personal Data may be addressed, at any time, to the following e-mail address: dpo@klaaryo.com.

   
   

2. CATEGORIES OF PERSONAL DATA, PURPOSES AND LEGAL BASES OF THE PROCESSING

   Identification and contact data of the customer and of related parties (e.g., attorneys-in-fact, legal representatives; employees and/or collaborators who have been given login credentials to the Software); banking and tax data; invoicing data. For the establishment, performance and management of a business relationship, as well as for the performance of administrative, accounting, insurance, social security and/or tax activities.

   The processing is necessary for the performance of the Agreement to which the customer is a party (Article 6(1)(b) GDPR). To comply with legal obligations or with obligations arising from requests by the authorities.

   The processing is necessary for compliance with a legal obligation to which the data controller is subject (Article 6(1)(c) GDPR). In order to exercise a right in legal proceedings. The processing is based on the legitimate interest of the Data Controller (Article 6(1)(f) GDPR).

   
   

3. CATEGORIES OF DATA SUBJECTS
   The Personal Data processed relate exclusively to the customer and to the parties related to it, by way of example: (a) attorneys-in-fact; (b) chief executive officers; (c) founders; (c) employees and/or collaborators; (d) employees and/or collaborators who are authorised by the Customer to use the login credentials to the Software and to the SaaS Services.

   
   

4. PROCESSING METHODS AND RETENTION PERIOD
   The Data Controller will process the customers’ Personal Data in compliance with the principles of fairness, lawfulness and transparency, as set out in Article 5 of the GDPR.
   The customers’ Personal Data will be processed in paper and/or digital form exclusively for the purposes
   identified in this notice, and no processing of the Personal Data will be carried out for any further purposes. The customers’ Personal Data will be retained only for as long as necessary to achieve the purposes for which they were collected, as detailed in this notice.

   
   

5. SECURITY MEASURES
   The Data Controller, taking into account the nature, scope, context and purposes of the processing of the customers’ Personal Data, as well as any risks posed by the processing, has adopted appropriate technical and organisational measures to ensure the utmost confidentiality, integrity and accuracy of the Personal Data processed, also in order to protect them against the risk of breaches and unauthorised access, in compliance with Art. 32 of the GDPR.

   
   

6. PERSONS OR CATEGORIES OF PERSONS TO WHOM THE PERSONAL DATA MAY BE DISCLOSED
   The customers’ Personal Data may be disclosed, where strictly necessary, to the following categories of recipients:
   ● persons authorised to process the Personal Data pursuant to Art. 29 of the GDPR (e.g.: employees and/or collaborators of the Data Controller);
   ● persons appointed as data processors (by way of example: labour consultants; tax advisors; social security consultants; banks and insurance companies);
   ● administrative, supervisory and/or judicial authorities.

   
   

7. MANDATORY OR OPTIONAL NATURE OF THE PROVISION OF PERSONAL DATA
   The provision and collection of the customers’ Personal Data are mandatory in order to achieve the purposes identified in this notice. Please note that any refusal to provide the Personal Data will make it impossible for the Data Controller to
   enter into and perform the Agreement and, consequently, to provide access to the “Klaaryo” software and to provide the related SaaS services, as identified in the Agreement.
   
   

8. INTERNATIONAL TRANSFERS OF YOUR PERSONAL DATA
   The customers’ Personal Data are not transferred and/or stored outside the European Economic Area (EEA). Where it becomes necessary – in order to achieve the purposes set out in this Notice – to transfer the Personal Data outside the EEA, they will be transferred exclusively to third countries in respect of which an adequacy decision has been adopted by the European Commission or – in the absence thereof – exclusively following the adoption of the appropriate safeguards provided for by Chapter V, Articles 46 et seq. of the GDPR.

   
   

9. YOUR RIGHTS
   At any time, customers may contact the Data Controller at the following e-mail address: dpo@klaaryo.com, in order to exercise the rights granted to them by Articles 15 et seq. of the GDPR, as further specified below:
   ● right of access;
   ● right to rectification of inaccurate and/or incomplete Personal Data;
   ● right to erasure (the so-called “right to be forgotten”);
   ● right to restriction of processing;
   ● right to data portability;
   ● right to object to the processing of your Personal Data;
   ● right to lodge a complaint with a data protection Supervisory Authority.