Privacy notice

1. Data controller and contact details

The data controller is GoEmbra — [TO BE COMPLETED: name and legal form of the controller], with registered office at [TO BE COMPLETED: address of the registered office], VAT no. IT04264030232.

For any question about your data and to exercise your rights, write to [TO BE COMPLETED: email address for privacy matters].

Data Protection Officer (DPO): [TO BE COMPLETED: state whether one has been appointed and their contact details; if not appointed, remove this sentence].

2. Website visitors

When you visit the website, the server receives, as with any website, your IP address, the page requested, the date and time and technical data about your browser. These are needed to display the pages and to protect the service from abuse (legal basis: our legitimate interest in security, art. 6(1)(f) GDPR) and are kept in the server’s technical logs for [TO BE COMPLETED: retention period of the server logs].

The website does not use profiling cookies or analytics tools, and does not load third-party resources to display its pages: fonts and images are served by our own server. Details are in the cookie policy.

To protect some forms (the questionnaire and the referrer application), Cloudflare Turnstile may be used to check that the sender is a person: Cloudflare receives your IP address and some technical data about your browser (see sections 10 and 11).

3. Contact requests, questionnaire and booking a call

«Contact us» form: name, email, company, country, service of interest, message and page language, plus the date, time and IP address of the request.

«Discover what you need» questionnaire: your answers are not linked to you until you leave your email; we only count, without personal data, how many times the questionnaire is started and completed. If you ask for the full profile, we process your email, name (if you enter it), answers and resulting profile, language, date and time of consent, IP address and, if you choose to, your agreement to receive news from GoEmbra.

Booking a call: the chosen day and time, time zone and an optional note. The appointment is created in GoEmbra’s Google calendar with the Google Meet video call link and with your name, your email and a summary of the request; the confirmation, reminders and calendar invitation (.ics) are sent to you by email. If you do not book, we may send you at most two reminders, which you can stop with the «stop receiving reminders» link.

Purposes and legal basis: to answer your request, send you the profile, organise the call and jointly assess a possible service (pre-contractual measures taken at your request, art. 6(1)(b) GDPR); to protect the forms from abuse (legitimate interest, art. 6(1)(f)). GoEmbra news only with your optional consent (art. 6(1)(a)), which you can withdraw at any time.

The questionnaire profile is a guidance calculated from your answers: it does not produce automated decisions with legal effects on you.

Retention: for the time needed to handle the request and no longer than 24 months from the last contact [TO BE COMPLETED: deletion is currently manual, to be automated or confirmed]; if you become a client, the periods in section 4 apply.

4. Portal clients

Your portal account is created by GoEmbra after the first contact, and you receive an invitation to choose your password (or to log in with Google, if your account already exists). We process:

• account data: name, email, password (only in encrypted form, never readable), preferred language, history of email changes;
• company data: company name, legal form, tax code and VAT number, REA (Italian business register) number, PEC (certified email) and email, offices, people and roles, the company register extract you upload, the signatory’s details (first name, surname, role, tax code);
• cases and projects: questions and answers, messages, documents uploaded by you or by GoEmbra, quotes, orders, signed contracts and NDAs, scheduled calls;
• electronic signature: to sign NDAs and contracts, the PDF document and your first name, surname and email are sent to OpenAPI (electronic signature with a code sent by email); the signed document comes back to the portal and is countersigned by GoEmbra;
• payments: with a card (Stripe) or PayPal you pay on the Stripe or PayPal pages, which receive the amount and description and process the payment data as independent controllers; GoEmbra neither sees nor stores card data, it only keeps the outcome and reference of the payment. For bank transfers we keep the payment receipt you upload;
• invoicing: to issue pro forma invoices and invoices we send Fatture in Cloud the company name, VAT number or tax code, address, service and amounts;
• translations: if a document in your case is in a language other than yours, the file may be translated automatically with DeepL (the whole document is sent to DeepL and the translation comes back to the portal).

Purposes and legal basis: to provide the requested services and manage the contract (art. 6(1)(b) GDPR); to comply with legal, tax and accounting obligations (art. 6(1)(c)); to protect GoEmbra’s rights and the security of the portal (legitimate interest, art. 6(1)(f)).

Retention: for the whole duration of the relationship; then contracts, signed documents, orders, payments and invoices for 10 years (article 2220 of the Italian Civil Code and the ordinary limitation period); everything else is deleted at the end of the relationship or at your request, unless it is needed to defend a right [TO BE COMPLETED: confirm the periods].

5. Partners and collaborators

For those who work with GoEmbra on projects (partners, called «collaborators» in the portal) we process: account data; profile data (company name, sector, countries covered, motivation, VAT number, tax code, telephone, billing address); uploaded documents (CV, company register extract or business registration, other documents); assigned projects, messages and project documents (also translated with DeepL as in section 4); fees, uploaded invoices and payment statements.

Purposes and legal basis: to assess and manage the collaboration and pay the fees (contract, art. 6(1)(b)); tax and accounting obligations (art. 6(1)(c)).

Retention: for the duration of the collaboration; invoices, fees and accounting documents for 10 years; the profile of an application that is not accepted [TO BE COMPLETED: retention period].

6. Referrers

If you apply as a referrer, we process the data in the form: type (individual or company), first name and surname or contact person, email, telephone, language; for individuals, the tax code; for companies, company name, VAT number, registered office, recipient code or PEC (certified email); the IBAN for commissions; the date, time and IP address of the application.

The referral agreement is accepted online, without a signature: we record the accepted version, the text with its digital fingerprint (SHA-256), date and time, IP address and browser, and we send you a PDF copy. If we approve the application, your account is created in the referrers’ mini-portal, with your referrals, commissions, payments and the receipts or invoices you upload.

Your tax code and IBAN are seen only by GoEmbra’s administration: they do not appear in the mini-portal or in emails (in the copy of the agreement they are partially shown).

Purposes and legal basis: to assess the application, manage the agreement and the referrals, pay the commissions (contract, art. 6(1)(b)); tax and accounting obligations (art. 6(1)(c)); to keep proof of acceptance of the agreement and to prevent new applications from people who have been excluded, by comparing email, tax code and VAT number (legitimate interest, art. 6(1)(f)).

Retention: for the duration of the agreement; then commission and payment data for 10 years; the data needed to prevent a new application after an exclusion [TO BE COMPLETED: period]; rejected applications or those whose email was never confirmed [TO BE COMPLETED: period].

7. Referred companies (data received from a referrer)

If a referrer has pointed you out to GoEmbra, we have received from them your name, your email, the name of your company, the service that might interest you, the language and a note of theirs (art. 14 GDPR). The referrer declares that they know you and that you have agreed to receive an email from us.

We use this data only to write to you once and ask whether you want to be contacted: until you reply we do not use it for anything else, and within GoEmbra your email remains hidden (legal basis: GoEmbra’s legitimate interest in checking your interest, art. 6(1)(f), balanced by the single email and the automatic deletion).

If you answer «no» or do not reply within 3 months, we delete your name, email and the note; we keep only an encrypted (non-reversible) fingerprint of your email, so as not to ask you again, and the company name. If you answer «yes», we record the date, time and IP address of your consent and the rules in section 3 apply.

8. Account, access and security

To access the portal we use your email and password (stored only in encrypted form) or, for clients who already have an account, Google sign-in: in that case Google tells us your email, which we use only to recognise your account.

For security, we block access for a few minutes after too many failed attempts. The app writes events such as the sending of an email, with the recipient’s address, to its own technical logs [TO BE COMPLETED: retention period of the application logs].

Files (company register extracts, documents, contracts, receipts) are stored in our server’s storage and can only be downloaded from the portal, by those entitled to them.

9. Emails

GoEmbra’s emails (confirmations, invitations, reminders, notices) are composed by the app and sent by our sending service, which runs on the same server, through an email delivery provider [TO BE COMPLETED: confirm the provider, currently Brevo]. The service keeps a history of the emails sent (recipient, subject, outcome) for [TO BE COMPLETED: period].

10. Who processes data on behalf of GoEmbra

Data is processed by authorised GoEmbra staff and, on behalf of GoEmbra, by the providers listed below, each only for its own service [TO BE COMPLETED: check the appointments as data processors, art. 28 GDPR]. We do not sell or transfer data to third parties for their own commercial purposes.

Data may also be disclosed to tax and legal advisers, banks and authorities, when needed to comply with legal obligations or to defend a right.

11. Transfers outside the European Union

Some providers (Google, Cloudflare, Stripe, PayPal) may process data in the United States. In that case the transfer is made to companies participating in the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) or under the standard contractual clauses approved by the European Commission [TO BE COMPLETED: check provider by provider].

GoEmbra also works with Brazil: if one of your projects involves partners in Brazil, the data needed for the project may be shared with them [TO BE COMPLETED: safeguards for transfers to partners in Brazil, e.g. standard contractual clauses].

12. How long we keep data, in brief

13. Your rights

You can ask at any time to access your data, correct it, delete it, restrict its processing, receive it in a machine-readable format (portability) and object to processing based on legitimate interest; you can withdraw any consent given, without affecting processing carried out before (articles 15–22 GDPR).

To exercise them, write to [TO BE COMPLETED: email address for privacy matters]: we reply within one month. Some data cannot be deleted as long as the law requires us to keep it (for example invoices).

If you believe the processing breaches the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work. If you are in Brazil, you can also exercise the rights provided by the Brazilian data protection law (LGPD, Lei 13.709/2018) and contact the ANPD [TO BE COMPLETED: lawyer’s check].

14. Changes to this notice

We update this notice when the processing changes: the version and date are at the top of the page. For important changes we will notify you in the portal or by email.