Privacy notice

1. Who processes the data

For the public site, commercial enquiries, sign-in accounts, service security and support, the controller is Z-Arts® (VAT no. 02807420068). To exercise your rights or ask a privacy question, write to support@z-arts.tech.

For the data the customer enters in the account — users, locations, products, lots, suppliers and other operational information — the customer is normally the controller. Z-Arts processes it as a processor, to provide Scado under the contract.

2. What data we process

• contact and business details sent for a demo or an information request;
• sign-in and profile data, such as name, email, role and assigned location;
• operational data entered in the service, including products, barcodes, lots, expiries, orders and suppliers;
• technical and security data, such as essential logs, IP address, browser and session data;
• in-app subscription transaction identifiers (Apple or Google), not card details;
• the content of messages sent to support;
• measurement-cookie identifiers, only if you accept non-technical tools on the public pages.

3. Why we process it

• answering demos and contact requests — pre-contractual steps, Art. 6(1)(b) GDPR;
• creating the account, managing roles and permissions, providing products, lots, expiries, orders and inventory, and checking the subscription with Apple or Google — contract, Art. 6(1)(b);
• security logs, abuse prevention and service continuity — legitimate interest, Art. 6(1)(f);
• tax and accounting duties, where they apply — legal obligation, Art. 6(1)(c);
• statistics and advertising measurement on public pages only — consent, Art. 6(1)(a), which you can withdraw at any time.

Legitimate interest is limited to protecting the service, preventing abuse and keeping it available. You can object to this processing.

Name, email and password are required to open the account: without them the service cannot start. The customer enters the other operational data because the features need it.

We do not take decisions based solely on automated processing that produce legal effects or similarly affect you.

4. Retention and recipients

We keep data for as long as the stated purposes, the contract and legal duties require, including tax and accounting duties. You can delete the account in the app or the portal: Settings / My profile → Delete account. By default only the user is deleted: products, lots, locations and colleagues stay, so someone else can take over. The owner (Director) can also close the business and erase the data. An App Store or Google Play subscription is cancelled in the store settings.

Data may be processed by providers of hosting, infrastructure, email, security and support, bound by instructions and appropriate safeguards. Apple and Google are independent controllers of store payments. If you accept measurement, Google (Analytics) and LinkedIn (Insight Tag) receive technical identifiers on the public pages, under their own notices. Internal access is limited to authorised people and to the data they need.

5. Transfers and security

If a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision (Art. 45 GDPR), including the EU–US Data Privacy Framework when the recipient is certified, or on the Commission's standard contractual clauses (Art. 46). We apply appropriate technical and organisational measures to protect data, access and the availability of the service.

6. Cookies and measurement

In the signed-in area and in the app we only use cookies and technical tools needed for access, the session and security. Under the ePrivacy Directive (2002/58/EC) and the national rules of Italy, Spain and France, these tools do not require consent.

On the public pages, Google Analytics 4 and the LinkedIn Insight Tag — if they are enabled in the site configuration — load only after freely given, specific and informed consent. Accept and reject are equivalent choices: continuing to browse is not consent. The choice stays on this browser and can be changed at the bottom of this page.

The same rule applies in Italy (Garante cookie guidelines of 10 June 2021), in Spain (Art. 22.2 LSSI) and in France (Art. 82 of the loi Informatique et Libertés and the CNIL guidelines).

7. Your rights

You can request access, rectification, erasure, restriction and portability, object to processing based on legitimate interest, and withdraw consent without affecting what was already done. Account deletion is in Settings → My profile → Delete account. Send requests to support@z-arts.tech.

You can lodge a complaint with the authority of the country where you live, work, or where the alleged infringement took place (Art. 77 GDPR). For Italy, Spain and France: Garante per la protezione dei dati personali (www.garanteprivacy.it), Agencia Española de Protección de Datos — AEPD (www.aepd.es), Commission nationale de l'informatique et des libertés — CNIL (www.cnil.fr).