Privacy Notice

1. WHO IS THE DATA CONTROLLER?

The data controller is Cubbit S.r.l., with its registered office at Via della Zecca 1, 40121 Bologna, Italy, Tax Code and VAT number 03562001200 (“Cubbit”, “we”, “us”).

You can contact us and our Data Protection Officer (DPO) at privacy@cubbit.io.

2. WHAT DATA DO WE COLLECT?

We collect data that you provide to us, data collected automatically when you use the Services, and data we receive from third parties.

         A. Data you provide to us

We collect it when you create an account, contact our technical support or sales team, subscribe to our newsletter, or take part in events and promotional initiatives.

• Identification data: first name, surname, VAT number, signature, identity document.
• Contact data: email address, phone number, billing and shipping address.
• Billing data: invoices, bank details.
• Support and communication data: the information you give us when you open a ticket or write to us, including via social media. For example, name, email, job title, company and the content of your request.
• Other information: data you choose to share by filling in forms, registering for events or answering surveys. Data collected during recruitment is processed in accordance with our Recruitment Privacy Notice.  

        B. Data collected automatically

When you use the Services, we automatically collect some information through system logs, cookies and tracking tools.

• Usage data: pages visited, actions taken, session duration, use of features.
• Device data: device type, operating system, browser, software version, screen resolution, IP address, approximate location.
• Cookies and similar technologies: identifiers used to analyse traffic, improve navigation and personalise your experience. Details are in our Cookie Notice.
• Data on your interaction with our emails: whether messages are opened, link clicks, the device and email client used. We collect this through tracking pixels, as explained in section 3.1.

       C. Data we receive from third parties

• Payment data: from banks and payment service providers.
• Professional contact data: from business partners and resellers, including company references and transaction details.
• Social media data: public content related to interactions with our pages, such as comments, likes and messages.
• Data from authentication services: if you sign in with your Google or Microsoft account, we receive your first name, surname and email address.

3. HOW DO WE USE YOUR DATA? 

We use your data only for the purposes set out in the table below, and keep it only for as long as necessary. When the retention periods expire, the data is deleted or anonymised.

Data required for the contract, support and legal obligations is mandatory: without it, we cannot provide the Services. Anything based on consent is optional, and refusing does not limit your use of the Services.

‍

3.1 Emails and tracking pixels

What they are. Some of our emails contain a tracking pixel: a tiny, invisible image hosted on the servers of the platform we use to send emails. When you open the email and your email client downloads images, the pixel sends a request to those servers. The same happens when you click a tracked link.

What data we collect. Whether you opened the email, when and how many times; the links you clicked; IP address; device type and email client; approximate location derived from the IP address. The pixel does not read the contents of your mailbox. If you have also accepted cookies on our website, when you click a link we associate the pages you visit with your contact profile.

When we use them and on what legal basis. We track opens and clicks only if you have given your consent, either when subscribing or separately. We use this data to understand how you interact with our promotional emails, tailor their content and frequency, and learn what interests you. Without your consent, our emails do not collect any data about whether or how you read them.

How to choose. Every email we send contains a Manage preferences link. From there you can:

• stop receiving our promotional communications, or
• keep receiving them, but without individual tracking.

You can also prevent tracking by turning off automatic image downloads in your email client. Refusing tracking does not limit your use of our Services in any way. We record your choices so that we can respect them and demonstrate that we do.

How we protect the data. Your email address does not appear in the request generated by the pixel. We use a random, non-sequential identifier, linked to your address only within the platform. We keep individual interaction data for 24 months.

Who processes the data. The sending platform manages emails and pixels on our behalf, as a data processor.

3.2 Artificial intelligence tools

We use artificial intelligence tools, developed in-house or provided by third parties, to draft support replies, summarise documents and communications, and search internal information. These tools may process the data you provide in requests and communications. The legal basis is performance of a contract or our legitimate interest in working efficiently.

With the participants’ consent, we also use AI to transcribe and summarise video calls. We keep transcripts and summaries for the same period that applies to the purpose of the meeting, for example support or a business relationship (section 3).

Every output is reviewed by a person: we do not make decisions based solely on automated processing. Your data is not used to train third-party models. We do not use AI on data we process on behalf of our customers.

4. WHO DO WE SHARE YOUR DATA WITH?

We share data only with the parties listed below, for the purposes set out in this Notice. We do not sell your data or disclose it to third parties for their own commercial purposes.

• Service providers and technology partners: infrastructure, support, analytics, email delivery, AI tools. They act as data processors (Article 28 GDPR), follow our instructions and are bound by contract.
• Authorised partners and resellers: if you access the Services through a partner, we share with them the data needed to manage the service. The partner acts as an independent controller, if it decides on its own how to use the data, or as a joint controller, if it decides this together with us.
• Advisers: legal, tax and accounting advisers and auditors, solely for legal obligations or business management.
• Authorities: public bodies, judicial or supervisory authorities, where required by law.
• Customer administrators: administrators appointed by a customer can access the data of users on that customer’s account.
• The public: only with your consent, for example to publish a testimonial on our website or social media.
• Corporate transactions: in the event of a merger or acquisition, data may be transferred to the companies involved, in accordance with the law.

5. WHERE DO WE TRANSFER YOUR DATA?

We store data mainly in Italy or, in any case, within the European Union and the European Economic Area (EEA). We transfer it outside the EU/EEA only when necessary, for example because a provider is based in the United States.

In such cases, we use the safeguards provided by the GDPR:

• countries that the European Commission recognises as providing adequate protection (adequacy decisions), including the United States for companies certified under the EU-US Data Privacy Framework;
• Standard Contractual Clauses, model contracts approved by the European Commission (Decision (EU) 2021/914);
• Binding Corporate Rules (BCRs), internal data protection rules approved by the authorities and applicable within a group of companies.

Where needed, we add supplementary technical and organisational measures. You can request a copy of the safeguards by writing to privacy@cubbit.io.

6. HOW DO WE PROTECT YOUR DATA?

We adopt appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of data. Cubbit is ISO/IEC 27001:2022 certified, and all staff receive ongoing training in security and data protection.

Our measures include:

• Internal policies on procedures and responsibilities.
• Access control with multi-factor authentication (MFA) and role-based permissions.
• Secure software development, with regular audits and vulnerability testing.
• Continuous monitoring to detect suspicious activity.
• Encryption of data in transit and at rest.
• Supplier selection based on their security and data protection guarantees.
• Incident management to detect, contain and notify any breaches. If a breach is likely to result in a high risk to your rights, we will inform you without undue delay.
• Regular backups in protected environments.

7. WHAT ARE YOUR RIGHTS?

You can at any time:

• access your data and obtain a copy;
• request rectification if it is inaccurate or incomplete;
• request erasure when it is no longer necessary, you have withdrawn consent, you have objected, or it has been processed unlawfully;
• Object to the processing of your data, particularly for direct marketing purposes or where there is no overriding legitimate interest.
• restrict processing in certain cases, for example while we verify the accuracy of the data;
• receive your data in a structured format and transmit it to another controller (portability);
• object to processing based on legitimate interest and, at any time, to direct marketing;
• not be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you;
• withdraw consent at any time, without affecting processing carried out before withdrawal. For email tracking, simply use the Manage preferences link;
• Lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the authority in the EU country or UK where you live or work.

To exercise your rights, write to privacy@cubbit.io. We will respond within one month. Before proceeding, we may need to verify your identity.

8. UPDATES

We may update this Notice, for example due to changes in the law or in our Services. If we make significant changes, we will let you know by email or through a clearly visible notice on our website. The date of the last update is shown at the top.

‍