Privacy notice (art. 13 Reg. EU 2016/679)

Last updated: 24 March 2026

1. Data controller

Valerio Zappone Via Colle Prato Rinaldo 8a, 00030 San Cesareo (RM), Italy Email: support.muovilazio@webizio.it

2. Personal data collected

Email: collected via point-of-sale reporting forms and newsletter sign-up
Navigation data: collected in anonymous and aggregated form via Umami Analytics (no cookies, no identifying data)
Geolocation data: approximate location (only if the user grants it voluntarily) to sort results by proximity
Google Maps data: address and coordinates of businesses reported via the Google Places API
Merchant account data: email, name and Google identifier, collected via Google OAuth authentication at registration time
Business data: name, address, phone, opening hours, point-of-sale photos, entered by the merchant during registration
Session data: technical session cookies managed via Supabase Auth, required for the merchant restricted area to work

3. Purposes and legal basis

a) Newsletter and updates — Basis: explicit consent (art. 6.1.a GDPR). Purpose: send updates about new points of sale and service news. Consent is freely given, specific and revocable at any time.

b) Point-of-sale reports — Basis: legitimate interest (art. 6.1.f GDPR) to store the report. Sending email communications to the reporter happens only with prior explicit consent (art. 6.1.a).

c) Analytics — Basis: legitimate interest (art. 6.1.f GDPR). Purpose: aggregated traffic analysis. Data is fully anonymised and does not allow user identification.

d) Merchant account registration and management — Basis: pre-contractual and contractual measures (art. 6.1.b GDPR). Purpose: enable merchants to register and manage their point of sale on the platform.

4. Data recipients

Data may be shared with:

Vercel Inc. (USA) — hosting and CDN, adheres to the EU-US Data Privacy Framework
Supabase Inc. — PostgreSQL database, servers in the EU (Ireland)
Google LLC (USA) — Google Maps Platform API and OAuth authentication for merchants, adheres to the EU-US Data Privacy Framework
Resend Inc. (USA) — transactional email service, adheres to the EU-US Data Privacy Framework
Umami — open-source self-hosted analytics, fully anonymised data. No data is transferred to third parties.

5. Transfers outside the EU

Some providers are based in the USA. Transfers are lawful under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023).

6. Retention periods

Point-of-sale reports: 12 months from the closing/handling of the report
Newsletter data: kept until consent is withdrawn (opt-out), plus a further 12 months as proof of the consent given
Navigation data: anonymised, no time limit
Merchant account data: kept for the duration of the account. On deletion, data is removed within 30 days, except for data required by legal obligations.

7. Data subject rights

Under arts. 15-22 GDPR, the user has the right to:

Access their personal data
Have inaccurate data corrected
Have data erased (right to be forgotten)
Restrict processing
Obtain data portability
Object to processing
Withdraw consent at any time

To exercise these rights, write to: support.muovilazio@webizio.it

You may also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

8. Cookies

Muovi Lazio uses only technical cookies necessary for the site to function:

Session cookies (Supabase Auth): required for merchant area authentication. Duration: browser session.

No profiling, advertising or third-party cookies are used. Technical cookies do not require consent under art. 122 of the Italian Privacy Code (Legislative Decree 196/2003).

9. Changes

The Controller reserves the right to amend this notice. The latest version is always available on this page.