Privacy Policy

Personal Data Processing Policy

Pursuant to Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, Systema360 S.r.l. provides the following information on the processing of personal data of users who visit this website.

1. Data controller

The data controller is:

• Systema360 S.r.l.
• Registered office: 85100 Potenza (PZ)
• VAT number / Tax code: 02227730765
• Certified email (PEC): systema360@pec.it
• Email: info@systema360.it

1Bis. Privacy Contact

For any questions regarding the protection of personal data, please contact the Privacy Officer at: privacy@systema360.it.

2. Types of data collected

Browsing data

The IT systems used to operate this website automatically collect certain personal data whose transmission is implicit in the use of Internet communication protocols (e.g. IP addresses, browser type, operating system, pages visited, time of request). IP addresses are anonymized (last octet masked) before storage.

Data voluntarily provided by the user

Sending messages via the website contact form entails the collection of the following data: name, email address, phone number (optional), company (optional), subject and message text. Upon submission, the timestamp of the privacy consent given by the user is also recorded.

Newsletter subscription

Optional subscription to the newsletter entails the processing of the following data: email address, preferred language, anonymized IP address, date and version of the consent given. Subscription uses a double opt-in mechanism: after signing up, a confirmation email is sent and data is processed only after the address is explicitly confirmed. The legal basis is consent (Art. 6.1.a GDPR), which can be withdrawn at any time via the link included in every email. Technical delivery is handled by Amazon SES (Amazon Web Services), an external data processor pursuant to Art. 28 GDPR, with processing on servers located in the European Union (Milan region, eu-south-1). Subscribers who do not confirm within 30 days are automatically deleted.

Upcoming product waiting list

Pages for products not yet released offer an optional form to receive a launch notice. Submitting it entails the processing of the following data: email address, product of interest, anonymized IP address and date of the consent given. The legal basis is consent (Art. 6.1.a GDPR), given through the dedicated checkbox at submission and withdrawable at any time by writing to privacy@systema360.it. The data is used only to confirm the sign-up and to send the launch notice for the product, with no further promotional use, and is deleted upon request. Email delivery is handled by Amazon SES (Amazon Web Services), an external data processor pursuant to Art. 28 GDPR, with processing on servers located in the European Union (Milan region, eu-south-1).

3. Purposes of processing

Personal data are processed for the following purposes:

• Responding to contact and information requests sent through the form on the website
• Complying with legal, regulatory and EU obligations
• Improving the functioning and security of the website

4. Legal basis for processing

Data processing is based on the following legal grounds under Article 6 of the GDPR:

• Art. 6.1.a, Consent: the user consents to the processing of their personal data when submitting the contact form
• Art. 6.1.b, Pre-contractual measures: processing is necessary to respond to the user's requests prior to the possible conclusion of a contract
• Art. 6.1.f, Legitimate interest: the processing of browsing data is necessary to ensure the proper functioning and security of the website

5. Data recipients

Personal data may be shared with:

• IT service providers (hosting, email, technical maintenance) acting as data processors pursuant to Article 28 of the GDPR
• Entities to whom disclosure is required by law or regulation

Personal data is not sold. Disclosures to the recipients described in this policy include, after consent, data sent to Meta from the turni pages.

6. Transfer of data outside the EU

Should it become necessary to transfer personal data to countries outside the European Union, the transfer will be carried out in compliance with Chapter V GDPR, using adequacy decisions under Article 45 or appropriate safeguards under Article 46, including standard contractual clauses.

7. Retention period

• Contact form data: retained for a maximum period of 24 months from collection, unless otherwise required by law. Deletion is performed automatically via a scheduled procedure
• Browsing data: retained for a maximum period of 12 months

8. Rights of the data subject

Pursuant to Articles 15-22 of the GDPR, the user has the right to:

• Access: obtain confirmation of the existence of processing and access to their data
• Rectification: obtain correction of inaccurate data or completion of incomplete data
• Erasure: obtain deletion of their data in cases provided for by law
• Restriction: obtain restriction of processing in cases provided for by law
• Portability: receive their data in a structured, commonly used and machine-readable format (Art. 20 GDPR). A data export function is available in the website's reserved area
• Objection: object to the processing of their data on legitimate grounds
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal

To exercise these rights, the user may send a written request to privacy@systema360.it, to the general address info@systema360.it or via certified email (PEC) to systema360@pec.it.

The user also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

9. Statistical analysis

This website uses Umami, a self-hosted web analytics platform hosted on European infrastructure managed by the data controller, without sending data to an external analytics provider. Umami operates in cookieless mode, does not install cookies on the user's device, does not perform advertising profiling and does not track users across different websites.

Umami processes browsing data including the page URL and title, referrer, browser, operating system, device type, screen resolution, language and approximate geographic area. To distinguish visits, it generates a pseudonymous session identifier from the IP address, user agent and website identifier. The IP address is not displayed in reports, but it contributes to generating the identifier. Authorized administrators can view sessions and the associated browsing activity. This information is not used to identify the user directly.

Umami data is retained in the data controller's instance and automatically deleted after 12 months by a scheduled procedure. Users may object to this processing by writing to privacy@systema360.it.

Additionally, the website internally records browsing events for statistical purposes (pages visited, time of access). IP addresses are anonymized (last octet masked for IPv4, /48 prefix for IPv6) before storage.

The legal basis for the processing of this data is the legitimate interest of the data controller (Art. 6.1.f GDPR) in improving the functioning of the website, in compliance with the principle of data minimization.

10. Cookies

The website uses necessary cookies for functionality and preferences. Only on the turni product pages, after consent, it uses Meta marketing cookies as described in the dedicated section.

For detailed information, please refer to our Cookie Policy.

11. Security measures

To protect users' personal data, the data controller has adopted the following technical measures:

• HTTPS connection with TLS encryption for all communications
• HTTP security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
• IP address anonymization before storage
• Encryption of user sessions

11Bis. Transparency on AI-generated content

Visual content published on this website may include images generated or modified with artificial intelligence systems. Such images are labelled as such directly on the website, in accordance with the transparency obligations set out in Article 50 of Regulation (EU) 2024/1689 (AI Act).

12. Official social media pages

The data controller runs official Facebook pages for itself and for its products, currently Systema360, acepoint, speedcalc, snipsy, notavia, mnemia and turni.

For the aggregated statistics Meta makes available to page administrators, known as Page Insights, the data controller and Meta Platforms Ireland Limited act as joint controllers pursuant to Article 26 of the GDPR. Meta independently determines the purposes and means of the processing carried out through its own platform, and the related information is published by Meta in its own terms and policy.

The data controller only receives aggregated, non-identifiable statistics on the interactions with its pages. It has no access to the personal data held by Meta and does not use it for any other purpose.

Interacting with the pages, such as following, liking, commenting or sending messages, happens on Meta's platform and is subject to Meta's terms. The links to those pages on this website are plain links and set no cookies.

The rights under Articles 15 to 22 of the GDPR may be exercised against either joint controller. To exercise them with the data controller, write to privacy@systema360.it.

13. Changes to this policy

The data controller reserves the right to amend this policy at any time. Users are invited to check this page periodically.

Last updated: 09/10/2026

Campaign measurement on the turni website

This section concerns the /it/turni and /en/turni web pages on systema360.it, which are separate from the turni app.

Only after consent to marketing cookies do these pages load the Meta pixel to measure campaigns, attribute visits and clicks to the App Store and Google Play, and enable personalised advertising.

Meta Platforms Ireland Limited receives the PageView visit event and the TurniStoreClick event with the selected store, together with technical data such as IP address, browser, page URL, permitted referral information and advertising cookie identifiers.

We do not send Meta shifts, hours worked, pay data, iCloud data or content entered in the app. Automatic advanced matching and automatic event collection are disabled.

The legal basis is consent under Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code. Refusing does not limit browsing or use of the app.

For collection and transmission of data through the pixel, the controller and Meta act as joint controllers within the scope of the Meta Controller Addendum. Meta processes data subsequently on its own systems under its Privacy Policy, which also explains retention and international transfers.

Systema360 provides the website notice and collects consent. Meta is responsible for the security of its tools and for handling requests under Articles 15 to 20 GDPR concerning data held on its systems. You may contact either joint controller. We forward requests about Meta’s processing to Meta and cooperate in handling them.

Meta may process data outside the European Economic Area using the instruments provided by Chapter V GDPR, including adequacy decisions or standard contractual clauses, under the applicable terms published by Meta.

You can reject, accept or customise in the banner and change or withdraw your choice using the Cookie and privacy preferences button on the website. Withdrawal stops subsequent events and removes pixel cookies accessible to the website. It does not undo processing carried out before withdrawal.

The browser choice lasts 180 days. The controller retains evidence of the choice, including its date, policy version, categories, random browser reference, hashed IP address and user agent, for up to 24 months to document consent and changes.

To exercise your GDPR rights, contact privacy@systema360.it or Meta. You can also lodge a complaint with the Italian Data Protection Authority.

The website’s Umami statistics remain separate from the pixel. For cookies, retention and preferences, see the Cookie Policy.