turni Privacy Policy
1. Controller and contacts
The data controller is Systema360 S.r.l.. You can contact us at info@systema360.it, certified email systema360@pec.it, or 85100 Potenza (PZ). For privacy matters, write to privacy@systema360.it. VAT or tax number 02227730765.
2. Scope and data entered in the app
This policy covers turni for iOS and Android. The app handles the shifts, schedules, contract settings, variable components, absences, notes and preferences that you enter.
3. Shift data storage
On Android, shift data stays in the app’s local storage. On Apple devices, it stays in local storage and, when iCloud is available and enabled, may sync to your private iCloud database through CloudKit. Systema360 has no application backend that receives shifts, schedules, notes or work settings.
4. Optional functions and permissions
Local notifications, reminders, Apple Calendar and biometric authentication, where available, are managed through operating system APIs and require your choice or permission. turni receives only the authentication result and does not read or store biometric data.
5. Purchases and Premium verification
Apple or Google handles payment and card data under its own privacy notice. turni receives product, transaction and subscription status information needed to purchase, restore and maintain Premium.
On Android, to verify Premium and prevent abuse, the app sends over HTTPS to a Systema360 service the package identifier, product and plan, Google Play purchase token, a cryptographic hash of the installation key, a Play Integrity token and a random request identifier. The service queries the Google Play and Play Integrity APIs, returns a signed entitlement for that installation and does not receive shift data.
6. Purposes and legal bases
We process technical purchase information to provide Premium and perform the contract under Article 6(1)(b) GDPR. We verify app integrity and prevent fraud and abuse for our legitimate interest in service security under Article 6(1)(f) GDPR. We do not use app data for advertising, profiling or sale to third parties and do not integrate behavioural analytics tools.
7. Recipients and transfers
Apple and Google process purchases and platform services under their respective privacy notices. For Android verification, we may use Google Play, Play Integrity and Google Cloud infrastructure as technical providers. These providers may process data outside the European Economic Area using the transfer mechanisms described in their applicable terms and privacy notices.
8. Retention and deletion
Local data remains on the device until you delete it in the app or remove the app. Data synced with iCloud remains in your private space and follows iCloud deletion and retention functions.
The Android verification service does not store request contents in a database. It may create minimal technical logs containing the request identifier, outcome, status-code class, approximate duration and error code. Purchase and Play Integrity tokens are not logged. Technical logs are kept only as long as necessary for security and diagnostics under the infrastructure configuration. Apple and Google retain purchase records under their own policies and applicable obligations.
9. Security
We use encrypted connections, signed entitlements and technical measures proportionate to the nature of the data. No system can guarantee absolute security, and you should protect your device and Store account.
10. Minors
Turni is intended for people aged 18 or over and is not designed to knowingly collect data from minors.
11. GDPR rights
You may request access, rectification, erasure, restriction, portability or object to processing where provided by the GDPR by writing to privacy@systema360.it. You may also lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority in your country.
12. Changes and effective date
We may update this policy when the processing described changes. Effective date 13 September 2026.
Campaign measurement on the turni website
This section concerns the /it/turni and /en/turni web pages on systema360.it, which are separate from the turni app.
Only after consent to marketing cookies do these pages load the Meta pixel to measure campaigns, attribute visits and clicks to the App Store and Google Play, and enable personalised advertising.
Meta Platforms Ireland Limited receives the PageView visit event and the TurniStoreClick event with the selected store, together with technical data such as IP address, browser, page URL, permitted referral information and advertising cookie identifiers.
We do not send Meta shifts, hours worked, pay data, iCloud data or content entered in the app. Automatic advanced matching and automatic event collection are disabled.
The legal basis is consent under Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code. Refusing does not limit browsing or use of the app.
For collection and transmission of data through the pixel, the controller and Meta act as joint controllers within the scope of the Meta Controller Addendum. Meta processes data subsequently on its own systems under its Privacy Policy, which also explains retention and international transfers.
Systema360 provides the website notice and collects consent. Meta is responsible for the security of its tools and for handling requests under Articles 15 to 20 GDPR concerning data held on its systems. You may contact either joint controller. We forward requests about Meta’s processing to Meta and cooperate in handling them.
Meta may process data outside the European Economic Area using the instruments provided by Chapter V GDPR, including adequacy decisions or standard contractual clauses, under the applicable terms published by Meta.
You can reject, accept or customise in the banner and change or withdraw your choice using the Cookie and privacy preferences button on the website. Withdrawal stops subsequent events and removes pixel cookies accessible to the website. It does not undo processing carried out before withdrawal.
The browser choice lasts 180 days. The controller retains evidence of the choice, including its date, policy version, categories, random browser reference, hashed IP address and user agent, for up to 24 months to document consent and changes.
To exercise your GDPR rights, contact privacy@systema360.it or Meta. You can also lodge a complaint with the Italian Data Protection Authority.
The website’s Umami statistics remain separate from the pixel. For cookies, retention and preferences, see the Cookie Policy.