1. Data Controller
FIDUS S.R.L. is the data controller responsible for your personal data. We are registered in Italy and comply with the General Data Protection Regulation (GDPR) and Italian data protection laws.
2. Data We Collect
We collect the following categories of personal data:
Account Data
Name, email address, password hash, role, and profile settings.
Booking Data
Reservation dates, times, party size, special requests, and booking status.
Customer Data
Names, email addresses, phone numbers, and communication preferences of your end customers.
Payment Data
Billing address, payment method details (processed by Stripe), and transaction history.
Technical Data
IP addresses, browser type, device information, and access logs.
Communication Data
Emails sent through the platform, support tickets, and feedback.
Usage Data
Feature usage patterns, dashboard interactions, and analytics events.
3. Legal Basis for Processing
We process your data based on the following legal grounds:
Consent
For marketing communications and optional analytics.
Contract Performance
To provide the booking platform services you subscribed to.
Legal Obligation
To comply with tax, accounting, and regulatory requirements.
Legitimate Interests
For security monitoring, fraud prevention, and service improvement.
4. How We Use Your Data
We use your personal data for the following purposes:
- Processing and managing reservations and bookings
- Managing user accounts and business profiles
- Sending transactional emails (confirmations, reminders, notifications)
- Marketing communications (with your consent)
- Processing payments and managing subscriptions
- Error monitoring and platform stability
- Security monitoring and fraud prevention
- Analytics and service improvement
- Compliance with legal obligations
5. Third-Party Processors
We share data with the following categories of processors:
| Processor | Purpose | Location | DPA Status |
|---|---|---|---|
| Resend | Transactional email delivery | EU | Signed |
| Twilio | SMS notifications | US | Signed (SCCs) |
| Sentry | Error monitoring | EU | Signed |
| Stripe | Payment processing | US/EU | Signed (PCI-DSS + SCCs) |
| Hetzner | Cloud hosting | Germany, EU | Signed |
| PostgreSQL (Hetzner) | Primary database | Germany, EU | Signed |
For a complete list of sub-processors, see our Sub-Processors page.
For our data processing terms, see our Data Processing Agreement.
6. International Data Transfers
Your data is primarily stored in the EU (Germany). When transfers to third countries are necessary (e.g., Twilio in the US), we rely on EU Standard Contractual Clauses (SCCs) or adequacy decisions to ensure adequate protection.
7. Data Retention
We retain your data for the following periods:
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Customer Records | Duration of account + 5 years | Legal obligation (tax/accounting) |
| Reservation Records | Duration of account + 3 years | Contract performance + legitimate interest |
| Email Outbox | 90 days after sending | Contract performance |
| Audit Logs | 2 years | Legitimate interest (security) |
| Session Tokens | 30 days after expiry | Contract performance |
| IP Address Logs | 90 days | Legitimate interest (security) |
| Account Data | Duration of account + 30 days | Contract performance |
| Payment Records | 10 years | Legal obligation (Italian tax law) |
8. Your Rights
Under the GDPR, you have the following rights:
Right of Access (Art. 15)
You have the right to request a copy of all personal data we hold about you. We will respond within 30 days. Contact privacy@fidus.media.
Right to Rectification (Art. 16)
You may request correction of inaccurate personal data. Update your information in dashboard settings or contact us.
Right to Erasure (Art. 17)
You have the right to request deletion of your personal data. Request account deletion via your dashboard settings or email us. Subject to legal retention obligations.
Right to Restrict Processing (Art. 18)
You may request that we temporarily restrict processing of your data. We will mark your data as restricted and cease processing except for storage.
Right to Data Portability (Art. 20)
You have the right to receive your personal data in a machine-readable format (JSON). Submit a data portability request via email.
Right to Object (Art. 21)
You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
Automated Decision-Making (Art. 22)
We do not make solely automated decisions that produce legal effects concerning you. If this changes, we will obtain your explicit consent.
Right to Withdraw Consent (Art. 7(3))
You may withdraw consent at any time without affecting the lawfulness of prior processing. Use cookie settings, unsubscribe links, or email us.
Right to Lodge a Complaint (Art. 77)
You have the right to lodge a complaint with your local supervisory authority. For Italy: Garante per la protezione dei dati personali (www.garanteprivacy.it).
9. Data Security
We implement industry-standard security measures including encryption at rest and in transit (TLS 1.3), access controls, regular security audits, and automated vulnerability scanning. See our Security page for details.
10. Children's Data
Our platform is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us immediately.
11. Cookie Policy
We use cookies and similar technologies on our platform. For full details, see our Cookie Policy.
Essential Cookies
Required for the platform to function, including authentication tokens, CSRF protection, and language preferences. These cannot be disabled.
Non-Essential Cookies
Analytics and marketing cookies are only set with your explicit consent. You can manage your preferences at any time via the cookie settings in the footer.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users. The latest version is always available on this page.
13. Contact
For privacy-related inquiries:
- Email: privacy@fidus.media
- Company: FIDUS S.R.L., Via Filippo Corridoni 25, 00195 Roma (RM), Italy
- PEC: fidus.srl@legalmail.it
Requests are handled within the statutory timeline applicable to their type and circumstances.