This document in other languages: Italiano Español Français Deutsch Português Română Polski Nederlands
PCO Suite Privacy Notice
Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) · version of 17 October 2026
1. Who processes the data
The controller is ComputerLab di Spoltore Fabio, Via Floraspe Renzetti 31, 66034 Lanciano (CH), Italy, VAT no. IT02841650696. For any privacy request: [email protected].
This notice covers the data ComputerLab processes on its own behalf: website visitors, people who register a company, administrators and users who contact support.
The data that companies enter into PCO Suite about their own clients, technicians and employees (records, jobs, signatures, GPS positions, attendance, documents) is processed by ComputerLab only on behalf of the company, which is its controller: for that data the notice is given by the company, and ComputerLab acts as processor under the Data Processing Agreement. If you are a technician or client of a company using PCO Suite, please contact that company first about your rights; if you write to us, we will forward your request.
2. What data we process, why and on what legal basis
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Company name, VAT or tax number, country, administrator email and password (hashed only), language | Register the company, create the account, give access to the Service | Performance of the contract (Art. 6.1.b) | For the duration of the contract; then as per Article 13 of the Terms |
| VAT number and email used for the free trial | Allow only one trial per company and prevent abuse | Legitimate interest (Art. 6.1.f) | 5 years from registration |
| Email confirmation code (hashed) | Verify that the email belongs to the person registering | Performance of the contract | 30 minutes, then deleted |
| Plan, modules, payment frequency, contract and any cancellation dates, usage (number of clients, technicians, storage used), payments received from Paddle (amount, date, status, invoice number) | Manage the subscription and limits | Performance of the contract | For the duration of the contract and 10 years after, for parts relevant to accounting |
| Billing details (company name, address, VAT number, tax code, SdI recipient code or PEC), invoices issued | Invoicing and tax obligations | Legal obligation (Art. 6.1.c) | 10 years (Art. 2220 of the Italian Civil Code) |
| Acceptance of the Terms and DPA and acknowledgement of this notice: version, date, time, IP address, email of the person accepting | Prove acceptance and the approval of clauses | Legitimate interest and legal obligation | 10 years from the end of the contract |
| Messages to support (email, WhatsApp) | Reply and solve problems | Performance of the contract and legitimate interest | Up to 24 months from the last contact |
| Problem reports sent from the app: note written by the user, role, company, version, technical log (pages opened, buttons tapped, errors; never passwords, keys or text typed in fields; emails masked) | Understand and fix malfunctions | Legitimate interest (Art. 6.1.f) | The technical log is deleted when the problem is resolved; the note up to 24 months |
| IP address and technical data of requests to the website and server | Operation and security; limiting sign-in and registration attempts | Legitimate interest | According to the providers' technical logs, normally no longer than 30 days |
We do not carry out profiling or automated decision-making, we do not use the data for advertising and we do not sell it to third parties. Providing the data marked as necessary is essential to register and use the Service.
3. Who we entrust it to
- Supabase Inc. – database, authentication and server functions, on Amazon Web Services servers in the European Union (Ireland) – processor.
- Cloudflare, Inc. – file storage in the European Union and hosting of this website – processor.
- Resend (Plus Five Five, Inc., USA) – sending service emails, such as the confirmation code – processor.
- Mapbox, Inc. (USA) – maps shown in the app: the device downloads the map images, which involves the IP address and the area displayed – processor.
- Aruba S.p.A. (Italy) – sending electronic invoices to the Italian Exchange System (SdI) – processor.
- Paddle.com Market Limited (United Kingdom) – reseller that sells the licence and collects its price: it collects payment and billing data directly from the Customer and processes them as an independent controller, under its own privacy notice on paddle.com. ComputerLab receives from Paddle only the customer's email, the amounts, dates and status of payments, never card data. The United Kingdom benefits from an adequacy decision of the European Commission.
- Accountant, advisers and authorities, only when required by law.
Some providers are based in the United States. In these cases the transfer takes place on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework, for participating companies) or the standard contractual clauses approved by the Commission.
4. Cookies
This website does not use cookies or analytics or advertising tools. The app does not use advertising tracking tools; it stores on the device only the settings needed to work (language, credentials remembered if you choose so, work data for offline use).
5. Your rights
You may at any time request access to your data, rectification, erasure, restriction of processing, portability and object to processing based on legitimate interest (Articles 15–22 GDPR) by writing to [email protected]. We reply within one month. A company administrator can also request directly from the app the deletion of the company and all its data (Settings → "Delete the company and all its data").
If you believe the processing breaches the law you may lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it), or the authority of the country where you live or work.
6. Users in Switzerland, the United Kingdom and the United States
- Switzerland: we also process data in compliance with the Federal Act on Data Protection (FADP). You may contact the Federal Data Protection and Information Commissioner (FDPIC).
- United Kingdom: we also process data in compliance with the UK GDPR and the Data Protection Act 2018. You may contact the Information Commissioner's Office (ICO). Transfers from the United Kingdom take place on the basis of UK adequacy regulations or the International Data Transfer Addendum.
- United States: we do not sell or share personal information for cross-context behavioural advertising, as defined by state privacy laws (for example the California Consumer Privacy Act). You may request to know, correct or delete your information by writing to the address above; you will not be discriminated against for doing so.
7. Security
Communications between the app and the server are encrypted (TLS); passwords are stored only as a hash (PBKDF2); each company's data is separated from that of others, also at database level; Cloud access requires an authenticated session. We process only the data strictly necessary.
8. Changes
We may update this notice; the version in force is always on this page, with its date at the top. We will notify administrators in the app of significant changes.