Privacy Policy

01Scope

This document is an essential element of the relationship between the Data Controller (hereinafter also the "Provider" and/or "Controller") and the user, regardless of any purchase or use of the services offered.

This privacy policy applies to this digital platform, available at eagleos.io (hereinafter also the "Site" and/or "Portal"). The Eagle OS service installed at clients is governed by a separate notice and contract, provided at signature.

This notice also describes the rights of data subjects in relation to the processing of their personal data.

02Data controller

The Data Controller is Elysir Digital LLC — EIN 30-1441698 — 418 Broadway #6851, Albany, NY 12207, USA — info@elysir.digital — +1 (607) 250 3129.

The Controller has not appointed a Data Protection Officer (DPO), not being required to: for any request you can write to the address above.

03General information

• This document describes how the Data Controller processes personal data provided through the Site.
• This notice may change due to the introduction and/or amendment of the applicable legal framework; users are therefore invited to check this page periodically.
• Where the user has entered into a specific contractual relationship with the Controller (installation and licence of Eagle OS), their personal data will also be used in accordance with the separate notices they will receive.
• Where the user is under 14 years of age, pursuant to art. 8(1) of Regulation (EU) 2016/679, their consent must be validated through the authorisation of a parent or legal guardian. The Site is in any case aimed at professionals and businesses.

04Definitions

Pursuant to the legislation referred to above:

"Processing" means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

05Data we process

The Site collects only the data needed to answer a contact request and to make the pages work.

• "Book a call" form data: first name, last name, email, phone, company name, range of apartments managed and, if you fill them in, the channel manager you use and free-text notes. Providing them is necessary to be contacted back; fields marked as optional can be left empty with no consequence.
• Browsing data: the IT systems running the Site acquire, in their normal operation, some technical data whose transmission is implicit in internet protocols (IP address, browser type, time of the request, page requested). They are used only for security and to deliver the service correctly, and are deleted periodically.
• Statistical data: if enabled, the Site uses a traffic-analytics service that works without cookies and without identifying the visitor, in aggregated and anonymous form only.

The Site does not process "special categories of data" (racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, genetic, biometric, health or sex-life data) nor judicial data. Please do not enter them in the notes field.

The Site does not implement geolocation tools based on the user's IP address.

06Purposes of processing

Data is processed for the following purposes:

• to answer your request, organise the call and assess together whether Eagle OS makes sense for your company;
• to send you, after the call, the proposal and documentation you asked for and manage the pre-contractual relationship;
• if you become a client, to perform the contract and fulfil the related accounting and tax obligations;
• to keep the Site secure (anti-spam filters, firewall, abuse prevention);
• to comply with obligations laid down by law, regulation, EU legislation or an order of the Authorities;
• to exercise or defend the Controller's rights, including in legal proceedings.

If you are already our client, we may send you communications about services similar to those you already use (art. 130(4) of the Italian Privacy Code), unless you object — which you can do at any time by writing to info@elysir.digital.

The Site does not profile users and does not send newsletters or third-party promotional communications. Calls are recorded only with explicit prior notice and your consent.

07Legal basis

• Performance of pre-contractual measures taken at your request and, later, performance of the contract (art. 6(1)(b) GDPR): for handling the call request, the proposal and the client relationship.
• Compliance with legal obligations (art. 6(1)(c) GDPR): for accounting and tax obligations and requests from the Authorities.
• Legitimate interest of the Controller (art. 6(1)(f) GDPR): for the security of the Site, anonymous statistics and the defence of its rights. This interest is balanced against the user's rights and involves no profiling.
• Consent (art. 6(1)(a) GDPR): only for any further processing proposed to you explicitly and separately. Consent can always be withdrawn by writing to the Controller, without affecting the lawfulness of processing carried out before withdrawal.

08Recipients and disclosure

The Controller processes users' data in compliance with the principles of lawfulness and fairness, with technical and organisational measures appropriate to ensure its security.

Besides the Controller, data may be accessed by the people involved in running the Site and the service (administrative, sales and technical staff), bound by confidentiality duties, and by external providers acting as processors under art. 28 GDPR: hosting providers, email and notification services, tools for managing contacts and call bookings, anonymous analytics services. Providers access only the data needed to perform their task and may not use it for other purposes. The updated list of processors is available on request.

Without the need for consent (art. 6(1)(b) and (c) GDPR), the Controller may disclose data to supervisory bodies, judicial authorities, legal and tax advisers and any party to whom disclosure is mandatory by law. Such parties process the data as independent controllers.

Data is not disseminated nor sold to third parties for marketing purposes.

09Place of processing and transfers outside the EU

Processing takes place at the Controller's premises and on servers made available by third-party providers located in the European Union. Clients' Eagle OS instances are hosted in the European Union.

Since the Controller is based in the United States and some providers may operate outside the European Union, data may be transferred to the United States or other third countries. In that case the Controller guarantees that the transfer complies with art. 44 et seq. GDPR: to countries covered by an adequacy decision of the European Commission or, failing that, on the basis of the Standard Contractual Clauses approved by the European Commission on 4 June 2021 and appropriate supplementary measures. You can ask about the safeguards adopted by writing to the Controller.

10Data retention

Data is kept only for as long as needed for the purposes it was collected for:

• call-request data that does not turn into a contract: up to 24 months from the last contact, then deleted or anonymised;
• client data: for the duration of the contract and, afterwards, for the period required by accounting and tax obligations (normally 10 years) and to exercise the Controller's rights;
• browsing data and security logs: deleted periodically, normally within 12 months;
• statistical data: collected in aggregated and anonymous form from the start.

At the end of these periods data is deleted or anonymised. The Controller may keep data longer only where required by law or to defend a right in legal proceedings.

11Methods of processing and security

Processing is carried out with IT and telematic tools, with logic strictly related to the stated purposes, through the operations set out in art. 4(2) GDPR. Data is stored in protected IT environments with access restricted to authorised staff, encrypted keys and credentials, and periodic backups.

Specific measures are adopted against misuse, loss, unauthorised access, manipulation or disclosure of data. No operator can guarantee the absolute security of information transmitted over the network: in case of a personal-data breach the Controller will act as provided by artt. 33 and 34 GDPR.

No decision concerning you is based solely on automated processing.

12Your rights

Under artt. 15–22 of Regulation (EU) 2016/679 you have the right to:

• access (art. 15): obtain confirmation that processing is taking place and receive a copy of your data;
• rectification (art. 16): correct or complete inaccurate or incomplete data;
• erasure (art. 17): request the erasure, anonymisation or blocking of data processed unlawfully or no longer necessary;
• restriction (art. 18): ask that data be merely stored pending checks;
• portability (art. 20): receive your data in a structured, commonly used format;
• objection (art. 21): object at any time to processing based on legitimate interest;
• withdraw consent, where processing is based on consent, without affecting the lawfulness of prior processing;
• obtain confirmation that the requested operations have been carried out.

You can exercise these rights at any time by writing to info@elysir.digital, clearly stating the right invoked and the operation requested. We reply within 30 days of receipt; for complex requests the deadline may be extended by a further 60 days with a reasoned notice.

If you believe the processing infringes the law, you have the right to lodge a complaint with the competent supervisory authority: in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it), or the authority of your Member State of residence.

13How to request data deletion

You can request deletion of your personal data at any time, free of charge, including under the CCPA/CPRA if you are a California resident.

• Email info@elysir.digital with the subject "Data deletion request – GDPR".
• Include your full name (or company name) and the email address or phone number you used to contact us.
• State what you want deleted: all of it or specific items (for example contact details or files you sent us).
• If an authorised agent submits the request on your behalf, attach proof of authorisation.

To protect you against fraudulent requests we may ask for additional information to verify your identity (for example a confirmation from the registered email address); we never ask for full identity documents or payment details. We acknowledge your request within 72 hours and complete it within 30 days.

Some data may be retained where law requires or permits it: accounting and tax obligations (invoices, contracts), legal defence, fraud prevention and managing opt-out requests. In such cases we will tell you which data remains and for how long.

14Minors

The Site and the Eagle OS services are aimed at businesses and professionals. We do not knowingly collect data from children under 14; should we become aware of such a submission, the data would be deleted promptly.

15Changes to this notice

This document may be changed or updated, including to comply with new legal provisions or changes to the Site. The version in force is always the one published on this page, with the last-updated date shown at the top. In case of substantial changes affecting data already collected, we will inform the data subjects.

For cookie-related matters please refer to the Cookie Policy; for the use of the Site, to the Terms & Conditions.