Privacy Policy

This policy describes how ChilometroZero processes users' personal data, in accordance with Regulation (EU) 2016/679 (GDPR).

1. DATA CONTROLLER

The data controller is Francesco Zerbinatti, a natural person, developer and operator of the ChilometroZero application.

Contact email: ChilometroZero.app@gmail.com

No data protection officer (DPO) has been appointed, as the legal requirements for doing so do not apply.

2. DATA COLLECTED

a) Registration data: full name, email address, password (in encrypted form). If you sign in with Google or Apple, we receive the account identifier and email address from the provider; with Apple you can hide your real email address.

b) Profile data: photograph, biography, dietary preferences and, for sellers, business details (business name, VAT number, address, telephone contact).

c) Location: used to show you the listings closest to you and to place collection points on the map. Precise location is requested only with your consent and can be revoked from your system settings.

d) Content: listings, photographs, chat messages, ratings and reviews.

e) Order data: products ordered, quantities, amounts, place and time of collection.

f) Push notification identifier, if you choose to enable notifications.

g) Billing data for sellers subject to the service fee: tax details needed to issue the invoice, history of amounts due and paid, payment outcomes. Card and bank account details are not stored by ChilometroZero but handled directly by the payment service provider.

3. PURPOSES AND LEGAL BASES

- Providing the service and performing the contract (Art. 6.1.b GDPR): account management, publishing listings, chat, orders.

- Consent (Art. 6.1.a GDPR): geolocation, push notifications and promotional messages, where you have accepted them. Consent can be withdrawn at any time.

- Legitimate interest (Art. 6.1.f GDPR): platform security, abuse prevention, handling reports.

- Legal obligations (Art. 6.1.c GDPR).

4. DISCLOSURE OF DATA

Some data is visible to other users so the service can work: your name, profile photograph, published listings and, for sellers, business details and collection point. A seller's telephone number is shown only if they have chosen to make it visible.

We use Google Firebase (Google Ireland Limited) as infrastructure provider for authentication, database, image storage and notifications. Data is hosted on servers located in the European Union.

For sellers subject to the service fee we also use a payment service provider, to collect the amounts due, and an electronic invoicing service, to issue invoices and transmit them to the Italian Exchange System. Only the data necessary for these purposes is shared with those providers.

5. RETENTION

Data is retained for as long as necessary to provide the service. When your account is deleted, your profile, listings, chats and photographs are permanently removed. Data relating to completed orders may be retained by the other party and for the period required by any legal obligation. Invoices and accounting records relating to service fees are retained for ten years, as required by tax law, including after the account has been deleted.

6. RECORD OF UNPAID AMOUNTS

If a seller leaves amounts due as service fees unpaid beyond the deadlines set out in the Terms of Service, we retain their identifying details (email address, business name and amount due) even if the account is deleted. The legal basis is legitimate interest (Art. 6.1.f GDPR) in preventing the payment obligation from being avoided by opening a new account. Only the data necessary for this purpose is retained, and it is deleted once the amount is settled.

7. YOUR RIGHTS

You may exercise at any time the rights of access, rectification, erasure, restriction, portability and objection provided for by Articles 15-22 GDPR, by writing to the email address given in section 1. You may also lodge a complaint with the Italian Data Protection Authority.

Account deletion is available directly in the App, in the Profile section.

8. MINORS

The service is not intended for people under 18 and we do not knowingly collect their data.