Privacy Policy

1. Introduction

This Privacy Policy describes how QUOVAI S.r.l. processes the personal data of users who visit the quovai.com website and use the services offered by Quovai.

Personal data is processed in compliance with Regulation (EU) 2016/679 (“GDPR”) and with the applicable legislation on the protection of personal data.

The Quovai services are intended exclusively for users of legal age. We do not knowingly collect personal data relating to persons under 18 years of age.

2. Data controller

The data controller is:

QUOVAI S.r.l.
Registered with the Companies Register of Varese
REA VA-398327
VAT no. 01871320493
Email: hello@quovai.com
Phone: +39 02 87198048

3. What personal data we collect

Browsing data

During normal browsing on the website, the IT systems and software procedures used to operate the website may acquire certain technical data.

Such data may include, by way of example, the IP address, the type of browser used, information about the device and data relating to access to the website.

This data is processed to ensure the correct operation and security of the website and of the Quovai services.

Data provided voluntarily by the user

When the user uses the “Request Info” form or contacts Quovai, we may collect the data provided voluntarily, including:

• first and last name;
• email address;
• website;
• name of the property;
• information entered in the free-text field;
• any further information communicated voluntarily by the user.

The data is used exclusively to respond to the user's request, to provide information about the Quovai services and, where requested, to allow access to the software trial or to start a commercial negotiation.

4. Purposes and legal bases of the processing

Personal data may be processed for the following purposes:

Handling information requests and software trial requests

The processing is necessary to respond to the user's requests and to carry out pre-contractual measures adopted at the request of the data subject, pursuant to Art. 6(1)(b) of the GDPR.

Provision of the Quovai services

When the user uses the Quovai services, the data is processed to the extent necessary for the performance of the contract and the provision of the requested services.

Security of systems and services

Certain data may be processed to ensure security, prevent misuse and protect Quovai's IT systems. This processing is based on the legitimate interest of the data controller, pursuant to Art. 6(1)(f) of the GDPR.

Compliance with legal obligations

Data may be processed where necessary to comply with legal, tax and administrative obligations or requests from the competent authorities.

Where specific processing activities require the user's consent, such consent will be requested separately and may be withdrawn at any time.

5. Place of processing and data transfers

The processing connected with the Quovai services is carried out through IT infrastructures and technical service providers used by QUOVAI S.r.l.

Quovai uses, among others, Aruba Data Centers located in Italy and Hetzner Data Centers located in Germany and Finland.

The data is processed mainly within the European Economic Area (“EEA”).

Should the use of specific providers or technological services involve the transfer of personal data to countries located outside the EEA, the transfer will take place in compliance with Art. 44 et seq. of the GDPR and on the basis of the safeguards provided for by the applicable legislation, such as adequacy decisions of the European Commission or standard contractual clauses.

6. To whom the data may be disclosed

QUOVAI S.r.l. does not sell users' personal data to third parties.

Personal data may be processed or disclosed to service providers strictly necessary for the operation and provision of the Quovai services, including:

• hosting and Data Center providers;
• cloud infrastructure providers;
• email service providers;
• technology and software service providers;
• consultants and professionals, where necessary;
• other parties involved in the provision of the services requested by the user.

These parties process the data in compliance with the applicable legislation and, where required, are appointed as data processors pursuant to Art. 28 of the GDPR.

Data may also be disclosed to the competent authorities or to other parties where required by law or in the presence of a legitimate request from the authorities.

7. Cookies and tracking tools

The Quovai website may use cookies and other technical tools necessary for the correct operation of the website.

For more information about the cookies used, their purposes and how to manage your preferences, please refer to our dedicated Cookie Policy.

8. How long we keep personal data

Personal data is kept for the time strictly necessary to achieve the purposes for which it was collected, in compliance with the principles of data minimisation and storage limitation provided for by the GDPR.

Data collected through the “Request Info” form is kept for a maximum period of 3 months from the request, unless a pre-contractual or contractual relationship is started that justifies its further retention.

Data relating to customers and to the use of the Quovai services is kept for the duration of the contractual relationship and, subsequently, for the period necessary to comply with legal obligations and to protect the rights of QUOVAI S.r.l.

For data processed as part of the “Umano” service, the specific retention arrangements set out in the dedicated section also apply.

9. How we protect personal data

QUOVAI S.r.l. adopts technical and organisational measures appropriate to the risk in order to protect personal data against unauthorised access, loss, alteration, destruction or disclosure.

Communications between the user's browser and the Quovai services are protected by means of HTTPS/TLS protocols.

Quovai also adopts authentication systems, access control and restriction of data access to only those systems and persons authorised and necessary for the provision of the services.

Despite the adoption of adequate security measures, no IT system or transmission system over the Internet can guarantee absolute security.

The Quovai website may contain links to sites or services operated by third parties. QUOVAI S.r.l. is not responsible for the personal data processing practices adopted by such parties. We invite users to consult the relevant privacy policies before providing personal data.

10. Access to emails through email services – “Umano” service

Should the user choose to use the “Umano” service offered by Quovai, they may authorise the application to access their email inbox through third-party services, including the Google Gmail API.

Access to the inbox takes place exclusively upon the user's explicit authorisation through the authentication and authorisation system provided by the email service provider.

For Gmail, Quovai requests only the permissions necessary for the operation of the features of the “Umano” service.

Type of data accessed

Following the user's authorisation, the service may access the following data contained in the emails:

• the content of the email messages;
• the subject of the emails;
• the email address of the sender;
• the email address of the recipient and of any additional recipients;
• the date and time of the message;
• any attachments contained in the emails;
• technical metadata necessary for the processing and management of the messages.

Purposes of the processing

The email data is used exclusively to provide the features requested by the user as part of the “Umano” service and, in particular, to:

• automatically analyse the requests received by email;
• extract the information necessary to handle guest or customer requests;
• generate quotes in an automated way;
• prepare drafts or automatic replies to the requests received;
• enable the operation of the automations configured by the user as part of the service.

The data obtained through access to the emails is not used for advertising purposes, for commercial profiling or for sale to third parties.

The data obtained through the Gmail API is not used to train general-purpose artificial intelligence models or artificial intelligence models intended for purposes other than the provision of the features requested by the user.

Use of data obtained through Google APIs

The use and transfer to any other application of information received from Google APIs takes place in compliance with the Google API Services User Data Policy, including the Limited Use requirements.

The data obtained through Google APIs is used exclusively to provide and improve the features of the “Umano” service requested by the user, in compliance with the authorisations granted by the user.

Access to Google User Data is limited to the purposes described in this Privacy Policy.

Sharing and processing of email data

The data obtained through access to the emails is neither sold nor transferred to third parties for commercial or advertising purposes.

The data may be processed:

• by Quovai's IT systems;
• by hosting and cloud infrastructure providers;
• by technology providers strictly necessary for processing the data and operating the “Umano” service.

Any access to the data by natural persons is limited to cases strictly necessary for security purposes, technical support, troubleshooting or compliance with legal obligations, in compliance with the authorisations and security measures adopted by Quovai.

Retention of email data

The data extracted or processed from the emails is kept exclusively for the time necessary to provide the features of the “Umano” service requested by the user.

The retention period is determined on the basis of the nature of the data, the feature used and the technical requirements necessary for the provision of the service, in compliance with the principles of data minimisation and storage limitation provided for by the GDPR.

When the data is no longer necessary for the purposes for which it was processed, it is deleted or anonymised, unless retention is necessary to comply with legal obligations or to protect the rights of QUOVAI S.r.l.

Withdrawal of access and deletion of data

The user may at any time:

• withdraw the authorisation to access their email inbox through the settings of their Google account or of the email provider used;
• deactivate the integration with the email service;
• request the deletion of the data associated with the “Umano” service, within the limits provided for by the applicable legislation.

The withdrawal of the authorisation prevents Quovai from accessing new data from the email inbox through the authorised integration.

Data security

Quovai adopts adequate technical and organisational measures to protect the data processed as part of the “Umano” service, including:

• access to the data limited to the systems and persons necessary for the operation of the service;
• protection of communications by means of encrypted HTTPS/TLS protocols;
• authentication and access control systems;
• measures aimed at preventing unauthorised access, loss or disclosure of the data.

11. Rights of data subjects

In accordance with the GDPR, the data subject may exercise, where applicable, the following rights:

• obtain confirmation as to whether or not personal data concerning them exists and request access to it;
• request the rectification or updating of the personal data;
• request the erasure of the personal data;
• request the restriction of the processing;
• object to the processing of the personal data;
• receive the personal data in a structured, commonly used and machine-readable format and request its portability, where applicable;
• withdraw consent at any time, where the processing is based on consent, without affecting the lawfulness of the processing carried out before the withdrawal;
• lodge a complaint with the competent supervisory authority.

The exercise of these rights is free of charge within the limits and in accordance with the arrangements provided for by the applicable legislation.

12. How to contact us

For any request relating to the processing of personal data or to exercise your rights, you can contact QUOVAI S.r.l.:

Email: hello@quovai.com
Phone: +39 02 87198048

The data subject also has the right to lodge a complaint with the:

Italian Data Protection Authority (Garante per la protezione dei dati personali)
Piazza Venezia n. 11
00187 Rome – Italy
Phone: +39 06 696771
Email: protocollo@gpdp.it
Official website of the Italian Data Protection Authority

13. Changes to this policy

QUOVAI S.r.l. may amend or update this Privacy Policy to adapt it to regulatory changes, developments in the services offered or changes in the way personal data is processed.

The most up-to-date version of the Privacy Policy will always be available on the Quovai website.

The date of the last update is indicated at the beginning of this document.