Privacy Policy
Last updated: 27 July 2026
Information on the processing of personal data pursuant to Articles 13-14 of Regulation (EU) 2016/679 (GDPR) and the Guidelines of the Italian Data Protection Authority on cookies and other tracking tools (10 June 2021).
1. Data Controller
The Data Controller is:
IndexOS
Registered office: Pordenone (PN) - Italy
VAT No.: IT01374730933
Email: info@indexos.eu
The Data Controller has determined that the processing carried out does not require the appointment of a DPO pursuant to Art. 37 GDPR, as it does not involve large-scale processing of special categories of data or systematic monitoring of data subjects.
2. Data collected
2.1 Data provided voluntarily
- email address (for license delivery)
- email address (for voluntary subscription to technical updates, with double opt-in confirmation)
- billing data (if required by the service)
2.2 Browsing data
- IP address
- access logs
- technical data about the browser and device
2.3 Cookies and similar technologies
- technical cookies necessary for website functionality
- equivalent tools (localStorage) to store privacy preferences
2.4 Anonymous usage statistics
The website collects aggregate usage statistics through an internal (first-party) system, without cookies and without third-party services. The IP address and technical browser data are used only transiently to generate a non-reversible anonymous code (hash with a key that rotates daily) and are not stored in clear text: the data collected does not allow the user to be identified or tracked over time.
IndexOS is a PWA (Progressive Web App) that runs entirely on the user's device after installation. The Data Controller does not have access to the data consulted by the user through the app, nor to the diagnostic content displayed. All app data resides exclusively on the user's device.
3. Purpose of processing
Personal data is processed for:
- software license delivery (sending access link via email)
- payment processing via Stripe
- invoicing and tax compliance
- customer assistance and support
- service communications
- sending technical updates via email (newsletter), only after voluntary subscription confirmed via double opt-in
- aggregate, anonymous website usage statistics
- security and abuse prevention
3.1 Nature of data provision
- data necessary for purchase and license delivery is mandatory; failure to provide it prevents order completion;
- data required for technical assistance is necessary to handle the support request.
4. Legal basis for processing
Processing is based on:
- Art. 6.1.b GDPR - performance of a contract (license delivery, support)
- Art. 6.1.c GDPR - legal obligations (invoicing, tax record keeping)
- Art. 6.1.f GDPR - legitimate interest (security, fraud prevention, aggregate anonymous statistics)
- Art. 6.1.a GDPR - consent (newsletter: voluntary subscription with double opt-in, revocable at any time via the unsubscribe link included in every email)
5. Processing methods and security
Processing is carried out using electronic and digital tools, in compliance with the principles of lawfulness, fairness, transparency and data minimisation.
Appropriate technical and organisational measures are in place (Art. 32 GDPR), including:
- HTTPS connections for all communications
- CSRF protection on forms
- server-side input validation
6. Data retention
- contractual and billing data: duration of the relationship + 10 years
- license delivery email: until revocation or deletion
- newsletter email: until unsubscription or deletion request
- access logs: 90 days
- anonymous statistics events: 13 months
7. Data recipients
Data may be disclosed to:
- Aruba S.p.A. - hosting and server infrastructure (Italy)
- Stripe, Inc. - payment processing (EU/USA with DPA and standard contractual clauses pursuant to Art. 46 GDPR)
- tax, accounting and legal advisors of the Data Controller
- public authorities for legal obligations
Data is not disseminated. Payment data (credit cards, IBAN) is processed exclusively by Stripe and does not pass through or get stored on IndexOS servers.
8. Data transfers
Data is stored on servers located in Italy, on infrastructure provided by Aruba S.p.A.
Transfers to non-EU countries may occur through Stripe, Inc. for payment processing. Such transfers are carried out on the basis of the safeguards provided by applicable regulations (standard contractual clauses pursuant to Art. 46 GDPR and/or EU-US Data Privacy Framework).
9. Data subject rights
Data subjects may exercise the rights under Articles 15-22 GDPR:
- access
- rectification
- erasure
- restriction
- portability
- objection
- lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it)
Email: info@indexos.eu