This notice describes how personal data is processed in GRADO Reflow, the software through which the customer organisation connects to the national RENTRI system (Registro Elettronico Nazionale per la Tracciabilità dei Rifiuti) to consult and manage forms and registers. It is provided pursuant to Arts. 13 and 14 of EU Regulation 2016/679 (GDPR) and supplements the general notice published on the GRADO Tech website. Not everything shown in Reflow is stored on GRADO TECH Srls servers: FIR forms and registers remain in the public RENTRI system.

How the service works

GRADO Reflow is provided as SaaS. The role of GRADO TECH Srls varies by context:

• Organisation work data (Part A): the customer company or body is the controller of the data it enters in the application database (party directory, emergency FIR drafts, files, operational credential metadata). GRADO TECH Srls acts as processor under Art. 28 GDPR.
• Accounts and software operation (Part C): for authentication, security logs, roles, MFA status and technical preferences GRADO TECH Srls is the controller.
• Public RENTRI system (Part E): RENTRI, established at the Italian Ministry of the Environment and Energy Security (MASE), is an independent controller of the national register, electronic FIR forms and RENTRI master data. GRADO TECH Srls is not the controller of those data and does not copy them into its own database, except for the Part A exceptions (emergency drafts and technical caches).

Part A — Data entered by customer organisations

This section applies to data that the customer organisation (or a person authorised by it) enters, uploads or generates on GRADO Reflow. Such data remain under the control and responsibility of the controller; GRADO TECH Srls only hosts them, stores them securely and makes them available under the contract and the instructions received.

Roles in the processing

For the data described in this Part A:

• the controller is the customer organisation that manages the workspace and determines the purposes and means of the processing;
• GRADO TECH Srls (registered office Corso Umberto I, 7 — 66050 San Salvo (CH), VAT IT02868240694) acts as processor, on the basis of the service contract and the Art. 28 GDPR agreement;
• the RENTRI / MASE system is an independent controller of national-register data: GRADO TECH Srls does not determine the purposes of that processing.

The controller must provide data subjects with a GDPR-compliant privacy notice and have a valid legal basis for each processing operation, including those relating to RENTRI credentials and work documents.

Categories of data in the Reflow database

The application database may store, among other items:

• RENTRI credentials: certificate and private key in encrypted form (AES-256-GCM), tax code / registration number, demo or production environment — never in clear text at rest.
• Party directory: local copies of work master data for faster completion of FIR forms and registers.
• Emergency FIR forms: drafts of paper forms used when RENTRI is unavailable, until regularisation on the public system.
• Uploaded files by the organisation (work documents attached to operations).
• Audit log: action, user, organisation, date, IP address.
• Technical cache of RENTRI coding tables (EER codes, errors, etc.), of short duration.
• Live FIR and register content retrieved via API is not duplicated as a historical archive on GRADO TECH Srls servers: it remains on RENTRI.

Purposes (on behalf of the controller)

GRADO TECH Srls processes Part A data exclusively on behalf of the controller: provision and hosting of Reflow, execution of documented instructions, IT security and technical support within the limits of Part B. It does not use customer-organisation data for marketing, commercial profiling, resale or independent analytics.

Legal basis

The legal basis of the processing by the controller is determined by the controller (typically performance of waste-traceability legal obligations and of the contractual relationship with operators). Processing by GRADO TECH Srls as processor is based on performance of the service contract and the Art. 28 GDPR agreement.

Retention

Retention periods for Part A data are determined by the controller. As a rule: emergency FIR forms and files until deletion by the customer or end of service; encrypted credentials until revocation, replacement or termination; coding caches a few hours / at most about one day; audit logs generally 24 months, unless longer obligations apply. At the end of the relationship, data are returned or deleted under the contract.

Part B — Access to data by GRADO TECH Srls

GRADO TECH Srls does not freely access, consult or use workspace content without a lawful, documented basis. Access by authorised staff is allowed only in the following cases:

• Explicit mandate or authorisation from the controller: upon written request, email, ticket or other documentable official communication;
• Strictly necessary technical support: interventions limited to the time and scope indispensable to diagnose faults, restore the service or respond to reports;
• Legal obligations: orders of judicial authorities or mandatory legal duties, informing the controller where permitted;
• Platform security: monitoring of technical metadata, except as strictly necessary to handle incidents.

Each access is limited to authorised staff, subject to confidentiality and confined to the duration of the intervention. GRADO TECH Srls does not sell the data and does not use the RENTRI certificate on its own initiative: calls to the public APIs occur only on the authenticated user’s initiative, with the operator’s certificate.

Part C — Data for which GRADO TECH Srls is controller

This section applies to personal data collected to provide the application: accounts, authentication, security logs and technical preferences.

Data controller

The controller for Part C data is GRADO TECH Srls, registered office Corso Umberto I, 7 — 66050 San Salvo (CH), Italy. VAT IT02868240694. Email: info@gradotech.it — Tel. +39 378 421 3717. Website: www.gradotech.it.

Categories of data

• Account: email, name, irreversible password hash, account status, organisation membership and role (owner, admin, operator).
• Authentication: login logs, IP address, user-agent, MFA status and TOTP secret in encrypted form, recovery codes.
• Technical preferences: acceptance of this notice (date and version), theme/appearance, session tokens.

Purposes and legal bases

Providing the service and authenticating users (performance of a contract, Art. 6.1.b GDPR); securely storing credentials and logs (security obligations and, where applicable, legal obligations, Arts. 6.1.c and 32 GDPR); preventing abuse and ensuring continuity of the service (legitimate interest, Art. 6.1.f GDPR). We do not process marketing data, we do not profile users for advertising, and we do not sell lists to third parties.

Part D — Data-subject rights

You may request access, rectification, erasure, restriction, portability and objection, within the limits of the law.

• for Part C data, write to info@gradotech.it;
• for work data in the workspace (Part A), rights are exercised primarily vis-à-vis the customer organisation (controller); GRADO TECH Srls, as processor, will forward the request or respond within the limits of its role;
• you always have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

For data that exist only on RENTRI, the request must be addressed to the competent public controller, not to GRADO TECH Srls.

Part E — RENTRI, cookies, recipients and transfers

Interaction with the RENTRI system

Reflow queries the official RENTRI APIs (api.rentri.gov.it / demo environment) using the operator’s digital certificate, stored encrypted. Responses (FIR forms, registers, master data, outcomes) are shown in session. Live FIR and register content remains on RENTRI.

For RENTRI data, privacy rights are exercised with the competent public controller, according to the notices on the RENTRI portal (rentri.gov.it).

Cookies and session

We use only technical cookies (or equivalent storage) for authentication and appearance preferences. We do not use advertising profiling cookies or third-party marketing trackers.

Recipients and sub-processors

Data may be known by authorised staff of GRADO TECH Srls for support and maintenance; by Aruba S.p.A. (Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy — VAT 01573850516), as infrastructure provider — Aruba GDPR; by the RENTRI / MASE system only for API calls that the authenticated user makes with their own certificate. An updated list is available on request at info@gradotech.it.

Transfers outside the EU

Processing normally takes place in Italy / the European Union. Any transfers to third countries occur only where adequate GDPR safeguards are in place.

Security measures

GRADO TECH Srls implements appropriate technical and organisational measures: multi-tenant segregation, TLS, irreversible password hashing, optional MFA, AES-256-GCM encryption of RENTRI credentials, role-based access control, backups, audit logs and ISO/IEC 27001:2024 compliance. In the event of a breach affecting data processed on behalf of the controller, GRADO TECH Srls will inform the controller without undue delay.

Changes

This notice may be updated to reflect regulatory, contractual or service changes. Any material amendments will be published on this page (and made available via API) with the date of the last update; Reflow will then request a new acceptance.