This notice describes how personal data is processed within the UnicaVista mobile application (the "App"), in accordance with Regulation (EU) 2016/679 ("GDPR"). UnicaVista is a platform for running structured relationship programmes (mentoring, coaching, training, tutoring).
1. Data controller and roles
CODIGO INTERACTIVO S.R.L. — Via Calabria 7, 56124 Pisa (Italy) — VAT / Tax ID 02522020508 — Certified email (PEC): codigointernational@pec.it — is the provider of the App.
- Account and technical data of the App (account, security, operation): the data controller is Codigo Interactivo S.R.L.
- Data entered within a programme (applications, meetings, forms, notes, feedback, documents): the data controller is the organisation running the programme (e.g. a university, institution or company) that has activated UnicaVista. In this case Codigo Interactivo acts as data processor (Art. 28 GDPR) under an agreement with the organisation. To exercise your rights over this data you may contact the organisation acting as controller, or us, and we will forward your request.
2. Data we process
- Account data: first name, last name, email address, role in the programme (e.g. mentor, mentee, evaluator, applicant, administrator, etc.), login credentials (your password is never stored in clear text: only an irreversible hash is kept).
- Programme data: answers to application and programme forms, pairings, meetings (date, time, mode, outcome), availability, mentoring agreement and related signatures, personal notes, feedback, assessments made by evaluators and the summary reports derived from them.
- Documents and images: files, documents and photos (including an optional profile picture) that you voluntarily upload in the App from your device's library or files.
- Essential technical data: session identifiers and the minimal technical logs required for security and for the service to work. Your language preference is stored on your device only.
The App does not use analytics, profiling or advertising tracking tools, does not collect location data, does not access your contacts and does not send push notifications.
Who can see your data
- Personal notes: visible to you only.
- Form answers, feedback and attachments: visible to the organisation acting as controller (those who manage the programme) and, for content the programme defines as shared, to the programme's evaluators.
- Mentoring agreement and meetings: also visible to the other person in your pair (mentor or mentee).
- Assessments and reports: produced by evaluators and by the organisation for the purposes of the programme; not visible to other participants.
3. Device permissions
The App requests no permissions at launch. It accesses your device only when you choose to, through the system pickers:
- Photos: to choose an image from your library to attach or to use as your profile picture.
- Files / Documents: to choose and upload documents.
The App does not use the camera, the microphone, your location or your contacts.
Selected content is uploaded to the service only when you confirm the action. You can revoke permissions at any time from your device settings.
4. Purposes and legal bases
- Provision of the service (account creation, programme management, meetings, forms, service communications) — legal basis: performance of the contract/service; for programme data, purposes and legal basis are defined by the organisation acting as controller.
- Security and abuse prevention — legitimate interest in protecting the integrity of the service.
- Legal obligations — applicable regulatory requirements.
5. No advertising, no sale of data
We do not sell your data and do not share it with third parties for marketing or advertising purposes. Data is used solely to make the service work.
6. Where data is stored and providers
App data is stored on infrastructure located in the European Union. We rely on the following providers, appointed as data processors:
- Supabase — database, authentication and file storage, with data located in France (EU).
- Hetzner — hosting of the application infrastructure, in Germany (EU).
- Resend — delivery of service emails (invitations, password reset, meeting notifications), sent from servers in the European Union. The provider is based in the United States: any access to the data needed for delivery (email address and message content) is covered by the Standard Contractual Clauses approved by the European Commission.
Apart from the above, no transfers of data outside the European Economic Area are planned. Should they become necessary in the future, they will take place only with appropriate safeguards under the GDPR.
7. Retention
Programme data is retained for the duration of the programme and according to the instructions of the organisation acting as controller; at the end it is deleted or anonymised. Account data is retained while the account is active and for as long as needed to comply with legal obligations, after which it is removed.
8. Minors
UnicaVista may be used by people under 18 within programmes run by an organisation (for example school or tutoring programmes). In such cases the organisation acting as controller is responsible for obtaining the necessary consents, including, where required, that of the person holding parental responsibility. The App processes minors' data in a minimised way, does not profile them and shows no advertising.
9. Your rights
You may at any time exercise the rights set out in Articles 15-22 GDPR: access, rectification, erasure, restriction, objection and data portability. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of your country of residence. To exercise your rights, write to privacy@unicavista.com or to the certified email address given in section 1.
10. Security
We adopt appropriate technical and organisational measures: encryption of data in transit, separation of data by organisation enforced at database level (Row Level Security), role-based access control and backups managed by the infrastructure provider.
11. Changes to this notice
We may update this notice; the current version is always available at this address, with the last-updated date shown at the top. In case of material changes we will notify you through the App.
12. Contacts
CODIGO INTERACTIVO S.R.L. — Via Calabria 7, 56124 Pisa, Italy — Email: privacy@unicavista.com — Certified email (PEC): codigointernational@pec.it
In case of discrepancy between this translation and the Italian version, the Italian version prevails.