Privacy and security
The client determines why and how the data is processed. Through rêd app, SVILUPPO processes it within the agreed framework, under a Data Processing Addendum (DPA) and technical, organisational and personnel safeguards.
How responsibility is split
Data Processing Addendum and documented instructions
Who decides about the data
When a company uses rêd app to organise the work of its employees, it governs the purpose of processing. We provide the platform and process the data on its behalf, within the agreed instructions.
The client determines what data it enters into the system, why it processes it, who in its organisation has access and how long it needs it, in line with the law and its own obligations towards employees.
Through rêd app, SVILUPPO processes data on the client’s behalf, maintains confidentiality and applies the agreed safeguards. It uses the data only to perform its contractual obligations and provides the client with the support it needs regarding the processing.
For data you send us directly through the website or the demo form, SVILUPPO acts as the controller to the extent described in the Privacy notice.Read the Privacy notice
Contractual framework
Alongside the rêd app terms and conditions we apply a Data Processing Addendum (DPA), the document that governs the controller–processor relationship. The client accepts it together with the terms, so both parties’ obligations are clear before processing begins.
What the DPA governs
Accountability does not start when a problem arises. We set it out before processing begins.
Contractual framework documents
The current version of both documents is published here and available to download at any time.
We may amend the DPA under the rules for amending the terms and conditions, but no amendment may lower the level of personal data protection. Questions about the document go to [email protected].
Protection in three layers
The DPA groups the safeguards into three categories. Here is what they mean in day-to-day work.
Technical measures
Access to data is allowed only with the appropriate authorisation. Without approval it is not possible to read, copy, change or delete data, and the safeguards also protect it from accidental loss or destruction. Data carriers entrusted to us are stored securely and protected from third-party access.
Organisational measures
Unauthorised persons are prevented from accessing the systems and premises where data is processed. We process data solely in line with the contract concluded with the client and handle it according to their instructions and legal obligations.
Personnel measures
Our employees and associates can access only the data they need to perform contractual obligations. They are bound to keep it confidential, not to use it for other purposes and not to disclose it to unauthorised persons. The confidentiality obligation remains in force after their engagement ends.
When you visit our site
When you send us an enquiry, book a demo or use the site, SVILUPPO processes a limited set of business and technical data for communication, scheduling, security and — where your choice is required — analytics and advertising. The details are available in separate notices.
What data we collect through the site, why we use it, how long we keep it, who it may be disclosed to and what rights you have.
Read the noticeWhich categories of technology we use, how Cookiebot works and how you can change your choice at any time.
Read the noticeOpen the Cookiebot panel and change or withdraw your choice, without leaving this page.
The contractual framework documents, the Data Processing Addendum and the terms and conditions, are available to download above.Open the contractual framework
Short, clear answers
Did not find your answer? Write to us at [email protected].
When a company uses rêd app for its employees, it generally determines the purposes and means of processing and acts as the controller. SVILUPPO processes the data on its behalf as a processor, within the terms and conditions, the Data Processing Addendum (DPA) and documented instructions.
It governs the controller–processor relationship: what data we process, whose it is and for what purpose, on whose instructions we act, who may access it, which safeguards we apply, which sub-processors we use and what happens to the data once processing ends.
The current version is published on this page, in the contractual framework section, together with the rêd app terms and conditions. The DPA forms an integral part of the terms and is accepted together with them.
Yes. The list of sub-processors is set out in Annex 5 of the DPA. We notify the client in advance of any intended addition or replacement of a sub-processor, so they can raise a reasoned objection within a reasonable period.
Without undue delay, and at the latest within 48 hours of becoming aware of the breach. The notification describes the breach, its likely consequences and the measures we have taken or proposed, to the extent the information is available to us.
As a rule the request goes to the employer or another organisation that is the data controller. If a request reaches SVILUPPO, we act in line with our contractual obligations and help the controller respond to it.
The client manages users, roles and permissions in line with its own organisation. Access should be limited to the data and functions a specific role needs.
Details about the demo form, the CRM process, scheduling and technical data are in the Privacy notice. Cookies and similar technologies are explained in a separate Cookie notice.
Write to us at [email protected]. If your company is running a vendor, legal or security review, tell us in the message which information or documentation you want to check.
Send us what you want to check. We will answer concretely and involve the responsible people from our team.
Write to us directly at [email protected]
