Privacy Policy

1. Introduction

Pen-GO ("we", "our" or "Pen-GO") is committed to protecting your privacy. This privacy policy explains how we collect, use and protect your personal information when you use our booking management service.

2. Data Controller

For registration data and platform usage data, the controller is the Pen-GO team. For privacy matters you can contact us for help.

For the data of a business's end customers (name, contact details, bookings, reviews) the controller is the business itself: Pen-GO processes it only on its behalf, to provide the booking service. To exercise your rights over that data you can also contact the business directly.

3. Data Collected

We collect the following types of information:

3.1 Data provided directly

• Registration information (name, email, password)
• Business data (business name, address, phone, description)
• Contact information for customers
• Messages sent through the contact form

3.2 Data collected automatically

• IP address and device information
• Platform usage data
• Cookies and similar technologies
• Geolocation data (with consent)

4. Purposes of Processing

We use your data to:

• Provide and manage the booking service
• Communicate with you about your account
• Send booking notifications
• Improve our services
• Comply with legal obligations
• Prevent fraud and abuse

5. Legal Basis for Processing

We process your personal data on the basis of:

• Performance of the contract: To provide the requested services
• Consent: For marketing communications (revocable)
• Legitimate interest: To improve the services and prevent fraud
• Legal obligation: To comply with applicable regulations

6. Data Sharing

We do not sell your personal data to third parties. We may share information with:

• Service providers: For hosting, payments, email (hosting, payments, email, notifications, technical monitoring)
• Competent authorities: When required by law
• Business partners: Only with your explicit consent

7. International Transfers

Your data may be transferred to and processed in countries outside the European Union. We use cloud providers (such as Vercel, Supabase) that guarantee adequate levels of data protection.

8. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss or alteration. We use encryption, access controls and continuous monitoring.

9. Data Retention

We keep your personal data for as long as needed to provide the services and comply with legal obligations. If the account is deleted, the data is kept for a maximum of 30 days from the date of the deletion request, after which it is deleted automatically and permanently. Data cannot be recovered once this process is complete.

10. Your Rights

You have the right to:

• Access: Request a copy of your data
• Rectification: Correct inaccurate data
• Erasure: Delete your data ("right to be forgotten")
• Portability: Receive the data in a structured format
• Objection: Object to processing on legitimate grounds
• Withdrawal of consent: Withdraw consent for marketing

11. Cookies and Similar Technologies

We use cookies and similar technologies to improve the user experience, analyse site usage and personalise content. You can manage cookie preferences through your browser settings.

12. Changes to the Privacy Policy

We may update this privacy policy from time to time. Significant changes will be notified by email or through the platform. Continued use of the service after the changes constitutes acceptance of the new policy.

13. Contact

To exercise your rights or for privacy questions, contact us for help.

14. Complaints

If you believe that the processing of your data breaches privacy law, you have the right to lodge a complaint with the competent supervisory authority (in Italy: Garante per la Protezione dei Dati Personali).