Privacy Policy

The Data Controller for personal data processed through the regiasuite.com website is:

• Company: FIDES FABER MOTUS S.R.L.
• VAT code: C.F. 14585740963
• Registered office: Via Vincenzo Monti 7, 20123 Milan (MI), Italy
• Privacy contact: privacy@regiasuite.com

This Privacy Policy applies exclusively to the regiasuite.com website, operated on the WordPress platform with WooCommerce. It governs the processing carried out when a visitor:

• browses the pages of the site;
• purchases a Doc Regia plan via the checkout process;
• subscribes to the newsletter;
• submits a request via the contact form or direct email;
• accepts or rejects cookies through the consent banner.

This Policy does not apply to the operation of the Doc Regia add-on within Google Workspace, which is governed by a separate dedicated policy.

The Data Controller processes the following categories of personal data, collected in different ways depending on the user’s interaction with the website:

• IP address, browser type and version, operating system, language, date and time of requests, pages visited, referring URL.
• This data is automatically collected by the web server and analytics tools, in aggregate or pseudonymised form.

• On regiasuite.com (WooCommerce): email address, first and last name, optional company name, country, order details, generated licence key.
• On Paddle (Merchant of Record): payment data (card number, billing address, VAT number for business purchases), transaction data. This data is collected and processed exclusively by Paddle.com Market Ltd and is never stored on Regia Suite’s servers.

• Email address, optional name, subscription date, preferred language, email open and click logs (aggregate statistics provided by the newsletter provider).

• Name, email address, subject of the request, message content, and any other data the user voluntarily includes in their message.

• Technical cookies required for the site and WooCommerce to function (cart, session, preferences).
• Third-party analytics cookies (Google Analytics 4) activated only with prior consent: pseudonymous visitor identifier, navigation events, page views, session duration, traffic source, country (at city/region level).
• For the full list of cookies used, their purposes, duration and recipients, please refer to the Cookie Policy, which forms an integral part of this Privacy Policy.

Data is processed for the following purposes, each based on its respective legal ground under Regulation (EU) 2016/679 (GDPR):

Any withdrawal of consent (for the newsletter or analytics cookies) does not affect the lawfulness of processing carried out based on consent before its withdrawal.

The website uses the CookieYes consent management platform to collect and record users’ cookie choices, in compliance with applicable EU data protection law and ePrivacy rules. On first access, a banner is displayed allowing the user to:

• accept all cookies;
• reject all non-strictly necessary cookies;
• customise preferences by category (necessary, analytics, marketing).

The user’s choice is recorded by CookieYes with proof of consent (timestamp, choice made, anonymous identifier). The user can modify or withdraw consent at any time through the “Cookie Settings” button available on every page of the site.

The website uses Google Analytics 4, a statistical analysis service provided by Google LLC, to collect aggregate information about site usage (pages visited, session duration, traffic source, country of origin). Google Analytics is activated only with prior user consent expressed through the consent banner and is managed via Google Consent Mode v2, which limits data transmission to Google until consent has been given. IP anonymisation is enabled by default in GA4.

For the detailed list of all cookies used, their purposes, duration and consent management, please refer to the Cookie Policy.

Purchases of Doc Regia plans made on regiasuite.com are processed by Paddle.com Market Ltd, acting as Merchant of Record. As Merchant of Record, Paddle is the legal reseller of Doc Regia plans and assumes full responsibility for the transaction, including billing, receipt issuance, tax compliance (VAT, sales tax, GST depending on the customer’s jurisdiction), and payment data security.

Payment data (card number, CVC, billing address, VAT number where applicable) is collected and processed exclusively by Paddle and is never transmitted to or stored on Regia Suite’s servers. Paddle is PCI-DSS Level 1 certified, the highest security standard in the payment industry.

Paddle processes payment data under its own Privacy Policy, which is incorporated by reference. By completing a purchase, the user also accepts Paddle’s Terms of Service.

Subscription to the newsletter is entirely optional and occurs through the dedicated form on the site. The legal basis for processing is the user’s explicit consent (Art. 6(1)(a) GDPR), given by ticking the dedicated checkbox and confirmed through a double opt-in procedure (confirmation email with activation link).

The data collected (email address, optional name) is used exclusively to send:

• updates on new Doc Regia features;
• technical content, tutorials, and user guides;
• occasional commercial communications regarding discounts or new plans.

The technical provider used for newsletter delivery is a professional email marketing service acting as a data processor under Art. 28 GDPR. Every email contains an unsubscribe link allowing the user to withdraw consent at any time, with immediate effect. Withdrawal can also be exercised by writing to privacy@regiasuite.com.

Data entered in the site’s contact forms (name, email, subject, message) is processed exclusively to respond to user requests and manage any pre-contractual or contractual relationships arising therefrom. The legal basis is the execution of pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR) and, where relevant, the Controller’s legitimate interest in responding to received communications (Art. 6(1)(f) GDPR).

Messages and associated data are retained for the time strictly necessary to handle the request and for any subsequent periods required by legal obligations or for legal defence purposes.

Personal data processed through the site may be communicated to the following categories of recipients, each acting as a data processor under Art. 28 GDPR or as an independent controller for processing within their own scope:

• Aruba S.p.A. — WordPress hosting and CDN provider, with servers located in Italy.
• Paddle.com Market Ltd — Merchant of Record for payments, independent controller for payment data processing.
• Google LLC — provider of Google Analytics 4, under the Google Analytics Data Processing Amendment.
• CookieYes Ltd — provider of the cookie consent management system.
• Newsletter provider — email marketing service, acting as data processor.
• Professional advisors — accountants, lawyers, tax advisors, strictly within the scope necessary to perform their mandates.
• Competent authorities — when required by legal obligations, judicial orders, or to protect the Controller’s rights.

Some of the recipients listed above may process personal data outside the European Economic Area, in particular in the United States of America. Such transfers are carried out exclusively in the presence of adequate legal safeguards:

• Google LLC — certified to the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023).
• Paddle.com Market Ltd — UK-based company (country covered by an EU adequacy decision). For any non-EU sub-processors, Paddle adopts the Standard Contractual Clauses under Art. 46 GDPR.
• Other non-EU providers — bound by Standard Contractual Clauses approved by the European Commission under Art. 46(2)(c) GDPR.

• Purchase and billing data: 10 years from the issuance of the tax document, due to legal obligations (Art. 2220 of the Italian Civil Code).
• WooCommerce account data: until the user deletes the account or, in the absence of activity, for a maximum of 24 months from last access.
• Newsletter data: until the user unsubscribes or withdraws consent.
• Contact form messages: up to 24 months after the resolution of the request, unless legal obligations or legal defence requirements impose longer retention.
• Analytics cookies (GA4): default retention period is set to a maximum of 14 months.
• Server logs (security): up to 12 months, except in case of security events justifying longer retention.
• Cookie consent records (CookieYes): 12 months, after which the banner is shown again to the user.

Within the limits set by the GDPR and applicable national legislation, every data subject has the right to:

• access their personal data (Art. 15 GDPR);
• obtain rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR);
• obtain erasure of data (“right to be forgotten”) in the cases provided for by Art. 17 GDPR;
• obtain restriction of processing (Art. 18 GDPR);
• receive their data in a structured format and transmit it to another controller (“portability”, Art. 20 GDPR);
• object to processing based on legitimate interest (Art. 21 GDPR);
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7 GDPR);
• lodge a complaint with the competent supervisory authority (in Italy: Garante per la protezione dei dati personali).

To exercise their rights, the data subject can write to: privacy@regiasuite.com. The Controller will respond within 30 days of receiving the request, subject to extension justified by complexity or number of requests, in compliance with Art. 12(3) GDPR.

The regiasuite.com website is accessible globally. Although this Policy is primarily drafted in compliance with the GDPR, the following local regulations also apply to users residing in the respective countries:

The rights described in Section 12 apply. Supervisory authority: Information Commissioner’s Office (ICO).

California residents have additional rights, including the right to opt out of the sale or sharing of their personal data. Regia Suite does not sell or share personal data with third parties for commercial or advertising purposes within the meaning of CCPA.

Rights analogous to those provided by GDPR apply. Competent authority: ANPD.

Users have the right to access and correct their personal data. To exercise these rights, write to privacy@regiasuite.com.

The regiasuite.com website and Doc Regia products are not intended for minors under 16 years of age. The Controller does not knowingly collect personal data from minors under 16. If a parent or guardian becomes aware that a minor under 16 has provided personal data through the site, please contact privacy@regiasuite.com immediately so that such data can be deleted.

The site uses HTTPS/TLS protocol for all communications. Payment data is handled exclusively by Paddle, certified PCI-DSS Level 1. WordPress and installed plugins are kept up to date with the latest stable versions. Technical and organisational security measures appropriate to the risk are applied, in accordance with Art. 32 GDPR (access controls, multi-factor authentication on administrative interfaces, periodic backups, monitoring of anomalous access).

The Controller reserves the right to modify this Policy at any time to adapt it to regulatory changes, the introduction of new features or new third-party tools, or for greater clarity. The updated version will be published on this same page with indication of the last update date. For substantial changes, the Controller will inform registered users by email and/or through a prominent notice on the site.

For any request relating to the processing of personal data under this Policy:

• Privacy email: privacy@regiasuite.com
• General support: support@regiasuite.com
• Postal address: FIDES FABER MOTUS S.R.L., Via Vincenzo Monti 7, 20123 Milan (MI), Italy