Privacy policy

1. Data controller

The controller of the data described in this notice is design Web Multimedia Agency, VAT number 04018830135, privacy email: info@cursusoffice.com (the “Controller”).

This notice concerns the personal data of people who visit cursusoffice.com / cursusoffice.it, sign up for the service or use it as users. It does not concern the personal data of customers, suppliers and collaborators that our customer enters into the system: for that data the Controller acts as processor on behalf of the customer, under the Data Processing Agreement (DPA).

2. What data we process

• Sign-up and account data: first and last name, email, company name, country, language, chosen plan, sign-up date, users and roles created in the account.
• Sign-in and security data: credentials (the password is stored only as a hash), passkeys and two-step verification data, active sessions, the security event log, IP address and device information (user agent).
• Proof of acceptance of legal texts: version and language of the texts accepted, date and time, IP address and user agent.
• Payment data: card data is processed directly by Stripe; we receive only the outcome, the amount and a reference of the transaction. Billing data: name, address, VAT number, tax and destination codes.
• Communications: messages you send us and the service emails we send you (address verification, invitations, expiry notices, security notifications).
• Technical data: server logs and rate limits to prevent abuse.

3. Why we process it and on what legal basis

Purpose	Legal basis
Creating and managing the account, providing the service, support	Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR)
Collecting fees, invoicing, complying with tax and accounting obligations	Contract and legal obligation (Art. 6(1)(b) and (c))
Platform security, fraud and abuse prevention, access log, protecting the sign-up form from bots	Legitimate interest of the Controller (Art. 6(1)(f))
Keeping proof of acceptance of legal texts, defending a legal claim	Legitimate interest and legal obligation (Art. 6(1)(f) and (c))
Commercial communications about the service, if you request or consent to them	Consent (Art. 6(1)(a)), revocable at any time

Providing the sign-up data is necessary to use the service. We do not carry out profiling or automated decisions that produce legal effects on you.

4. Cookies and similar tools

• The marketing website sets no cookies and uses no analytics or advertising tools.
• The signed-in area uses a single technical session cookie, necessary for sign-in and security, which does not require consent.
• The sign-up form uses Cloudflare Turnstile, an anti-bot check that may process technical browser data; the language menu loads flags from a content delivery network (jsDelivr), which may receive your IP address.

5. Who we share data with

Data is processed only by authorised persons and by suppliers acting on our behalf as processors, including: hosting and infrastructure providers, e.g. IONOS SE, email delivery for service messages, Stripe Payments Europe Ltd. for payments, Cloudflare for form protection. We may share data with advisers (accountant, lawyer) bound by confidentiality and with authorities where the law requires. We do not sell your data.

6. Transfers outside the European Economic Area

Some suppliers (e.g. Stripe and Cloudflare) may process data outside the EEA. In that case the transfer is based on an adequacy decision (e.g. the EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses, with supplementary measures where necessary.

7. How long we keep it

• Account data: for the duration of the contract and, after closure, for 7 unless the law requires otherwise.
• Security event and session log: for the period set in the account (normally 12 months).
• Proof of acceptance of legal texts, tax and accounting records: for the time required by law (tax records up to 10 years) or to defend rights. [TO BE CONFIRMED]
• Unconfirmed sign-ups: 10 days.

8. Your rights

You may request access to your data, rectification, erasure, restriction, portability and object to processing based on legitimate interest; you may withdraw consent where it is required. Write to info@cursusoffice.com. You have the right to lodge a complaint with the Italian data protection authority (www.garanteprivacy.it) or with the authority of your country. If your request concerns data entered into the system by one of our customers we refer you to that customer, who is the controller.

9. Security

We adopt appropriate technical and organisational measures: hashed passwords, encrypted secrets of connected services, a separate database for each account, two-step verification and passkeys, revocable sessions, a security event log, rate limits against abuse.

10. Changes

We may update this notice; the version in force is the one published on this page, with its effective date. We will notify you of material changes.