Inqubomgomo Yobumfihlo
Indlela i-Cashfulness eqoqa, esebenzisa, futhi ivikela ngayo i-personal data yakho ngaphansi kwe-EU GDPR ne-Italian Privacy Code.
Le Nqubomgomo Yobumfihlo ichaza indlela i-Vittorio Giusti srl (kulokhu ebizwa ngokuthi “Cashfulness”, “thina”, “Data Controller”) eqoqa, esebenzisa, futhi ivikela ngayo i-personal data yabasebenzisi benkonzo ye-Cashfulness (iwebhusayithi cashfulness.com ne-application ye-mobile/desktop), ngaphansi kwe-Regulation (EU) 2016/679 (“GDPR”) ne-Italian Legislative Decree namba 196/2003 njengoba ichitshiyelwe (“Italian Privacy Code”).
Uma ufuna ifilosofi yethu yobumfihlo ngendlela yendaba (ukuthi kungani senze izinqumo ezithile), bheka ikhasi le-/privacy-radicale. Lo mqulu ungu-isaziso esisemthethweni.
1. I-Data Controller
- Igama lenkampani
- Vittorio Giusti srl
- Ihhovisi elibhalisiwe
- Via del Campisano 520, 55054 Massarosa (LU), Italiya
- I-VAT / Tax ID
- 12122090967
- I-imeyili eqinisekisiwe (PEC)
- vittoriogiusti.com@pec.it
- I-imeyili yamalungelo e-GDPR
- privacy@cashfulness.com
- Ummeleli osemthethweni
- UVittorio Giusti, umnikazi kanye nomqondisi oyedwa
I-Vittorio Giusti srl ingumnikazi we-trademark ethi “Cashfulness” (i-EUIPO registration namba 019297195).
I-Data Protection Officer (DPO): ayiqokiwe, njengoba i-Vittorio Giusti srl ingaphansi kwezimo ezidingwa ukuthi zibe ne-DPO ngokusho kwe-Article 37 ye-GDPR (akuyona i-public authority, futhi imisebenzi yayo emikhulu ayihlanganisi ukucutshungulwa okukhulu kwedatha ebucayi).
2. Izincazelo ezisheshayo
- Umsebenzisi
- umuntu obhalisela inkonzo ye-Cashfulness.
- Inkonzo
- iwebhusayithi
cashfulness.comne-application ye-Cashfulness ye-mobile (iOS, Android) ne-desktop (Windows, macOS). - I-Personal data
- noma iyiphi ulwazi olumayelana nomuntu ohlonziwe noma ongahlonzwa (Art. 4.1 GDPR).
- Ukucutshungulwa (Processing)
- noma yisiphi isenzo esenziwa ku-personal data (ukuqoqa, ukurekhoda, ukugcina, ukucutshungulwa, ukususa, njll.).
- I-Nickname
- igama elizenzelwe elikhethwa ngokukhululekile umsebenzisi ngesikhathi sokubhalisa; alihlonzi umuntu wangempela.
3. Izigaba zedatha ecutshungulwayo
3.1. Idatha yokuhlonza (okuncane)
- I-imeyili (kungaba ne-pseudonymous futhi, isb.
aurora.at.night@protonmail.com) - I-Nickname (igama elizenzelwe, kungaba ngokuphakama — isb. “Captain”, “Sail”, njll.)
- I-Password (igcinwa i-encrypted, ayilokothi ibonakale ngokusobala)
Asiceli noma sicutshungulwe: igama lokuqala, isibongo, i-tax ID, usuku lokuzalwa, ikheli, inombolo yocingo, ubulili, umqulu wobunikazi.
3.2. Idatha yokuphepha (ithebula `login_history`)
Ngayo yonke i-sign-in entsha, sirekhoda:
- Ikheli le-IP lesizini
- I-User agent yebrawuza/i-app
- Ulwazi ngedivayisi (i-operating system, uhlobo lwedivayisi uma lutholakala)
- Usuku nesikhathi sesizini
Le datha isetshenziselwa kuphela ukuphepha kwe-akhawunti (ukubona ukungena okusolisayo, ukulwa nokusetshenziswa kabi). Iqoqwa njalo futhi ayiphathelene ne-opt-out ye-Improvement Programme (bheka §3.5).
3.3. Idatha ye-accounting
- Ama-Workspace (“isikhala se-accounting”) adalwe umsebenzisi, kanye ne-chart of accounts yawo
- Ama-Transaction arekhodwe umsebenzisi ngendlela ye-double-entry
- Amabhalansi nezibalo ezitholakala kuwo (inani elingasele, i-income statement, njll.)
- Izigaba nama-budget adalwe umsebenzisi
Le datha ihlala ku-database yethu ekude (i-Supabase, amaseva aseYurophu) ehlotshaniswa ne-nickname ne-imeyili yomsebenzisi. Ngokuklama, ayihlanganisi imininingwane yokuhlonza umuntu wangempela, ngaphandle uma umsebenzisi ezifaka ngokuzithandela (isb. amagama e-akhawunti afaka isibongo — isenzo esingakhuthazwa, bheka i-/privacy-radicale).
3.4. Amadokhumenti alayishiwe (i-end-to-end encryption)
- Amafayela alayishwe umsebenzisi (izitatimende zebhange, amabhili, izinkontileka, ama-insurance policy, njll.)
La mafayela ayi-end-to-end encrypted kudivayisi yomsebenzisi ngaphambi kokuthunyelwa kuseva yethu, ngokhiye otholakala kusuka epasiwedini yomuntu siqu + amagama e-24 okubuyisela (i-BIP39 seed). Ukhiye awulokothi asuke kudivayisi yomsebenzisi. Kuseva sibona kuphela amabhulokhi we-digital noise: asikwazi ukufunda okuqukethwe emadokhumentini — hhayi thina, hhayi izisebenzi ze-infrastructure, ngisho noma iyiphi igunya elingase licele ngokusemthethweni.
3.5. Ama-log okusetshenziswa e-pseudonymous, ahlaziywa ngendlela ehlanganisiwe (i-Improvement Programme, i-opt-out)
Ukuze sithuthukise i-app, silinganisa:
- Amasizini (ukuvulwa kwe-app, ubude besikhathi)
- Ukusetshenziswa kwezici (yiziphi izigaba ezisetshenziswayo, kanjani njalo)
- Amaphutha nokusebenza (ukuwa kwe-app, izikhathi zokuphendula)
- I-operating system yedivayisi (ukuze sinikeze isibaluleko nokubandakanyeka kwabahloli be-beta)
Le datha i-pseudonymized ngesikhathi sokuqoqwa futhi ihlaziywa kuphela ngendlela ehlanganisiwe (Art. 4.5 GDPR): asiyisebenzisi ukwenza i-profile yomuntu ngamunye, futhi ayiveli kithi ihlotshaniswa negama lakho. Ihlala kumaseva ethu aseYurophu (Supabase): akukho izinkonzo zangaphandle (Google Analytics, Mixpanel, Amplitude, Sentry, Firebase Analytics, njll.).
Isixhumanisi sobuchwepheshe se-akhawunti sisadingeka, kodwa ngenxa yezinjongo ezimbili kuphela: (a) ukuze sihloniphe i-opt-out yomsebenzisi ngamunye (ukuze siyeke ukuqoqa idatha ye-akhawunti yakho kudingeka sazi ukuthi yiliphi eliyeyakho) kanye (b) ukuze silinganise ukubandakanyeka kwe-operating system (isibaluleko sabahloli be-beta nokuxhaswa kwepulatifomu). Ngaphandle kwalezi zinjongo, idatha icutshungulwa futhi ihlaziywa ngendlela ehlanganisiwe.
Umsebenzisi angakwazi ukuvala ukuqoqwa noma nini kusuka kuzilungiselelo ze-app, ngaphansi kwe-“Improvement Programme” (i-opt-out).
3.6. Idatha yokubhalisela i-newsletter (kuphela uma umsebenzisi ekhetha)
- I-imeyili + igama/i-pseudonym engekho phoqelekile
Icutshungulwa kuphela uma umsebenzisi ekhetha ngokusebenzayo. Bheka §5 ngenkonzo yangaphandle ehlala nayo (ActiveCampaign).
3.7. Idatha yokukhokha
Ayicutshungulwa ngqo yi-Cashfulness. Izinkokhelo ze-subscription zidlula ku:
- Apple App Store (ye-subscription ethengwe ku-iOS)
- Google Play (ye-subscription ethengwe ku-Android)
- Stripe (ye-subscription ethengwe ngewebhusayithi)
I-Apple App Store ne-Google Play zisebenza njenge-merchant of record: zicutshungulwa igama lomsebenzisi, ikheli, ikhadi lesikweletu, i-IBAN, futhi ziyimpendulo yokukhipha izitatimende noma amareseti asemthethweni kubasebenzisi bokugcina ngokwenqubomgomo yazo kanye nemithetho yezwe ngalinye. Kule zinkonzo ezimbili, i-Cashfulness ithola kuphela inzuzo ye-net ne-identifier engacaci ye-subscription (isb. sub_abc123): asilokothi sibone igama lekhasimende, ikheli, i-tax ID, ikhadi lesikweletu, i-IBAN.
I-Stripe ihlukile: ye-subscription ethengwe ngewebhusayithi, umthengisi Vittorio Giusti srl, esebenzisa i-Stripe njenge-payment processor kuphela. Kulokhu, i-Vittorio Giusti srl, nge-dashboard ye-Stripe, ithola futhi icutshungula: igama, ikheli le-imeyili, ikheli lokukhokhisa (uma lidingekile), uhlobo lwekhadi kanye nezinombolo ezine zokugcina, umphumela wokukhokha kanye ne-identifier yekhasimende ye-Stripe. Asilokothi sithole inombolo egcwele yekhadi lesikweletu noma idatha yokuphepha (i-CVV), ekugcinwa icutshungulwa yi-Stripe kuphela. Ukuze kuxhunyaniswe inkokhelo ne-akhawunti, i-Cashfulness ithumela ku-Stripe ikheli le-imeyili ne-identifier yomsebenzisi; ngokuthola inkokhelo, sigcina ukuxhumana phakathi komsebenzisi ne-identifier yekhasimende ye-Stripe.
Idatha yokukhokha ye-channel ye-Stripe icutshungulwa yi-Vittorio Giusti srl ukuze kwenziwe inkontileka (Art. 6.1.b GDPR) nokuze kuhloniphwe izibopho zomthetho zentela ne-accounting (Art. 6.1.c GDPR); bheka §4 ne-§7.
4. Izinjongo zokucutshungulwa
I-personal data icutshungulwa ngezinjongo ezilandelayo:
| # | Injongo | Izigaba zedatha ezibandakanyekayo | Isisekelo esisemthethweni |
|---|---|---|---|
| 1 | Ukulethwa kwenkonzo (ukubhalisa, i-authentication, ukuvumelanisa idatha ye-accounting kuzo zonke izinsizakusebenza) | 3.1, 3.3, 3.4 | Ukwenziwa kwenkontileka (Art. 6.1.b GDPR) |
| 2 | Ukuphepha kwe-akhawunti (ukubona ukungena okusolisayo, ukulwa nokusetshenziswa kabi) | 3.2 | Uzuzo olusemthethweni (Art. 6.1.f GDPR) |
| 3 | Ukuthuthukiswa komkhiqizo (ama-log e-pseudonymized ngesikhathi sokuqoqwa, ahlaziywa ngendlela ehlanganisiwe; isixhumanisi se-akhawunti sisebenzela i-opt-out nokubandakanyeka kwe-operating system kuphela) | 3.5 | Uzuzo olusemthethweni (Art. 6.1.f GDPR), lungabuyiswa nge-opt-out |
| 4 | Ukuxhumana kwenkonzo (ukuqinisekiswa kwe-imeyili, ukusetha kabusha ipasiwedi, izaziso zokuphepha) | 3.1 | Ukwenziwa kwenkontileka (Art. 6.1.b GDPR) |
| 5 | I-newsletter yezemfundo namacebiso okusebenza (kuphela uma kukhethiwe) | 3.6 | Imvume ecacile (Art. 6.1.a GDPR), engabuyiswa |
| 6 | Ukuhloniphwa kwezibopho zomthetho (izicelo ezivela emagunyeni afanele noma kubaphathi) | 3.1, 3.2, 3.3 | Isibopho esisemthethweni (Art. 6.1.c GDPR) |
| 7 | Ukuhloniphwa kwentela ne-accounting ye-subscription ethengiswe nge-Stripe (ukukhishwa nokugcinwa kwezitatimende/amareseti, ama-accounting entry) | 3.7 (idatha yokukhokha ye-channel ye-Stripe) | Isibopho esisemthethweni (Art. 6.1.c GDPR) |
5. Izinkonzo zangaphandle (ama-external data processor)
Ukuze silethe inkonzo, sincike kubahlinzeki bangaphandle, abakhethwe ngenxa yokwethembeka nokuhambelana ne-GDPR. Bonke basayine i-Data Processing Agreement (DPA) nathi ngaphansi kwe-Art. 28 GDPR.
| Inkonzo | Umsebenzi | Ikomkhulu | Amaseva angempela | Izivikelo zokudlulisa ngaphandle kwe-EU |
|---|---|---|---|---|
| Supabase (Supabase Inc.) | I-database + i-authentication yomsebenzisi | USA | Yurophu (eu-west) | DPA + SCC + Data Privacy Framework |
| Vercel (Vercel Inc.) | I-hosting ye-cashfulness.com | USA | Yurophu (Frankfurt) | DPA + SCC + Data Privacy Framework |
| Resend (Resend Inc.) | I-imeyili ye-transactional (ukuqinisekiswa, ukusetha kabusha ipasiwedi, izaziso) | USA | Yurophu (isifunda se-EU) | DPA + SCC + Data Privacy Framework |
| SiteGround (SiteGround Hosting Ltd) | Amabhokisi we-imeyili abantu (info@, support@, beta@, privacy@) + i-DNS | EU (Bulgaria) | Yurophu | DPA (ukucutshungulwa phakathi kwe-EU) |
| ActiveCampaign | I-newsletter + ifomu le-beta signup | USA | USA | DPA + SCC + Data Privacy Framework |
| Apple App Store (Apple Inc.) | Izinkokhelo ze-subscription ze-iOS | USA | USA + Yurophu | Data Privacy Framework + imithetho ye-Apple |
| Google Play (Google LLC) | Izinkokhelo ze-subscription ze-Android | USA | USA + Yurophu | Data Privacy Framework + imithetho ye-Google |
| Stripe (Stripe Inc.) | Izinkokhelo ze-subscription ze-web | USA | USA + Yurophu | DPA + SCC + Data Privacy Framework |
| Umami Cloud | I-analytics yesayithi ehlonipha ubumfihlo (akukho amakhukhi, akukho i-profiling) | USA | Yurophu (isifunda se-EU) | DPA + SCC + Data Privacy Framework |
Asikusebenzisi: i-Google Analytics, i-Mixpanel, i-Amplitude, i-Sentry, i-Firebase, i-Meta Pixel, i-TikTok Pixel, i-LinkedIn Insight Tag, noma noma isiphi esinye isistimu sokulandelela ukuziphatha noma i-commercial profiling.
6. Ukudluliselwa kwedatha ngaphandle kwe-EU
Abanye babahlinzeki bethu bayizinkampani ezisuselwa e-United States of America (bheka §5). Ukudluliselwa okunjalo kwenzeka ngezivikelo ezilandelayo:
- I-Standard Contractual Clauses (SCC) esayinwe ngaphansi kwe-Implementing Decision (EU) 2021/914.
- I-EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), yabahlinzeki asebehlanganyele kuyo.
- Izinyathelo zobuchwepheshe ezengeziwe (i-encryption ngesikhathi sokudlulisa nasekugcinweni, ukuhlukaniswa kwedatha ezifundeni zaseYurophu uma zitholakala).
Umsebenzisi angacela ikhophi yezivikelo ezisetshenzisiwe ngokubhalela ku-privacy@cashfulness.com.
7. Izikhathi zokugcina
| Isigaba sedatha | Isikhathi sokugcina |
|---|---|
| I-akhawunti yomsebenzisi + idatha ye-accounting + amadokhumenti e-E2EE | Kuwo wonke impilo ye-akhawunti; ukususwa okuqinisekile ngaphakathi kwezinsuku ezingu-30 zesicelo (izinsuku ezingu-30 zivumela i-soft-delete engaphenduka izicelo ezingahlelekile) |
Ama-log okuphepha (login_history, i-IP, i-user agent) | Izinyanga ezingu-6 kusukela ngosuku lwesizini |
| Ama-log okusetshenziswa ahlanganisiwe angahlonzeki (i-Improvement Programme) | Izinyanga ezingu-6 ezizulayo; ngesikhathi se-opt-out, siyeka ngokushesha ukuqoqa amasha |
| Amabhaka amasha e-encrypted (kuphela ku-Ultra plan) | Izinsuku ezingu-30 ezizulayo, bese kwenzeka ukubhaliswa kabusha |
| I-newsletter (uma ubhalisile) | Kuze kube ikhansela elicacile lomsebenzisi (isixhumanisi se-unsubscribe kuyo yonke i-imeyili) |
| Idatha ye-billing — izinsizakusebenza ze-Apple / Google | Akusebenzi: ye-subscription ethengwe ku-App Store noma ku-Google Play, i-Cashfulness ayikhiphi izitatimende noma amareseti asemthethweni kubasebenzisi bokugcina (bheka §3.7); lezi zikhishwa yi-Apple noma i-Google, ezisebenza njenge-merchant of record |
| Idatha ye-billing namarekhodi we-accounting — insizakusebenza ye-Stripe | Iminyaka engu-10 kusukela ngosuku lomqulu, njengoba kudingwa yi-Art. 2220 ye-Italian Civil Code yamarekhodi we-accounting nezincwadi zentela, njengoba ye-subscription ethengwe ngewebhusayithi umthengisi kuyi-Vittorio Giusti srl (bheka §3.7 ne-§4) |
8. Amalungelo we-data subject
Ngaphansi kwe-Article 15–22 ye-GDPR, umsebenzisi unelungelo lokuthi:
- Athole ukufinyelela (Access) kudatha yomuntu emayelana naye (Art. 15)
- Ukulungisa (Rectification) idatha engalungile noma engaphelele (Art. 16)
- Ukususwa (Erasure) kwedatha (“ilungelo lokukhohlakala”, Art. 17)
- Ukukhawulelwa (Restriction) kokucutshungulwa (Art. 18)
- I-Portability yedatha ngendlela ehlelekile, efundeka ngomshini (Art. 20)
- Ukuphikisa (Objection) ekucutshungulweni okusekelwe kuzuzo olusemthethweni (Art. 21)
- Ukubuyisela (Withdrawal) imvume noma nini, kokucutshungulwa okusekelwe kwimvume (Art. 7.3)
- Ukukhalaza (Complaint) ku-Italian Data Protection Authority (Garante per la Protezione dei Dati Personali): Piazza Venezia 11, 00187 Roma — ucingo +39 06 696771 — PEC protocollo@pec.gpdp.it — iwebhusayithi www.garanteprivacy.it
8.1. Indlela yokusebenzisa la malungelo
Ukusebenzisa noma yiliphi lamalungelo abalwe ngenhla, umsebenzisi angakwazi:
- Bhalela ku-
privacy@cashfulness.comukhombise ilungelo afuna ukulisebenzisa, i-imeyili ehlotshaniswe ne-akhawunti ye-Cashfulness, futhi — ye-ukususwa — noma iyiphi imiqinisekiso yokuthi bayazi ngokungabuyiswa kwamadokhumenti e-E2EE. - Yelungelo lokususwa (ukususwa okuphelele kwe-akhawunti): le sici itholakala ngqo ku-app, ngaphansi kwe-“Settings → Delete account”. Ukususwa okuqinisekile kwenzeka ngaphakathi kwezinsuku ezingu-30.
- Ukuvala i-Improvement Programme (i-opt-out): kusuka ku-“Settings → Improvement Programme” ku-app. Umphumela osheshayo.
Sizophendula ngaphakathi kwezinsuku ezingu-30 kusukela ngesicelo (kungeleleke izinsuku ezingu-60 ezengeziwe zezicelo ezinzima kakhulu, ngaphansi kwe-Art. 12.3 GDPR; umsebenzisi uzokwaziswa uma kunjalo).
9. Ukuphepha kwedatha
Sisebenzisa izinyathelo ezifanele zobuchwepheshe nezenhlangano ukuvikela idatha yomuntu:
- I-Encryption ngesikhathi sokudlulisa: konke ukuxhumana kusebenzisa i-HTTPS/TLS 1.3.
- I-Encryption ngesikhathi sokugcina: ama-database e-Supabase asebenzisa i-encryption-at-rest ejwayelekile yomhlinzeki.
- I-End-to-end encryption yamadokhumenti alayishwe umsebenzisi (bheka §3.4).
- I-authentication eqinile: amapasiwedi anezidingo eziphakeme; ukusekela i-biometric (Touch ID, Face ID) uma kutholakala kudivayisi.
- I-Row Level Security (RLS) kuwo wonke amathebula edatabase: umsebenzisi ngamunye ufinyelela kuphela kudatha yakhe.
- I-Access logging: ukulandelela ukungena ukubona ukungena okusolisayo (bheka §3.2).
- Izibuyekezo ezijwayelekile ze-software dependencies ukuze kuvalwe ukungenelela okwaziwayo.
Ayikho isistimu engaphephile ngo-100%. Uma kuke kwaba nokuphuliwa kwedatha yomuntu okuhlanganisa ingozi kubasebenzisi, sizokwazisa i-Italian Data Protection Authority ngaphakathi kwamahora angu-72 kusukela kufunyanwe (Art. 33 GDPR) futhi — uma ingozi iphakeme — sizowaziswa ngqo abasebenzisi abathintekile (Art. 34 GDPR).
10. Izingane
Inkonzo ye-Cashfulness ihlose abantu abaneminyaka engu-18 ubudala noma ngaphezulu (isilinganiso se-legal capacity ngaphansi komthetho wase-Italiya, Art. 2 ye-Italian Civil Code), noma iminyaka yokuba ngumuntu omdala ngokomthetho wezwe lomsebenzisi uma iphakeme ku-18.
Ngaphansi kwe-GDPR nge-Art. 2-quinquies ye-Italian Privacy Code, iminyaka esezingeni eliphansi yemvume ezimele yengane ekucutshungulweni kwedatha yomuntu iphansi (iminyaka engu-14 e-Italiya, iminyaka engu-16 njenge-EU default). Ye-Cashfulness, umkhawulo weminyaka wenkontileka ongu-18 yiwo osebenza ngempela, ngoba ubudlelwane nomsebenzisi bungobenkontileka (bheka Imigomo Nemibandela §4.1) futhi budinga i-legal capacity ephelele.
Asiqoqi ngamabomu idatha yezingane ezingaphansi kweminyaka engu-18. Uma sithola ukuthi kunee-akhawunti eyakhiwe yingane engenayo i-legal capacity edingekayo, sizoyisusa ngaphandle kokubambezela.
11. Izinguquko kule Nqubomgomo Yobumfihlo
Sizigcinela ilungelo lokushintsha le Nqubomgomo Yobumfihlo esikhathini esizayo, ngenxa yezibuyekezo zomthetho noma izinguquko zenkonzo. Izinguquko zishicilelwa kule khasi ngosuku olubuyekeziwe phezulu.
Ye-zinguquko ezinkulu ezithinta izinjongo zokucutshungulwa noma izisekelo ezisemthethweni, sizowazisa abasebenzisi abasebenzayo nge-imeyili okungenani izinsuku ezingu-30 ngaphambi kokuba izinguquko zisebenze, sibanikeze ithuba lokubuyekeza izimo ezintsha futhi, uma befuna, ukususa i-akhawunti ngaphambi kokuba isebenze.
12. Okokuxhumana
Ye-noma yimuphi umbuzo ophathelene nokucutshungulwa kwedatha yomuntu:
- I-imeyili yobumfihlo: privacy@cashfulness.com
- I-imeyili yosizo evamile: info@cashfulness.com
- I-imeyili eqinisekisiwe (PEC): vittoriogiusti.com@pec.it
- I-imeyili yeposi: Vittorio Giusti srl, Via del Campisano 520, 55054 Massarosa (LU), Italiya
13. Umthetho osebenzayo nesigodi somthetho
Le Nqubomgomo Yobumfihlo ilawulwa wumthetho wase-Italiya ne-Regulation (EU) 2016/679.
Inkantolo enegunya: Lucca, Italiya, ngaphandle kwezimiso ezidingekayo zokuvikela abathengi (Art. 66-bis ye-Italian Consumer Code), lapho umthengi engabhekana khona nenkantolo yendawo yakhe yokuhlala noma i-domicile.