Privacy Policy

Last Updated: March 2026

Introduction

Paolo Cappelletto Ditta Individuale (hereinafter "PC-DI," "we," "us," or "our") operates the "Zero Token" tool (hereinafter the "Tool"), accessible at https://www.zero-token.com/. This Privacy Policy explains how we collect, use, process, and protect your personal data in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and applicable national privacy legislation.

This policy applies exclusively to the Tool and not to third-party websites that may be accessed through links on the Tool. For those websites, please consult their respective privacy policies.

1. Data Controller

The data controller responsible for processing your personal data is:

Paolo Cappelletto Ditta Individuale
Via Nino Bixio 14
20129 Milano (MI), Italy
Email: privacy@zero-token.com

2. Types of Personal Data Collected

2.1 Data Automatically Collected

When you visit and use the Tool, we automatically collect certain technical information:

Browsing Data:

IP address
Date and time of access
Browser type and version
Operating system
Device information (type, unique identifiers)
Pages viewed before or after using the Tool
Referring website
Technical error logs and crash data

Tool Usage Data:

Pages and features accessed within the Tool
Actions performed within the Tool
Session duration and interaction patterns

This data is collected through our hosting infrastructure for operational, security, and performance purposes.

2.2 Data You Provide Directly

To use the Tool, you must provide the following information:

Required Data:

Email address (required for account creation, authentication, and communication)
Username (a fictional username of your choice for identification within the Tool)

Optional Data:

You may choose to provide additional information to enhance your experience, including:

First name and last name
Phone number
Address
Any notes or additional information you wish to share
Company name
Tax code or VAT number
Registered office address
Business email address and PEC (Posta Elettronica Certificata)

Important: Only your email address and username are strictly necessary to use the Tool. All other information is optional and provided at your discretion. If you choose not to provide the required data (email and username), you will not be able to access or use the Tool's features.

2.3 Cookies and Similar Technologies

We use technical cookies to ensure the Tool functions properly. For detailed information about the cookies we use, please refer to our Cookie Policy.

2.4 Third-Party Data

You are solely responsible for any third-party personal information you enter, upload, or share through the Tool. By providing such data, you warrant that you have the necessary rights and authorizations to do so, and you release PC-DI from any liability toward those third parties.

3. Legal Basis and Purposes of Processing

We process your personal data based on the following legal grounds and for the following purposes:

3.1 Contractual Necessity (GDPR Art. 6(1)(b))

We process your data to:

Create and manage your user account
Provide access to the Tool's features and functionalities
Deliver the services you have requested
Communicate with you regarding the Tool and your account

3.2 Compliance with Legal Obligations (GDPR Art. 6(1)(c))

We process your data to:

Comply with applicable laws and regulations
Respond to lawful requests from public authorities
Maintain records as required by law
Fulfill tax and accounting obligations

3.3 Legitimate Interests (GDPR Art. 6(1)(f))

We process your data to:

Operate, maintain, and improve the Tool
Monitor and analyze Tool performance and usage patterns
Detect, prevent, and respond to security threats, fraud, and technical issues
Troubleshoot errors and resolve technical problems
Ensure the security and integrity of our systems
Collect statistical information in aggregate form

These legitimate interests do not override your fundamental rights and freedoms.

3.4 Protection of Vital Interests (GDPR Art. 6(1)(d))

In exceptional circumstances, we may process your data to protect your vital interests or those of another person.

4. How We Process Your Data

Your personal data is processed using electronic and automated means, strictly limited to the purposes outlined in this policy. We implement appropriate technical and organizational measures to ensure data security, including:

Encryption of data in transit and at rest
Access controls and authentication mechanisms
Regular security assessments and updates
Staff training on data protection principles

Access to your personal data is restricted to authorized PC-DI personnel who have been trained on data protection requirements and are bound by confidentiality obligations.

5. Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, in accordance with GDPR Article 5(1)(e) and Recital 39.

General Retention Period:

User account data is retained for the duration of your active account plus a maximum of 10 years from your last interaction with the Tool
Technical logs and browsing data are typically retained for 90 days unless required for security investigations

Extended Retention:

Personal data may be retained beyond these periods only when necessary to:

Comply with legal, tax, or accounting obligations (typically 10 years)
Establish, exercise, or defend legal claims
Protect rights in judicial proceedings

Deletion:

After the applicable retention period expires, your personal data will be permanently deleted or irreversibly anonymized.

The specific retention periods for different data categories are documented in PC-DI's processing activity register maintained pursuant to GDPR Article 30.

6. Data Sharing and Disclosure

PC-DI does not sell, rent, or trade your personal data to third parties for commercial purposes.

We may disclose your personal data only in the following limited circumstances:

6.1 Service Providers (Data Processors)

We may share data with trusted third-party service providers who process data on our behalf under strict contractual obligations, including:

Cloud hosting and infrastructure providers
Security and performance optimization services

These service providers act as data processors and are contractually bound to:

Process data only according to our documented instructions
Implement appropriate technical and organizational security measures
Comply with GDPR requirements and applicable data protection laws
Not use your data for their own purposes

6.2 Legal Obligations and Rights Protection

We may disclose your data when required or permitted by law:

To comply with legal obligations, court orders, or valid legal processes
To respond to lawful requests from public authorities, law enforcement, or regulatory bodies
To protect the rights, property, or safety of PC-DI, our users, or others
To prevent, detect, or investigate fraud, security breaches, or illegal activities
To establish, exercise, or defend legal claims

6.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the successor entity, subject to the same privacy protections outlined in this policy.

7. International Data Transfers

Our infrastructure providers may process data in various locations, including outside the European Economic Area (EEA). When personal data is transferred outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V, such as:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions recognizing equivalent data protection levels
Other legally valid transfer mechanisms under applicable law

These safeguards ensure that your data receives an adequate level of protection regardless of where it is processed.

8. Your Rights as a Data Subject

Under GDPR Articles 15-22, you have the following rights regarding your personal data:

8.1 Right of Access (Art. 15)

You may obtain confirmation of whether we process your personal data and request access to such data, including information about:

The purposes of processing
The categories of data processed
The recipients or categories of recipients
The retention period
Your rights regarding the data

8.2 Right to Rectification (Art. 16)

You may request correction of inaccurate or incomplete personal data.

8.3 Right to Erasure / "Right to be Forgotten" (Art. 17)

You may request deletion of your personal data when:

The data is no longer necessary for the purposes for which it was collected
You withdraw consent (where processing is based on consent)
You object to processing and there are no overriding legitimate grounds
The data has been unlawfully processed
Deletion is required to comply with a legal obligation

8.4 Right to Restriction of Processing (Art. 18)

You may request that we limit processing of your personal data in certain circumstances.

8.5 Right to Data Portability (Art. 20)

You may request to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

8.6 Right to Object (Art. 21)

You may object to processing based on legitimate interests or for direct marketing purposes.

8.7 Right to Withdraw Consent (Art. 7(3))

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

8.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, particularly in your country of residence, workplace, or where an alleged infringement occurred. For Italy, the supervisory authority is:

Garante per la Protezione dei Dati Personali
Website: https://www.garanteprivacy.it/
Email: garante@gpdp.it

9. Exercising Your Rights

To exercise any of the rights listed above, please send a written request to:

Email: privacy@zero-token.com
Subject line: "Data Subject Rights Request – [Your Name]"

Response Timeline:

We will respond to your request within one month of receipt. This period may be extended by up to two additional months when necessary due to the complexity or number of requests. We will inform you of any such extension within the initial one-month period.

Verification:

To protect your privacy, we may request additional information to verify your identity before processing your request.

No Fee:

Exercising your rights is free of charge unless your requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

HTTPS encryption for all data transmission
Secure authentication mechanisms (JWT tokens)
Regular security audits and monitoring
Access controls and authorization procedures
Incident response and breach notification procedures

Despite our efforts, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data using industry-standard practices.

11. Children's Privacy

The Tool is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child under 16, we will take steps to delete such information promptly.

12. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes in our practices, legal requirements, or the Tool's functionality. Any changes will be posted on this page with an updated "Last Updated" date at the top.

Notification:

For material changes that significantly affect your rights, we will provide prominent notice or seek your consent as required by law.

Your Responsibility:

We encourage you to review this Privacy Policy periodically. Continued use of the Tool after changes are posted constitutes acceptance of the updated policy.

Previous Versions:

Unless otherwise stated, changes to this policy will apply only to data collected after the effective date. Previous privacy policies will continue to govern data collected under those versions.

13. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us at:

Data Controller:
Paolo Cappelletto Ditta Individuale
Via Nino Bixio 14
20129 Milano (MI), Italy

Email: privacy@zero-token.com

We are committed to resolving any concerns you may have about your privacy and personal data.

Last Updated: March 2026