Privacy Policy

1. General Provisions & Scope

The operator of this mobile application (hereinafter referred to as the "Application") takes the protection of your personal data with the utmost seriousness. All personal data collected, processed, or stored within the scope of this Application shall be treated in strict confidentiality and in rigorous compliance with the statutory data protection provisions, notably the European General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and applicable national legislation.

Please note that this Application serves primarily as a client interface for the third-party educational platform “digitalesregister.it”. Insofar as personal data is transmitted to, processed by, or stored upon the servers of the respective educational institution, said institution remains the sole Data Controller. This Privacy Policy governs exclusively the data processing operations executed locally on your end-device and via the integrated analytical and diagnostic tools described herein.

2. Data Controller

The Data Controller responsible for the processing of data within this Application pursuant to Art. 4 No. 7 GDPR is:

Tobias Bucci
Email: buccitobias774@gmail.com
Italy

3. Categories of Data Processed & Legal Bases

3.1 Locally Stored Data (Core Functionality)

For the purpose of ensuring seamless functionality and provisioning the contractual services of the Application, the following categories of data are stored locally upon your end-device. The legal basis for this processing is Art. 6(1)(b) GDPR (processing necessary for the performance of a contract or the implementation of pre-contractual measures):

Authentication Credentials (including usernames, encrypted passwords, server URLs, and multi-account configurations);
Application Data Cache (including but not limited to academic grades, absences, internal notices, messages, and calendar entries);
User Profile Metadata (including name, email address, and institutional role);
User Preferences and Configurations (including push-notification configurations, application themes, and bookmarked elements);
Locally downloaded academic files and documents;
Technical system logs and cached notifications.

3.2 Data Transmission to the Institutional Server

To facilitate the intended operational purpose of the Application, data is transmitted directly to the servers operated by “digitalesregister.it”. The categories of data transmitted include:

Authentication and login credentials;
Specific school and institutional server URLs;
Academic and functional datasets (grades, attendance records, and internal institutional correspondences).

3.3 Analytical and Diagnostic Data (Tracking)

In order to guarantee technical stability, optimize performance, and continuously improve user experience, the Application integrates proprietary third-party diagnostic and analytical services. The processing of such data is strictly contingent upon your explicit, prior, and unambiguous consent. The legal basis for this data processing is Art. 6(1)(a) GDPR (Consent).

Consent is entirely voluntary and may be revoked or modified at any time with future effect via the privacy settings menu located within the Application.

Google Analytics for Firebase: This service aggregates anonymized interaction metrics (e.g., application invocation frequency, session duration, view transitions, and interface element interactions). All Internet Protocol (IP) addresses are truncated and anonymized by Google prior to any statistical assessment.
Firebase Crashlytics: In the event of a critical application malfunction or crash, anonymized diagnostic stack traces (comprising device architecture, operating system version, real-time application state at the time of failure, and error logs) are transmitted to facilitate swift remedial development.

4. Purposes of Processing

The Data Controller processes the aforementioned personal data strictly for the following purposes:

To render and display institutional and academic records (e.g., evaluations, scheduling, and notifications);
To manage and authenticate user accounts, including multi-account synchronizations;
To facilitate data synchronization with the server infrastructure of "digitalesregister.it";
To diagnose application vulnerabilities, maximize operational stability, and mitigate software defects (via Firebase Crashlytics);
To perform quantitative and qualitative reach measurement and audience analytics in an anonymized aggregate form (via Google Analytics for Firebase).

5. Third-Party Processors & International Data Transfers

In provisioning the Application’s capabilities, the Data Controller engages third-party service providers. Such engagements may necessitate the transfer of pseudonymized or anonymized technical metadata to territories outside the European Economic Area (EEA), specifically the United States of America. Google ensures an adequate level of data protection by adhering to the EU-U.S. Data Privacy Framework and through the execution of Standard Contractual Clauses (SCCs) approved by the European Commission.

Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – Acting as the provider of Google Analytics for Firebase, Firebase Crashlytics, and the Google User Messaging Platform (UMP) SDK, the latter utilized for the lawful administration of user consent metadata.
The respective educational institution (via digitalesregister.it).
Google Forms – Explicitly restricted to instances where the user voluntarily submits feedback or manual errata reports.
PayPal Inc. – Solely in the event of voluntary financial contributions or donations initiated by the user.

6. Data Retention and Erasure

Locally cached authentication and operational data shall be summarily expunged from the end-device upon the user executing a "log out" command within the Application, or alternatively, upon the total uninstallation of the Application from the end-device. Data processed via Google Analytics and Firebase Crashlytics is subject to automated retention thresholds established by Google, and is routinely deleted or completely anonymized after a maximum duration of 14 months.

7. Device Permissions

To ensure technical operability, the Application requires the invocation of the following system permissions:

Network Access (Internet): Required to establish a secure connection with the institutional servers and to transmit authorized analytical metadata.
Push Notifications: Required to alert the user of newly published evaluations, notices, or registration updates.
Local Storage Access: Required exclusively to facilitate the local download and preservation of pedagogical materials provided by instructors.

Sensible device capabilities, such as the camera, microphone, precise geolocation hardware (GPS), or personal contacts, are not requested, accessed, or utilized by this Application.

8. Protection of Minors

Given that the primary target demographic of this Application comprises students, the Data Controller acknowledges that users may be under the age of 13 or 16. The integrated consent framework (Google UMP) strictly accounts for and adheres to the heightened regulatory barriers governing the processing of minors' data within the European Union. No behavioral profiling or personalized advertising datasets are generated.

9. Rights of the Data Subject (Betroffenenrechte)

Pursuant to Chapter III of the GDPR, you possess the following inviolable rights regarding your personal data:

Right of Access (Art. 15 GDPR): The right to obtain confirmation as to whether or not your personal data is being processed, and access to said data.
Right to Rectification (Art. 16 GDPR) & Erasure (Art. 17 GDPR): The right to obtain the rectification of inaccurate data or the immediate erasure of your data (executable locally at any time via uninstallation or logging out).
Right to Withdraw Consent (Art. 7(3) GDPR): The right to withdraw your consent to data tracking at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to Lodge a Complaint (Art. 77 GDPR): The right to lodge a complaint with a competent supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR.

For all inquiries concerning data hosted on institutional servers (grades, attendance, etc.), please direct your petitions to the respective school administration. For application-specific inquiries, contact the Data Controller at the address specified in Section 2.

10. Amendments to this Privacy Policy

The Data Controller reserves the right to modify, amend, or alter this Privacy Policy at any time to ensure ongoing alignment with evolving statutory mandates, judicial precedents, or technical updates within the Application.