1. Data Controller
Controller: SeoSoft di Federico Cassani
Registered office: Via Gran Bretagna 44, Trani (BT), Italy
VAT number: IT09158230723
OVVO website: https://ovvo.it
Company website: https://www.seosoft.it
Email: info@seosoft.it
Phone: +39 338 208 9310
The Data Controller is the entity that, alone or jointly with others, determines the purposes and means of processing personal data.
2. Data collected
OVVO collects and processes the following categories of personal data:
PMS user data (operators)
- •First and last name
- •Email address (used as username)
- •Password (encrypted with bcrypt, not readable)
- •Company role (admin, staff)
- •Session data (httpOnly technical cookie)
Guest data of the accommodation
- •Name, surname, date and place of birth
- •Nationality and identity document (type, number, issued by)
- •Email address and phone number (optional)
- •Stay data (dates, room, number of guests)
Technical navigation data
- •IP address (in server logs for 30 days)
- •Browser type and device
- •Pages visited and access times
3. Purposes and legal basis
| Purpose | Legal basis (GDPR art.) |
|---|---|
| Provision of the PMS management service | Contract performance — art. 6(1)(b) |
| Transmission of Alloggiati Web forms to Law Enforcement | Legal obligation — art. 6(1)(c) + D.Lgs. 286/1998 |
| Authentication and access security | Legitimate interest — art. 6(1)(f) |
| Service communications (renewals, updates) | Contract performance — art. 6(1)(b) |
| Tax and accounting compliance | Legal obligation — art. 6(1)(c) |
| Service improvement and aggregated analysis | Legitimate interest — art. 6(1)(f) |
| Marketing and remarketing via Meta Pixel — only with explicit consent | Consent — art. 6(1)(a) |
4. Retention period
6. Your rights
Under arts. 15–22 of the GDPR, you have the right to:
Access (art. 15)
Obtain confirmation of whether your data is being processed and receive a copy
Rectification (art. 16)
Correct inaccurate or incomplete data
Erasure (art. 17)
"Right to be forgotten" — request deletion of your data
Restriction (art. 18)
Restrict processing in certain circumstances
Portability (art. 20)
Receive your data in a structured, machine-readable format
Objection (art. 21)
Object to processing based on legitimate interest
Withdraw consent
Withdraw consent at any time without affecting prior processing
Complaint to the Authority
Lodge a complaint with your national Data Protection Authority
To exercise your rights, write to: info@seosoft.it. We will respond within 30 days of receiving your request (art. 12 GDPR).
8. Security measures
OVVO implements appropriate technical and organisational measures under art. 32 GDPR:
- ✓Encrypted transmission via HTTPS/TLS on all channels
- ✓Operator passwords encrypted with bcrypt (salt factor ≥ 10) — never readable in plain text
- ✓Session-based authentication with httpOnly and Secure cookies
- ✓Multi-tenant isolation: each property sees only its own data
- ✓Periodic database backups
- ✓Access to production systems limited to authorised personnel
9. Contact
For any request regarding the processing of your personal data:
SeoSoft di Federico Cassani
Address: Via Gran Bretagna 44, Trani (BT), Italy
Email: info@seosoft.it
Phone: +39 338 208 9310
Website: www.seosoft.it
Italian Data Protection Authority (Garante): www.garanteprivacy.it
The Controller reserves the right to amend this policy. Changes will be published on this page with an updated date at the top. In case of material changes, registered users will be notified by email.