Cookie Policy

V1.1

Product: Data Aggregator / API Gateway for Resale
Company: Plumma® Srl
Last Updated: 30/12/2025

1) Who We Are

Plumma® Srl is a company incorporated under Italian law, with its registered office at VIA CORSINI 21, Frazione FELLICAROLO, 41021 FANANO (MODENA), Italy (hereinafter, Plumma®, we, or Controller). Plumma® provides a professional API platform (the Service) acting as a data gateway and aggregator for business clients (the Clients).

2) Scope and Processing Roles

In compliance with the General Data Protection Regulation (GDPR), Plumma® operates in two distinct roles:

• Plumma® as Data Controller: For data concerning platform users, website visitors, and Clients' billing/administrative data.
• Plumma® as Data Processor: For the personal data of end-customers sent by our Clients via APIs for processing and enrichment. We act strictly upon the Client's documented instructions as defined in our Data Processing Addendum (DPA).

3) Data We Collect

A) Platform User Data (Controller Context)

• Account Data: Name, email, phone, company name, and billing details.
• Payment Data: Managed via secure third-party providers; Plumma® does not store full credit card details.
• Technical Telemetry: IP address, device/browser information, and API usage logs for billing and security.

B) Client-Provided Data (Processor Context)

• Identifiers (Name, DoB, Address) and specific network/transactional data provided via API for aggregation and enrichment.

4) Purposes and Legal Bases

We process Platform User Data based on:

• Contract Performance: To provide the Service and manage billing.
• Legitimate Interest: For platform security, fraud prevention, and service diagnostics.
• Legal Obligation: For tax and regulatory compliance.

5) Sharing and Sub-Processors

To ensure high performance and security, we utilize the following specialized sub-processors:

• WaveMaker: Application development and deployment infrastructure. Data resides within the European Union (EU).
• Amazon Web Services (AWS) / CloudFront: Cloud hosting and Content Delivery Network (CDN) for secure and low-latency API delivery.
• GitHub: Version control and source code management. Transfers are protected by Standard Contractual Clauses (SCCs).

6) International Transfers

While primary hosting is in the EU, technical services (e.g., GitHub, AWS global edge locations) may involve data transfers to the U.S. All such transfers are governed by Standard Contractual Clauses (SCCs) or the Data Privacy Framework (DPF) to ensure a GDPR-equivalent level of protection.

7) Data Retention

• Account Data: Retained for the duration of the service plus statutory limitation periods (e.g., 10 years for Italian tax records).
• Client API Data: Retained as per the DPA instructions, typically deleted within 30 days of contract termination.

8) Security

We implement industry-standard encryption (TLS in transit, AES at rest), network segmentation, and strict access controls via our AWS infrastructure to protect against unauthorized access.

9) Your Rights (GDPR)

Users have the right to access, rectify, erase, or object to the processing of their personal data. For data where Plumma® acts as a Processor (Section 3.B), individuals must contact the respective Client (Data Controller) to exercise these rights.

10) Cookie Policy and Local Storage

Plumma® Srl operates under a Privacy by Design principle. Our platform exclusively uses strictly necessary technical cookies and similar client-side storage technologies to provide the Service. These do not require prior consent under the GDPR.

Technologies Used

In addition to cookies, we utilize Local Storage and Session Storage to enhance performance. These allow us to store session states and UI preferences locally in your browser, reducing latency and server load.

Functional Categories

• Authentication & State: We use session identifiers (e.g., JSESSIONID) generated by WaveMaker to maintain your authenticated state. Without these, the portal cannot verify your identity across different pages.
• Security & Integrity: We deploy security tokens (e.g., XSRF-TOKEN) to prevent Cross-Site Request Forgery (CSRF) attacks. Our infrastructure also logs technical data (IP addresses) to detect and mitigate malicious activity.
• Routing & Performance: Through Amazon CloudFront, we use technical cookies (e.g., AWSALB) to route your requests to the optimal server node, ensuring connection stability during the data aggregation process.

No Third-Party Tracking

Plumma® Srl does not use advertising cookies, tracking pixels, or third-party analytics (e.g., Google Analytics). We do not track your activity across other websites. Consequently, while we acknowledge "Do Not Track" (DNT) signals, our platform's behavior remains unchanged as no cross-site tracking is performed.

Management

You may block cookies via browser settings; however, as a professional authenticated tool, the Network API platform will become inaccessible if these technical identifiers are disabled.

11) Contact Us

For privacy inquiries or to exercise your rights:
Plumma® Srl
Email: support@Plumma®.it
Registered Office: VIA CORSINI 21, 41021 FANANO (MO), Italy.