Privacy Policy

Product: Data Aggregator/API Gateway

Last Updated: 22/12/2025 v1.2 

1) Who We Are 

Plumma® Srl is a company incorporated under Italian law, with its registered office at VIA CORSINI 21, Frazione FELLICAROLO, 41021 FANANO (MODENA), Italy (hereinafter, "Plumma®", "we", or "Controller"). Plumma® provides an API platform (the "Service") which acts as a data gateway and aggregator for its business clients (the "Clients"), enabling them to enrich and manage their end-users' data. 

2) Scope and Processing Roles 

Plumma®'s business model involves two distinct roles in data processing, in compliance with the General Data Protection Regulation (GDPR): 

• Plumma® as Data Controller: This applies to data concerning platform users, website visitors, and Clients' administrative/billing data. We process this data for our own legitimate purposes (service management, marketing, security). 

• Plumma® as Data Processor: This applies to the personal data of end-customers that our Clients (the Data Controllers) send to us via the Service's APIs for processing, aggregation, and enrichment. In this case, we act strictly upon the Client's documented instructions. The terms for this processing are defined in a separate Data Processing Addendum (DPA). 

3) Data We Collect 

We collect data in two main contexts: 
 
A. Platform User and Website Data (Plumma® is Controller) 
 
 

Data Category	Description
Registration/Account Data	First name, last name, email address, phone number, company name, and billing details.
Payment Data	Partial payment details. Full credit card information is managed directly by our payment service provider (Sub-Processor) and is not stored by us.
Service Usage/Telemetry Data	IP address, device and browser information, access logs, viewed pages, and, specifically, the number of API calls made per service (used for billing and service optimization).

B. Client-Provided Data for Processing (Plumma® is Processor) 

This is the data that our clients send to us via the APIs for processing and enrichment. Plumma® processes this data as a Data Processor: 

• Basic Identifiers: First name, last name, date of birth (DoB), address. 

• Additional/Specific Data: Other identifiers and attributes provided by the Client (e.g., Customer ID, Transactional Data, Network Data) necessary for aggregation and enrichment. 

4) Sources of Data 

Data is sourced from: 

• Directly from you: Through registration and platform usage. 

• From your employer: If you are a platform user and your employer is our Client. 

• From our service providers (e.g., payment providers, web analytics tools). 

• From our clients (data in B only): Provided via API for processing. 

5) Purposes and Legal Bases (Plumma® as Controller) 

We process Platform User Data (Section 3.A) for the following purposes and legal bases (ref. EU/UK GDPR): 

Processing Purpose	Legal Basis (GDPR)
Service Provision and Security	Contract Performance (for Account, Billing) and Legitimate Interest (Security and Fraud Prevention).
Account Management and Support	Contract Performance (for Support and Service Communications).
Service Improvement (Analytics)	Legitimate Interest (Analysis and diagnostics to improve platform functionality).
Commercial Communications (Marketing)	Legitimate Interest (Soft Spam, if you are an existing Customer) or Consent (for new sign-ups or newsletters). The right to Opt-out is guaranteed at any time.
Legal Compliance	Legal Obligation.

6) Processing on Behalf of Clients (Plumma® as Processor) 

Plumma® processes end-customer data (Section 3.B) strictly upon the written and documented instruction of the Client (Data Controller), as specified in the Data Processing Addendum (DPA). 

Our function in this context is the aggregation of data from various external sources and suppliers to achieve a specific output required by the Client through the API endpoint calls. Plumma® guarantees that no processing will be carried out beyond what is specified in the DPA and the Client's instructions. 

N.B.: Based on your input, Plumma® does not forward Client data received via API to external third parties on its own behalf. Aggregation is performed internally using the sources/suppliers already managed and configured by Plumma®. 

7) Sharing and Sub-Processors 

Technical Infrastructure and Development Partners To ensure the high performance, security, and continuous delivery of our API Gateway, Plumma® Srl utilizes specialized technical sub-processors: 

• WaveMaker: Used for application development and deployment. Data processed through WaveMaker is hosted on servers located within the European Union (EU), ensuring strict adherence to regional data residency requirements. 
   

• GitHub: Used for version control and source code management. While GitHub may involve data processing in the United States, such transfers are protected by Standard Contractual Clauses (SCCs) and robust security protocols to ensure a level of protection equivalent to the GDPR. 
   

• Amazon CloudFront (AWS): Used as a Content Delivery Network (CDN) to ensure low-latency delivery and security. As part of the AWS ecosystem, CloudFront processes data primarily within the European Economic Area (EEA), with any international transfers covered by the AWS Data Processing Addendum and SCCs. 

8) International Transfers 

Plumma® uses hosting infrastructure located within the European Union (EU). Therefore, data transfer outside the EEA/EU is not the default. Should a transfer outside the EEA be necessary for specific services (e.g., CRM/Analytics), we will ensure the transfer is governed by: 

• The adoption of Standard Contractual Clauses (SCCs) approved by the European Commission, combined with necessary supplementary measures. 

• Adoption of other applicable transfer mechanisms (e.g., adequacy decision). 
   
   

9) Data Retention 

• Platform/Account Data (Controller Context): Retained for as long as your account is active and for the necessary period to comply with legal/business obligations (e.g., tax records), after which it is deleted or anonymized. 

• Client-Provided Data (Processor Context): Retained for the duration of the agreement with the Client and deleted within 30 days after termination or earlier upon the Client's request. Backup media will be overwritten within an additional 30 days. 

10) Security 

We implement industry-standard security measures, including data encryption in transit and at rest, strong access controls, network segmentation, and vulnerability management. While we strive for maximum security, no system can be guaranteed to be 100% secure. 

11) Your Rights (GDPR) 

As an individual whose data we process, you have the following rights concerning your Personal Data processed by Plumma® (Sections 3.A and 3.B): 

• Right of Access: Obtain confirmation and access to your data. 

• Right to Rectification: Correct inaccurate data. 

• Right to Erasure (Right to be Forgotten): Request deletion of your data, subject to legal limitations. 

• Right to Data Portability: Receive your data in a structured, commonly used format. 

• Right to Restriction of Processing: Limit how we process your data. 

• Right to Object: Object to processing based on legitimate interest (including marketing). 

• Right to Withdraw Consent: Withdraw consent at any time, where consent is the legal basis. 

Note for End-Customers (Section 3.B): If you are an end-customer of one of our Clients and wish to exercise your rights, you must contact the Client directly, as they are the Data Controller responsible for your data. We will assist the Client in fulfilling the request as required by the DPA. 

12) Automated Decisions and Profiling 

Plumma® does not make decisions that produce legal or similarly significant effects based solely on automated processing. We may use profiling (e.g., analyzing API usage frequency) to improve service delivery and marketing, but this does not result in automated legal decisions. 

13) Changes to this Policy 

We may update this Policy from time to time. We will post any changes on this page and update the "Last Updated" date. 

14) Contact Us 

For any questions or to exercise your rights, please contact our dedicated Privacy Contact: 

Plumma® Srl Email: support@Plumma®.it