MOD 83.ENC.1 - Rev. 0 - 17/09/2026
The data controller is Orlando Engineering and Consulting Srl, Via Antonio Pacinotti 17, 20094 Corsico (MI) — Italy, VAT number 12625200964. For any matter concerning personal data, please write to techsupport@orlandoeandc.com.
No data protection officer has been appointed, the conditions required by law not being met.
Easy Nonconformity is software used by companies to manage non-conformities, complaints and quality events. In the course of using the service, different roles in the processing of personal data may therefore arise.
As regards the data of those who sign in — name, email address, settings — the data controller is Orlando Engineering and Consulting Srl.
As regards the content entered into the service — issues, content added over time, attachments — the data controller is the Client Company that enters it, while Orlando Engineering and Consulting Srl acts as a data processor under art. 28 GDPR, on the basis of the contract signed with that Client Company.
Easy Nonconformity does not require personal data concerning third parties to be entered into issues.
However, depending on its own activity and on the nature of the issue, the Client Company may enter personal data concerning third parties, which may also include special categories of personal data.
Such data is neither requested nor used by Orlando Engineering and Consulting Srl for its own purposes: where it is entered by the Client Company, it is processed solely in the course of providing the service and on that company's behalf, in the capacity of data processor.
Data of those who use the service: Name, email address, preferred language, organisation, account status, date of creation and of last change. If the second authentication factor is enabled, the data needed to verify it and the recovery codes. The outcome of service messages — delivered, bounced — is recorded, so that it is possible to understand why a message was not received.
Company data: Company name, sector, email address, tax code (codice fiscale), VAT number, country. For a sole trader the tax code is personal data, and it is treated as such.
Content entered by users: The text of issues, the content added over time and the attached files. This content is free-form and may include personal data concerning third parties, such as names, photographs or other information relating to natural persons. Depending on the nature of the issue, special categories of personal data may also be present. The division of roles described in point 2 applies to such data. Any special categories of personal data entered by Client Companies are processed by Orlando Engineering and Consulting Srl solely on their behalf and are NOT used for its own purposes. Orlando Engineering and Consulting Srl does NOT profile any user and does NOT take automated decisions producing effects on people.
Technical error data: When the service or the application, web or mobile, encounters an error, a technical report is recorded: the error message and where it occurred, the application version, the screen in use, the last request made to the server, the user account, the IP address and the type of device or browser. This data is processed solely to identify and fix malfunctions, on the basis of the legitimate interest in the proper functioning of the service (Art. 6(1)(f) GDPR), and is retained for 90 days from the last time the same error occurred.
Providing the data needed to create and manage an account is necessary in order to use the service. Without that data an account cannot be created or kept active.
Inside the application no tracking whatsoever is carried out. No profiling cookies, no third-party analytics tools, no advertising pixels or SDKs are used. The token needed to keep the session open is held in the browser's local storage and is transmitted solely to the servers of Orlando Engineering and Consulting Srl.
On the public presentation page — that is, the site's main address, reachable without signing in — Orlando Engineering and Consulting Srl uses Google Analytics to measure the number of visits. The service processes a device identifier and the IP address, and uses cookies in the browser.
For a detailed list of the cookies used, their purpose and their duration, please refer to the Cookie Policy available at https://easynonconformity.com/cookie-policy.
Google Analytics is activated solely upon prior consent. On the first visit a notice is shown allowing a choice, through two equivalent options, whether to accept or refuse.
In the absence of consent, no request is sent to Google and no cookie is installed. The legal basis for the processing is consent (art. 6(1)(a) GDPR), which may be withdrawn at any time through the dedicated control at the foot of that page. Where consent is withdrawn, the cookies already installed are deleted.
The mobile application requires a single system permission on Android — network access — while on iOS it requires access to the camera, solely at the moment the user chooses to attach a photograph. The application contains no analytics tools.
To provide the service, the infrastructure of Amazon Web Services (AWS) is used, located in the eu-west-1 (Ireland) region, for hosting the application server, storing attached files and sending service messages. AWS processes the data in the capacity of sub-processor.
The data processed in order to provide the service — accounts, issues, content added over time, attachments and service messages — is processed and stored within the European Economic Area (EEA) and is not transferred to third countries.
A single exception, confined to the public presentation page and conditional upon the consent described in point 5. Where the visitor gives that consent, the data collected by Google Analytics — a device identifier and the IP address — is transmitted to Google Ireland Limited, which processes it as a data processor under the Google Analytics Data Processing Terms and which may also process it outside the EEA through its affiliated companies. The transfer takes place on the basis of the safeguards provided for in Chapter V GDPR: at present, the European Commission's adequacy decision concerning the EU-U.S. Data Privacy Framework and, failing that, standard contractual clauses. In the absence of consent, no request is sent to Google and no data leaves the EEA.
No content entered into the service by Client Companies — issues, content, attachments — is transmitted to Google or to any other third party.
Personal data is not sold, transferred or disclosed to third parties for marketing purposes.
Account data is kept for the whole duration of the contractual relationship and, after it ends, for a period of 24 months.
Content entered by companies is kept for the whole duration of the contract. On termination of the relationship, such content is handled as provided by the contract itself, with return within 30 days of termination and deletion within 60 days, without prejudice to any retention obligations laid down by applicable law.
Data processed in compliance with legal obligations is kept for the period laid down by applicable law.
Orlando Engineering and Consulting Srl adopts technical and organisational measures intended to ensure a level of security appropriate to the personal data.
Communications between users' devices and the servers of Orlando Engineering and Consulting Srl are encrypted. Access to data is governed by an authorisation system based on three levels of role, which restricts access to the information pertinent to the functions and permissions assigned to each user.
A second authentication factor is also available, and each Organisation may make it mandatory for its own users.
Deletions are initially carried out as logical deletions, so that data can be recovered in the event of accidental deletion, in accordance with the retention periods and arrangements provided for.
Any user may request access to their data, its rectification, erasure, restriction of processing, portability, and may object to processing based on legitimate interest (arts. 15-22 GDPR). Requests may be sent to the address given in point 1 and will receive an answer within one month.
That period may be extended by two months where requests are complex or numerous (art. 12(3) GDPR); in that event the controller will give notice of the extension and of the reasons for it within one month of the request.
If a user believes that the processing of their personal data infringes the Regulation, they may lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali).
If the request concerns personal data held in an issue or in other content entered by the client company, the data controller is the Client Company. Orlando Engineering and Consulting Srl, in the capacity of data processor, provides the client company with the support needed to handle requests relating to such data.
This notice may be updated where the arrangements for processing personal data change. The date of the latest update is given at the top of the document. Any substantial changes will be notified to data subjects through the service.
In the event of any discrepancy between the Italian and English versions of this notice, the Italian version prevails.