Privacy Policy

Data controller

The data controller is Luigi Bianco, via Colonnello Enrico Franceschi 39/7, Chiavari, Italy, who operates prod2buy as a natural person. Contact: privacy@prod2buy.com.

Data we collect

• Registration data — first name, last name, email, role (buyer or supplier), company name, VAT number, phone, business sector, address. Suppliers also provide selected sectors of interest.
• Usage data — requests posted, proposals sent, messages exchanged, login timestamps.
• Navigation data — IP address, browser, pages visited and their sequence, referring page, date and time. Described in detail in the next section.
• Cookies — strictly technical session cookies issued by Supabase to keep you signed in, plus your language preference. No analytics or advertising cookies are used.
• Payment data — for suppliers, billing information is collected and processed by Stripe; prod2buy never stores card numbers.

Access log and navigation data

Every page request is recorded in an internal log, whether you are signed in or browsing anonymously. The log exists to keep the platform secure, prevent abuse and automated misuse, and analyse in statistical form how pages are used.

• The full IP address of the device the request comes from.
• The browser identifier (user agent) and, where available, the country of origin.
• Pages visited, their chronological sequence, the page language, and the address of the web page you came from.
• The link to your account if you are signed in; otherwise the visit remains anonymous.
• Recognition of automated visitors, such as search engines, to tell them apart from people.

To link together the pages seen by the same visitor we use no cookies and no identifier stored on your device: the link is computed on our servers as a non-reversible encrypted value, renewed every day. For this reason the log does not install any tracking technology on your device, and it relies on the legitimate interest set out in the following section.

Legal basis for processing

Processing is based on (a) performance of the contract you accept by creating an account, (b) compliance with legal obligations (tax, accounting), and (c) our legitimate interest in operating and securing the platform. The access log and navigation data rely specifically on legitimate interest under Article 6(1)(f) GDPR: service security, abuse prevention, and statistical analysis of usage. You have the right to object to this specific processing by writing to the address in the Contact section.

Data retention

Account data is kept while your account is active. After deletion, residual data tied to issued invoices or legal disputes is retained for the period required by Italian law (typically ten years for tax records). Access log and navigation data, including the IP address, are kept for 90 days and then deleted automatically.

Your rights

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion when there is no legal reason to keep your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection and restriction — object to processing based on legitimate interest, including the access log, or restrict it in specific cases.
• Complaint — lodge a complaint with the Garante per la protezione dei dati personali (https://www.garanteprivacy.it).