Privacy Policy

Privacy Policy

Last updated: 12 April 2026

This Privacy Policy explains how Roraima ("we", "us", "the Platform"), operated by [RAGIONE_SOCIALE], collects, uses, shares, and protects your personal data when you use our IoT marketplace platform, including our website, mobile services, AI assistants, and connected device features.

We are committed to protecting your privacy in accordance with Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR"), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and all applicable data protection laws.

Please read this policy carefully. By using our Platform, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

The data controller for personal data processed through the Platform is:

2. Data Protection Officer (DPO)

We have appointed a Data Protection Officer whom you may contact for any questions regarding the processing of your personal data or the exercise of your rights:

DPO contact: [DPO_EMAIL]

3. Categories of Personal Data We Collect

Depending on how you interact with the Platform, we may collect the following categories of personal data:

3.1 Account and identity data

• Full name, email address, phone number
• Billing and shipping address
• Company name, VAT number (for vendors)
• Account credentials (password stored in hashed form only)
• User role (buyer, vendor/seller, installer)
• Vendor subtype classification (seller, installer, or both)
• Professional documentation uploaded by installers (certifications, insurance)

3.2 Transaction and order data

• Order history, order amounts, payment status
• Booking and rental reservations (dates, guests, duration)
• Invoice and billing information
• Stripe payment identifiers (we do not store full card numbers)
• AI credit balances and consumption history

3.3 IoT device data

• Device status: on/off state, connectivity, firmware version, battery level
• Telemetry data: sensor readings (temperature, humidity, motion, energy consumption), relay states, device health metrics
• Smart lock access logs: timestamps of lock/unlock events, access method used (PIN, app, temporary code), user identifiers associated with each access event
• Usage patterns: frequency of device interactions, automation trigger history, scenario execution logs
• Device configuration: custom names, assigned rooms/zones, automation rules, schedules
• Device pairing and delegation data: device ownership transfers, installer delegation records, sharing permissions

3.4 AI interaction data

• Conversations with our AI assistants (Buyer Agent, Vendor Agent, Installer Agent)
• Questions submitted and responses received
• Knowledge base search queries (Installer Agent only)

3.5 Technical and usage data

• IP address, browser type and version, operating system
• Pages visited, time spent, click patterns
• Cookies and similar tracking technologies (see Section 12)
• Referral source

3.6 Location data

• Vendor business address (displayed on Google Maps for buyer convenience)
• Buyer shipping address
• Approximate location derived from IP address

3.7 Communication data

• Support requests and correspondence
• Vendor-buyer order communications
• Notification preferences

4. Purposes and Legal Bases for Processing

We process your personal data for the following purposes, each with the corresponding legal basis under GDPR Article 6(1):

4.1 Contract performance (Art. 6(1)(b))

4.2 Legitimate interest (Art. 6(1)(f))

4.3 Legal obligation (Art. 6(1)(c))

• Tax and accounting records retention (Italian fiscal law)
• Compliance with consumer protection regulations
• Responding to lawful requests from public authorities
• VAT calculation and reporting for EU cross-border transactions

4.4 Consent (Art. 6(1)(a))

• Marketing communications and newsletters (where applicable)
• Non-essential cookies and analytics (managed via Klaro consent manager)
• Processing of special categories of data, if ever required

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. IoT Device Data — Special Provisions

Given the nature of our platform, IoT device data requires specific attention:

5.1 What IoT data we collect and why

• Device status and telemetry are collected to enable real-time monitoring, automation scenarios, and troubleshooting. This data flows through our IoT Gateway and may be temporarily cached for performance.
• Smart lock access logs record who accessed a property and when. This data is essential for security, booking verification, and dispute resolution. Access logs include timestamps, the method of entry (PIN, temporary code, app), and the associated user or guest identifier.
• Automation scenario execution logs are retained to enable trigger-based automations, allow users to review scenario history, and diagnose failures.
• MQTT real-time data may be transmitted for devices using the MQTT protocol. This data is encrypted in transit and is not stored beyond the duration necessary for real-time processing unless explicitly configured by the user in an automation scenario.

5.2 Data minimisation for IoT

We collect only the device data points necessary for the features you have activated. If you do not use automation scenarios, scenario execution data is not generated. Telemetry granularity is determined by the device manufacturer's firmware and the features you choose to enable.

5.3 Device data sharing

When a device is delegated to an installer or shared with other users, the delegated party gains access to the device data necessary for their role. Delegation is tracked and can be revoked at any time by the device owner. Upon revocation, the delegated party's access to device data ceases immediately.

6. AI Assistants — Special Provisions

6.1 How our AI assistants work

Roraima offers three AI-powered assistants (Buyer Agent, Vendor Agent, and Installer Agent) powered by Anthropic's Claude language model. These assistants help users with product questions, IoT device management, and installation guidance.

6.2 Data processed by AI assistants

• Your messages and queries submitted during a conversation session
• Relevant contextual data (e.g., device status, order information) provided to the AI to generate helpful responses
• For the Installer Agent: indexed documentation from the knowledge base (RAG) used to answer technical queries

6.3 What we do NOT do with AI data

• We do not use your conversations to train or fine-tune any AI model
• We do not share your conversation content with other users
• We do not use AI conversations for profiling or automated decision-making that produces legal or similarly significant effects

6.4 AI data retention

AI conversation logs are retained for up to 90 days to enable conversation continuity and support dispute resolution. After this period, conversations are permanently deleted. You may request earlier deletion at any time (see Section 10).

6.5 Sub-processor

AI processing is performed by Anthropic, PBC (USA) as a data sub-processor. See Sections 7 and 8 for details on international transfers and safeguards.

7. Recipients and Data Processors

We may share your personal data with the following categories of recipients:

7.1 Marketplace vendors (independent controllers)

When you place an order with a vendor on Roraima, the vendor receives the personal data necessary to fulfil your order (name, shipping address, order details). Each vendor is an independent data controller for the data they receive and process in the context of their customer relationship with you. Vendors are contractually obligated to comply with GDPR and applicable data protection laws. We encourage you to review each vendor's own privacy policy.

7.2 Payment processor

Stripe, Inc. (USA) and its affiliate Stripe Payments Europe, Ltd. (Ireland) process payment transactions via Stripe Connect. Stripe acts as an independent data controller for payment data. Stripe's privacy policy is available at stripe.com/privacy.

7.3 AI service provider

Anthropic, PBC (USA) provides the Claude language model that powers our AI assistants. Anthropic processes conversation data solely on our behalf as a data processor and does not use this data to train its models.

7.4 Mapping service

Google LLC (USA) provides Google Maps services to display vendor locations. Google's privacy policy is available at policies.google.com/privacy.

7.5 Hosting and infrastructure

Our platform is hosted on servers located in [HOSTING_LOCATION]. Our hosting provider processes data solely on our behalf under a data processing agreement compliant with GDPR Article 28.

7.6 Other recipients

• Professional advisors: legal counsel, accountants, and auditors, bound by professional secrecy obligations
• Public authorities: when required by applicable law, regulation, or legal process
• IoT device manufacturers: certain device data may be exchanged with the device manufacturer's cloud platform (e.g., Tuya Smart) to enable device functionality. Such exchanges are governed by the manufacturer's privacy policy and our data processing agreements

8. International Data Transfers

Some of our processors and partners are located outside the European Economic Area (EEA), specifically in the United States. We ensure that any transfer of personal data to countries outside the EEA is protected by appropriate safeguards as required by GDPR Chapter V:

• Standard Contractual Clauses (SCCs): We have entered into the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with our US-based processors (Anthropic, Stripe, Google) to ensure an adequate level of protection for transferred data.
• EU-U.S. Data Privacy Framework: Where applicable, we rely on processors' certification under the EU-U.S. Data Privacy Framework as an additional safeguard.
• Supplementary measures: We implement additional technical and organisational measures as necessary, including encryption in transit and at rest, access controls, and data minimisation.

You may request a copy of the relevant safeguards by contacting our DPO.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Below are the specific retention periods by data category:

When data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you.

10. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

How to exercise your rights

You may exercise any of the above rights by contacting us at [EMAIL] or our DPO at [DPO_EMAIL]. We will respond to your request within 30 days, which may be extended by a further 60 days for complex requests, in which case we will inform you of the extension and the reasons for it.

We may ask you to verify your identity before fulfilling your request to prevent unauthorised access to personal data.

Supervisory authority

The competent supervisory authority for complaints is:

Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma, Italy
Website: www.garanteprivacy.it
Email: protocollo@gpdp.it
PEC: protocollo@pec.gpdp.it

11. Marketplace Roles — Controller and Processor

Roraima operates as a marketplace platform connecting vendors and buyers. This creates distinct data controller roles:

11.1 Roraima as data controller

We are the data controller for:

• User account data (registration, authentication, profile management)
• Platform usage and analytics data
• Payment processing coordination (via Stripe Connect)
• IoT device data managed through the platform
• AI assistant conversations
• AI credit management
• Cookie consent management
• Platform communications and support

11.2 Vendors as independent data controllers

Each vendor on the Roraima marketplace is an independent data controller for personal data they collect and process in the context of their relationship with buyers, including:

• Fulfilling orders and providing after-sales support
• Managing their own customer communications
• Processing returns and warranty claims
• Installation services and property access arrangements

Vendors are required under our Terms and Conditions to comply with the GDPR and to maintain their own privacy policies. We are not responsible for vendors' data processing practices beyond what occurs through the Platform.

11.3 Joint controllership

For certain processing activities (e.g., displaying vendor profile pages, facilitating reviews), Roraima and the vendor may act as joint controllers under GDPR Article 26. The respective responsibilities are defined in our Vendor Agreement.

12. Cookies and Similar Technologies

We use cookies and similar technologies on our Platform. We use Klaro as our consent management platform to allow you to manage your cookie preferences.

In summary, we use:

• Strictly necessary cookies: essential for the functioning of the Platform (e.g., session management, shopping cart, security). These do not require consent.
• Functional cookies: remember your preferences (e.g., language, currency).
• Analytics cookies: help us understand how the Platform is used so we can improve it.
• Third-party cookies: set by our partners (e.g., Stripe for payment security, Google Maps for vendor locations).

You can manage your cookie preferences at any time by clicking the cookie settings link in the footer of our website. For full details, please refer to our Cookie Policy.

13. Automated Decision-Making

We do not currently engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of GDPR Article 22.

Our AI assistants provide informational responses and suggestions but do not make decisions that have legal or significant effects on users. All purchase decisions, account actions, and service activations require explicit user action.

Should we introduce any form of automated decision-making in the future, we will update this Privacy Policy and, where required, obtain your explicit consent or implement suitable safeguards, including the right to obtain human intervention, express your point of view, and contest the decision.

14. Children's Privacy

The Roraima Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete such data promptly.

If you are a parent or guardian and believe that your child has provided personal data to us, please contact us at [EMAIL] so that we can take appropriate action.

15. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• Encryption of data in transit (TLS/SSL) and at rest where applicable
• Hashed password storage using industry-standard algorithms
• Access controls and role-based permissions
• Regular security assessments and vulnerability testing
• Secure smart lock access code generation and encrypted transmission
• Rate limiting and abuse prevention on all API endpoints
• CSRF protection on all forms
• Content Security Policy (CSP) headers
• Server-side input validation and sanitisation

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify registered users via email or platform notification for significant changes
• Where required by law, seek your renewed consent before applying changes to your data

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after the effective date of any changes constitutes your acknowledgement of the updated policy.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

This Privacy Policy is available in the following languages: English, Italiano, Deutsch, Ελληνικά, Español, Français, Polski, Português.