Privacy policy

Draft — pending legal review. This document is a working draft. It describes our current practice accurately, but the specific legal-entity details and some commitments below are placeholders awaiting sign-off. Do not treat it as the final published policy.

Who we are

The data controller for the personal data described here is NPM2 Solutions Srl [TODO: legal review — registered address and VAT number]. If you have any question about this policy or how we handle your data, write to privacy@worgify.com.

What we collect and how

We collect only the personal data you choose to give us through this site, in three ways:

• Contact and demo requests. When you fill in a contact or demo form, we collect the details you enter — typically your name, email address, company, and whatever you write in the message. These submissions are relayed to our customer relationship management system so we can respond and follow up.
• Standards-change alert subscriptions. When you subscribe to alerts about changes to the standards you work to, we collect your email address and hold it for the alert service, so we can send you the notifications you asked for.
• Analytics. As you browse the site, we collect usage data — pages viewed, approximate location, device and browser type, and similar — through a product analytics tool, to understand how the site is used and improve it.

Why we process it, and on what legal basis

Under Article 6 of the GDPR, each purpose rests on a specific legal basis:

• Responding to your contact or demo request — our legitimate interest in answering enquiries, and taking steps at your request before entering into a contract (Art. 6(1)(b) and (f)).
• Sending standards-change alerts — your consent, given when you subscribe, which you can withdraw at any time (Art. 6(1)(a)).
• Analytics — your consent, where consent is required for the analytics and any cookies involved (Art. 6(1)(a)).

Where your data lives

Your personal data is hosted and processed within the European Union.

Who else processes it

We use a small number of service providers who process personal data on our behalf as sub-processors. We name them honestly:

• GoHighLevel — customer relationship management, holding contact and demo-request submissions.
• Brevo — transactional email delivery.
• PostHog — product analytics, on its EU region.
• Hetzner — hosting, in Germany.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

International transfers

We aim to keep processing within the European Union. Where any provider processes data outside the EU or European Economic Area, we rely on an appropriate transfer safeguard under the GDPR — such as an adequacy decision or the European Commission's standard contractual clauses. [TODO: confirm — verify each sub-processor's transfer mechanism during legal review.]

How long we keep it

We keep your data only as long as we need it for the purpose you gave it:

• Alert subscription data — until you unsubscribe or withdraw your consent.
• Contact and demo-request data — for as long as needed to handle your enquiry and any follow-up, and any period we are required to retain it. [TODO: confirm retention period during legal review.]
• Analytics data — for the retention period configured in the analytics tool. [TODO: confirm.]

Your rights

Under Articles 15 to 22 of the GDPR, you have the right to:

• access the personal data we hold about you;
• rectify data that is inaccurate or incomplete;
• erase your data, where the conditions apply;
• restrict our processing, in certain circumstances;
• data portability — receive your data in a structured, commonly used, machine-readable format;
• object to processing based on our legitimate interest.

Where our processing rests on your consent, you can withdraw that consent at any time; withdrawing it does not affect the lawfulness of what we did before. To exercise any of these rights, write to privacy@worgify.com. We will respond within the timeframe the GDPR sets.

Complaints

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it). You may also complain to the authority in your own country of residence.

Changes to this policy

We may update this policy as the site, our providers, or the law change. When we make a material change, we will update this page and revise the date below. [TODO: add "last updated" date and version at publication.]