Privacy Policy
pursuant to Articles 13 and 14 of EU Regulation 2016/679 (hereinafter "Regulation")
Updated as of: March 31, 2026
This notice provides an overview of the processing of the user's personal data by Come Stai S.p.A. (Data Controller) and of the related rights under the provisions on the protection of personal data in the use of our App ("comestai App", hereinafter "App"), based on the service requested.
1. Information on the Data Controller
Pursuant to Article 4(7) of the GDPR, the Data Controller is:
Please be advised that the Data Controller is Come Stai S.p.A. (hereinafter "Comestai" or the "Controller"), with registered office at Via Angelo Rizzoli, 4 – 20132 Milan, Italy.
Please be advised that the Controller has appointed, pursuant to Art. 37 of the GDPR, a Data Protection Officer who can be contacted through the following channels:
- address: via Angelo Rizzoli, 4 – 20132 Milano
- e-mail: dpo@comestai.io
2. Purposes of processing and categories of data
Below we wish to inform you about the various types of personal data we process and for which purposes.
Data collected: First and last name, e-mail address, mobile phone number, device information (device ID, time of access to the App, browser type and operating system), review data (from 1 to 5 stars, average reviews), User ID, password, consent status.
The purposes of the processing of personal data are as follows:
- a) Registration to the Comestai App. Registration to the Comestai App makes it possible to access the services offered. The provision of data is optional but necessary for the purposes described above, failure to provide it resulting in the impossibility of fulfilling your requests.
- b) Payment for services. In order to make payment, the App will provide the personal data necessary to the payment gateways. It is possible to consult the terms of use as well as the rules on the processing of personal data directly on the websites of the payment gateways used. Failure to provide the data results in the impossibility of providing the requested service.
- c) Resolution of errors and improvement of the App's functionalities.
- d) Exercise of a right by the Controller in judicial or administrative proceedings.
- e) Compliance with laws, regulations and EU legislation.
- f) Advertising and offers. This service consists of sending personalised advertising, including newsletters, relating to the services offered by Comestai and by companies of the Vittoria Assicurazioni group. Advertising may be sent through automated tools (e-mail, SMS, MMS) or other electronic means (in-App notifications, push notifications). The provision of data is optional and consent may be withdrawn at any time (with effect within 48 hours of the request at the latest).
- g) Research and surveys. This service consists of participation in research and surveys through automated tools or other electronic means. We also collect information about the device, App version, access data, IDFA, IFV, GAID, IP address and usage data. Consent may be withdrawn at any time (with effect within 48 hours of the request at the latest).
- h) Profiling. Personal data is processed in order to analyse or predict the user's personal preferences, habits and characteristics for the purpose of sending personalised promotional communications.
3. Legal bases of processing
For the purposes referred to in points 2.a and 2.b, the legal basis is the performance of a contract or of pre-contractual measures (Art. 6(1)(b) of the GDPR).
For the purposes referred to in points 2.c and 2.d, the legal basis is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR) and therefore no consent is required.
For the purpose referred to in point 2.e, the legal basis is a legal obligation (Art. 6(1)(c) of the GDPR).
For the purposes referred to in points 2.f, 2.g and 2.h, the legal basis is consent (Art. 6(1)(a) of the GDPR).
4. Disclosure of data to third parties
The User's data may be processed by third parties, acting as independent controllers or as data processors, who collaborate with the Controller in various capacities. For commercial and marketing purposes (points 2.f and 2.g), the data may be disclosed to commercial partners. For the fulfilment of regulatory obligations, the data may be disclosed to Authorities or Institutional Bodies (e.g. police).
5. Transfer of data outside the EU
We store all personal data with a cloud service provider located within the EU. The data is accessed by a provider located in India, for the maintenance and updating of the software, ensuring all technical cyber-security measures; the processing of data takes place on the basis of the "Standard Contractual Clauses" approved by the European Commission as provided for in Articles 45 and 46 of the Regulation.
6. Retention period
Personal data will be retained for as long as the user remains active, or in any case for the period necessary to carry out the activities connected with the purposes for which it was collected, as well as to fulfil legal and contractual obligations. Upon expiry of these periods, the data will be deleted or irreversibly rendered anonymous.
7. Exercise of rights
The user has the right to request from us, at any time, information regarding their personal data on record, its recipients, the purposes of retention, the envisaged retention period, the right to data portability, rectification, erasure and restriction of processing, where the legal requirements are met.
Consent to processing for the purposes referred to in points 2.f, 2.g and 2.h may be withdrawn using the "unsubscribe" function in the communications sent or in the relevant section of the App.
All requests may be sent to: dpo@comestai.io or by writing to the Controller's address.
8. Complaint to the Supervisory Authority
In the event of processing in violation of the provisions of the Regulation, the data subject has the right to lodge a complaint with the Supervisory Authority for the protection of personal data.
9. Changes to this notice
Come Stai reserves the right to amend or update the content of this notice, in part or in full, including as a result of changes to applicable legislation.
Come Stai will inform you of such changes by publishing the updated text in the relevant section of the App.
We invite you to visit this section regularly in order to be aware of the most recent version of this notice.