Privacy Policy

Last updated: 27 Sep 2026

Part A – Website www.lisorect.it

Data Controller

Lisorect d. Locher Matthias, Steinackerstr. 37, IT-39040 Tramin a.d.W. (BZ), Italy. Email: info@lisorect.it.

What data is processed?

This website uses only a technically necessary session cookie to store the selected language. No tracking, analytics tools or advertising are used. For technical reasons, the hosting provider briefly processes server log data (e.g. IP address, access time) when the site is visited, to ensure stable operation.

Legal Basis

Processing is based on the legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR). The language cookie is technically necessary and does not require consent.

Retention Period

The session cookie is automatically deleted when the browser is closed. Server log data is kept only as long as necessary to ensure secure operation.

Disclosure to Third Parties

No data is shared with third parties, except the hosting provider, who acts as data processor within the limits set by law.

Part B – SaaS platform (register.lisorect.it and customer instances)

Scope and roles

This part applies to registration at register.lisorect.it and to customer instances at <name>.lisorect.it. For our customers' data (registration, contract, billing, security) Lisorect is the controller. For the data customers process in their instance (e.g. their employees' working hours) the respective customer is the controller; Lisorect processes this data only on the customer's behalf as processor (Art. 28 GDPR). Data subjects should contact the respective company regarding such data.

What data is processed?

Registration: company name, requested subdomain, email address, password (stored only as an encrypted hash), selected product, optionally logo and colours, confirmation code.
Contract and billing: plan, billing period, payment status, invoicing data (e.g. VAT number, SDI recipient code/PEC). Payment data such as card or account numbers is processed exclusively by the payment provider Mollie and is not stored by us.
Login and security: IP address, entered username, number and time of failed login attempts, to protect accounts against attacks.
Communication: content of emails and support requests.
Server logs: IP address, time, requested address, browser identifier.

Purposes and legal bases

Providing the platform, performing the contract, support and billing (Art. 6(1)(b) GDPR); compliance with tax and commercial law obligations, in particular electronic invoicing (Art. 6(1)(c) GDPR); protecting the platform against abuse and attacks and enforcing the terms of use (Art. 6(1)(f) GDPR). Providing the registration data is required to conclude the contract; without it no instance can be provided.

Storage in the browser

After login the application stores a login token in the browser's local storage and, briefly, the last page visited. Both are technically necessary and do not require consent. No tracking, analytics or advertising cookies are used.

Automated checks

Company names and subdomains are automatically checked for inadmissible terms during registration; in addition, logins are temporarily blocked after repeated failed attempts. No automated decision with legal effect within the meaning of Art. 22 GDPR takes place; blocked access is reviewed manually on request.

Recipients and processors

Hetzner Online GmbH, Germany (server hosting, data centres in the EU); Aruba S.p.A., Italy (email delivery); Mollie B.V., Netherlands (payment processing – partly an independent controller for payment data); tax advisors and authorities where required by law. Contracts under Art. 28 GDPR are in place with all processors. No data is transferred to countries outside the EU/EEA.

Retention period

Unconfirmed registrations are deleted within 30 days. Trials that are not converted: the instance is deleted 30 days after the trial ends. After the contract ends: the instance and all customer data are deleted after 30 days; backups are overwritten no later than 90 days thereafter. Login and security data is deleted no later than 90 days after the last login attempt. Invoices and accounting records are kept for 10 years (Art. 2220 Italian Civil Code).

Data security

All connections are TLS-encrypted. Passwords are stored only as hashes. Each customer gets a separate environment isolated from other customers (dedicated containers and database). Data is backed up regularly.

Terms of use

Use of the platform is additionally governed by the terms of use. Data in customer instances is governed by the data processing agreement (DPA).

Your Rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest (Art. 15–21 GDPR). You may also lodge a complaint with the competent supervisory authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it). For requests, please contact info@lisorect.it.