Privacy Notice

Last updated: April 16, 2026

1. Data Controller

2. Scope

This notice concerns the processing of personal data of users who register on the Italian Truffle App platform, accessible at truffleweek.it/ita/.

Italian Truffle App is a certification and traceability system for Italian truffles, designed for authorized truffle hunters, consortia and commercial operators. The system currently operates in test mode (pre-blockchain).

3. Data collected

• Identification data: name, surname, tax code or VAT number, address
• Contact data: email, phone
• Professional data: operator type, collection permit number, region of activity
• Access credentials: username and password (stored in encrypted hash form)
• Test codes: unique codes assigned during the test phase
• Usage data: access logs, operations performed, timestamps

4. Purposes and legal bases

Purpose	Description	Legal basis
Registration and access	Account creation, authentication, profile management	Art. 6(1)(b) – Contractual performance
Certification and traceability	Code assignment, batch registration, origin tracking	Art. 6(1)(b) – Contractual performance
Testing and development	Pre-blockchain functional testing, feedback collection	Art. 6(1)(f) – Legitimate interest
Service communications	Technical notifications, platform updates	Art. 6(1)(b) – Contractual performance
Regulatory compliance	Food traceability obligations	Art. 6(1)(c) – Legal obligation

5. Data retention

• Account data: duration of registration + 24 months after deletion
• Traceability data: 10 years (food traceability obligations)
• Access logs: 6 months
• Test codes: until end of test phase + 12 months

6. Security

Data is stored on a database hosted by Netsons S.r.l. on EU servers. Security measures include:

• Cryptographic password hashing
• Database access restricted to authorized personnel with individual credentials
• Regular backups with integrity verification
• HTTPS protocol for all communications
• Role-based access segregation
• Audit trail of all platform operations

7. Future developments – Blockchain and DPIA

In a future phase, the system may integrate blockchain technology for immutable batch certification. In that case:

• Data recorded on blockchain will be pseudonymized (cryptographic hashes, not plain text)
• The legal basis for on-chain processing will be assessed case by case
• A Data Protection Impact Assessment (DPIA, Art. 35 GDPR) will be conducted before activation
• Users will be informed in advance of any changes

8. Your rights

All rights listed in the general Privacy Policy (Section 7) apply in full. To exercise them, contact privacy@truffleweek.it.

Note: in the event of future blockchain integration, the right to erasure may only be exercised for off-chain data. On-chain data, being pseudonymized and immutable by nature, cannot be modified or deleted.