Privacy Policy App

Data Controller

The Data Controller for personal data is Parts S.r.l. Società Benefit, an Innovative Startup with registered office in Italy, VAT no. 10996271218, reachable at the email address info@partshub.it.

Users may exercise their rights by contacting the Data Controller using the details provided in Section 10.

Scope

This Privacy Notice applies exclusively to the PARTS mobile app, distributed on the App Store (iOS) and Google Play (Android), used by visitors of partner museums to explore artworks through audio and textual content in different exploration modes.

The app is free and publicly downloadable. Access to the content of a specific museum requires activation via QR code, NFC, a code provided by the museum, or — for some museums — free access.

For the privacy policy of the partshub.it website, please refer to the notice available at /privacy/.

Data Collected by the App

The PARTS app is designed according to the data minimization principle: it is used anonymously and does not require registration or the entry of identifying personal data (name, email, etc.).

3.1 Anonymous technical identifier

On first launch, the app generates an anonymous technical identifier (UUID) via the Supabase authentication service. This identifier is necessary for the app to function: it allows the app to remember the unlock status of a museum, the language preference, and the visitor profile selected across sessions. It is not linked to any personal data and does not allow identifying the user.

Pursuant to Article 4 GDPR, a persistent online identifier is considered personal data even in the absence of associated name or email. This Notice therefore applies to all users of the app.

3.2 Preference data

• Selected language
• Selected visitor profile (e.g. standard, child, expert, blind/visually impaired)
• Unlock status of activated museums

3.3 Usage events (analytics)

The app collects content interaction events, aimed at improving the service and providing aggregated statistics to partner museums:

• App open
• Museum unlock and method used (QR, NFC, code, free access)
• Visit start and end
• Artwork views
• Audio playback (start, pause, completion, speed)
• Exploration mode used
• Time spent on each artwork
• Language and profile changes
• Text description and transcript views

3.4 Device technical data

Together with usage events, technical device data may be collected (model, operating system version, app version) for diagnostic, compatibility and service improvement purposes.

3.5 Data NOT collected

The PARTS app does NOT collect:

• Name, surname, email or other identifying data
• Precise GPS location
• Contacts
• Photos, videos or other media from the device gallery
• Microphone (audio is playback only, never recording)
• Payment data (the app is free)
• Advertising identifiers (IDFA on iOS, GAID on Android) for marketing or profiling purposes
• Third-party cookies

3.6 Future developments

Future versions of the app may introduce optional features requiring registration (e.g. personal notes, favorites, visit history). If activated, this Notice will be transparently updated and users will receive adequate information before providing any additional data.

Purposes and Legal Basis

• Service provision (app functioning, museum unlocking, content playback, preference persistence): contract performance — Article 6(1)(b) GDPR.
• Service improvement and aggregated statistics for partner museums: legitimate interest of the Controller and partner museums — Article 6(1)(f) GDPR. Statistics provided to museums are exclusively aggregated and anonymous; no museum receives identifying information about individual visitors.
• Security and abuse prevention: legitimate interest of the Controller — Article 6(1)(f) GDPR.

Retention Period

• The anonymous technical identifier and preference data are retained as long as the user uses the app. Uninstalling the app or clearing app data from device settings results in the loss of the local reference.
• Usage events (analytics) are retained server-side in pseudonymous form (linked to the technical identifier) for a maximum of 24 months, after which they are anonymized and kept exclusively in aggregated form for statistical purposes.
• Users may request complete deletion of their data at any time by writing to info@partshub.it (see Section 7).

Data Recipients and Transfers

Data is processed exclusively by:

• Supabase Inc. — Provides the backend infrastructure (database, anonymous authentication service, content storage, serverless functions). Registered office in the United States. Transfer is safeguarded by the adoption of Standard Contractual Clauses (SCC) approved by the European Commission.
• Partner museums — Receive exclusively aggregated and anonymous statistics on app usage within their own museum (e.g. most viewed artworks, average visit duration, most used modes). They do NOT have access to any identifying data of individual visitors.
• Apple Inc. and Google LLC — Limited to the minimum technical data necessary for distribution on the respective stores (App Store and Google Play), under their respective privacy policies.
• Competent authorities, in case of legal obligation.

Museum audio and textual content is generated on the internal CMS via artificial intelligence services (OpenAI, ElevenLabs), which under no circumstances receive personal data of app users.

Data Subject Rights

In compliance with Regulation (EU) 2016/679 (GDPR), the user has the right to:

• Access their personal data;
• Rectify inaccurate or incomplete data;
• Erase their data ("right to be forgotten");
• Object to processing based on legitimate interest;
• Restrict processing under certain circumstances;
• Obtain portability of their data;
• Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of their country of residence.

To exercise these rights, simply write to info@partshub.it, providing — if possible — the app's technical identifier (retrievable from Settings → Information). Without this identifier, exercising some rights may be technically limited, as the app does not collect personal data useful for uniquely identifying the user.

Alternatively, uninstalling the app stops the collection of new data associated with the local identifier.

Security

All communications between the app and the server take place over HTTPS with TLS. Data is protected by Row Level Security (RLS) policies at the database level, ensuring that each user can only access their own data. Anonymous authentication credentials are stored in the Keychain (iOS) or equivalent secure storage (Android) and never transmitted in cleartext.

Changes to the Policy

Any updates to this Notice will be published on this page, with the date of the last update indicated. In case of substantial changes (e.g. introduction of account registration features), users will receive in-app notification.

Contact

For any question regarding this Notice or to exercise your rights, contact the Data Controller:

• Parts S.r.l. Società Benefit — Innovative Startup
• VAT no.: 10996271218
• Email: info@partshub.it
• Website: partshub.it