IT Sign in

Privacy Policy

Last updated: July 25, 2026

1. Data Controller

The Data Controller for the personal data collected through the Onboarding platform is:

Orientia Società a Responsabilità Limitata Semplificata
Registered office: Via Nazionale 79, 81028 Santa Maria a Vico (CE), Italy
Tax code / VAT number: 04966350615
REA: CE-369813
Certified email (PEC): orientia@pec.it

("Orientia", "the Company" or "the Controller"). To exercise the rights described in Section 11, or for any request relating to the processing of personal data, data subjects may contact the Controller using the PEC address above.

2. The service and infrastructure

Orientia directly develops, operates and delivers, as sole provider, the multi-tenant SaaS software made available through Onboarding. There is no software provider other than Orientia: the Company is therefore the sole party responsible for the data collected and processed through the platform.

The technical infrastructure and all databases used to deliver the service are hosted exclusively within the European Union. Data belonging to different customers is logically separated (multi-tenant isolation), so that no customer can access another customer's data.

3. Payments

Subscription payments are processed through the payment processor Stripe, Inc. ("Stripe"). Orientia does not store customers' full payment card data, which is handled directly by Stripe under its own security standards (PCI-DSS). For the processing activities within its own scope, Stripe acts as an independent provider of payment services, under its own Privacy Policy, available on Stripe's website.

4. Personal data collected

Orientia collects and processes the following categories of data:

4.1 Data provided directly by the user

  • first and last name;
  • email address;
  • password, stored exclusively in hashed form (never in plain text);
  • phone number, if provided;
  • company name;
  • VAT number;
  • tax code;
  • billing address;
  • further data required for invoicing (e.g. Italian SDI recipient code, PEC address for electronic invoicing).

4.2 Data collected automatically

  • IP address;
  • browser type;
  • operating system;
  • date and time of access;
  • authentication logs;
  • device identifiers, where available;
  • other technical information necessary for the security of the service.

4.3 Operational data within the SaaS

In the ordinary use of the software, the user enters data relating to their own business, including, by way of example: customers, suppliers, products, documents, orders, images, attachments, configurations, and any other data voluntarily entered. This data is processed by Orientia solely on behalf of the customer, to the extent necessary to deliver the service.

5. Purposes of processing

Personal data collected is processed for the following purposes:

  • account creation and management;
  • user authentication;
  • delivery of the SaaS service;
  • subscription management;
  • billing;
  • customer support;
  • IT security;
  • abuse and fraud prevention;
  • backup and disaster recovery;
  • tax compliance;
  • compliance with legal obligations;
  • protection of the Company's rights, including in judicial proceedings.

6. Legal basis for processing

Depending on the purpose pursued, the processing of personal data is based on one or more of the legal bases set out in Article 6 of Regulation (EU) 2016/679 (GDPR):

  • performance of the contract to which the data subject is party, or pre-contractual steps taken at their request (account creation, service delivery, billing);
  • compliance with a legal obligation to which the Controller is subject (e.g. tax and accounting law);
  • legitimate interest of the Controller (e.g. IT security, fraud prevention, protection of its own rights), balanced against the rights and freedoms of the data subject;
  • consent of the data subject, where required for specific purposes not covered by the above bases (for example, sending promotional communications or newsletters), which may be withdrawn at any time.

7. Data retention

  • Account data: retained until the account is deleted and, thereafter, for the time necessary to comply with legal obligations.
  • Tax data and invoices: retained for at least 10 years, in accordance with applicable tax and civil law.
  • Security logs: retained for a limited period, proportionate to the security purposes for which they are collected.
  • Backups: Orientia performs automatic daily backups of the service's data, retained for a variable period determined according to the Company's internal policies, which may change over time.

Backups exist solely for business continuity and disaster recovery purposes and do not constitute an archiving service available to the user. Restoration of individual data items accidentally deleted by the user during ordinary use of the service is not guaranteed. Users are therefore encouraged to keep their own copies of data they consider essential to their business.

8. Recipients of the data

Personal data may be disclosed, to the extent strictly necessary for the purposes described, exclusively to the following parties:

  • Stripe, Inc., for payment processing;
  • hosting providers with infrastructure located in the European Union;
  • the Company's tax advisors;
  • the Company's legal advisors;
  • other providers strictly necessary to deliver the service, appointed as data processors where applicable;
  • competent authorities, where disclosure is required by law or by an order of such authorities.

9. International transfers

The main infrastructure used by Orientia to deliver the service, including databases, is hosted exclusively within the European Union. Where certain third-party providers (for example Stripe) carry out processing outside the European Economic Area, such processing takes place in compliance with Articles 44 et seq. of the GDPR, through the adoption of appropriate safeguards (such as standard contractual clauses approved by the European Commission or equivalent mechanisms recognized under applicable law).

10. Security

Orientia adopts technical and organizational measures appropriate to ensure a level of security proportionate to the risk, including:

  • encryption of communications via HTTPS/TLS;
  • passwords stored exclusively in hashed form;
  • access controls to systems and data;
  • logical segregation of data between tenants;
  • daily backups;
  • security event logging;
  • infrastructure monitoring;
  • prompt application of security updates and patches;
  • other reasonable data protection measures, in line with the state of the art.

No IT system can guarantee absolute security: Orientia is committed to adopting and maintaining reasonable and proportionate measures over time, updating them as threats and available technology evolve.

11. Data subject rights

As a data subject, the user has the right to exercise, against the Controller, the rights set out in Articles 15-22 of the GDPR, including:

  • access to their personal data and to information about the processing (Art. 15);
  • rectification of inaccurate or incomplete data (Art. 16);
  • erasure of data, in the cases provided by law (Art. 17);
  • restriction of processing, in the cases provided by law (Art. 18);
  • objection to processing based on the Controller's legitimate interest (Art. 21);
  • data portability, for data provided to the Controller, in a structured, machine-readable format (Art. 20);
  • withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal, where processing is based on that legal ground;
  • lodging a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it), or with the competent supervisory authority, if the data subject believes the processing violates applicable law.

To exercise these rights, data subjects may contact the Controller at the PEC address indicated in Section 1.

12. Cookies

The Onboarding platform uses technical cookies, necessary for the site to function and to manage the session, which do not require consent. With your consent, analytics cookies (Google Analytics 4, anonymous/aggregate usage statistics) and marketing cookies (Meta/Facebook Pixel, ad measurement and remarketing) may be enabled, managed through Google Tag Manager.

Analytics and marketing cookies are set only after you give consent in the banner. Your choice is stored in your browser (localStorage) until revoked. You can change your mind at any time — see "Manage your preferences" at the bottom of this page.

13. Minors

The service is not intended for individuals under 18 years of age. Orientia does not knowingly collect personal data from minors. If the Company becomes aware that it has collected personal data of a minor without the consent of the holder of parental responsibility, it will take steps to delete such data.

14. Changes to this Privacy Policy

Orientia may update this Privacy Policy to reflect changes in applicable law, developments in the service, or its operating practices. The date of the last update is shown at the top of this page. In the event of material changes, Orientia will notify users through appropriate means.

Manage your preferences

You can review or withdraw at any time the consent given for analytics and marketing cookies: