Privacy Notice

This document provides all users of the Selya application (the “App”) with all the information needed to explain the characteristics and methods of the processing of personal data through the use of the App, in accordance with Regulation (EU) 2016/679 on the protection of personal data (GDPR) and Legislative Decree 101/2018, as subsequently amended and supplemented.

By installing the App, the user (“User” or “Data Subject”) consents to the collection and processing of the data indicated below, without prejudice to the requirement to obtain specific consent for certain processing activities, as explained in more detail below.

1. Data processed, purposes of processing, legal basis and nature of data provision

Through the App, the Controller, as defined below, may process the following categories of data for the purposes described below.

Data for account creation and the provision of contractual services

Personal data processed: personal details, email address, authentication data such as provider ID (idpId).

Purpose: this data is necessary to create and manage your account and enable you to use the App.

Legal basis: processing is necessary for the performance of a contract to which the Data Subject is a party (Article 6(1)(b) of the GDPR).

Nature of data provision: mandatory. Failure to provide this data prevents the use of the services offered by the App.

Data relating to the management of the Data Subject’s account

Personal data processed: account status (active/inactive), onboarding status, account deletion requests and their status.

Purpose: management of the user account.

Legal basis: processing is necessary for the performance of a contract to which the Data Subject is a party (Article 6(1)(b) of the GDPR).

Nature of data provision: mandatory. Failure to provide this data prevents the use of the services offered by the App.

Data relating to the Data Subject’s location

Personal data processed: data relating to the User’s geographical location, including data collected through GPS or automatic location technologies.

Purpose: this data is used to enable the feature that allows the Controller to show the User nearby retail outlets or dining establishments with fresh products available.

Legal basis: the Data Subject’s consent (Article 6(1)(a) of the GDPR).

Nature of data provision: optional. Failure to give consent does not affect the use of the App’s other features.

Data for service improvement and statistical analysis

Personal data processed: personal details, sociodemographic data (e.g. age, occupation, location, marital status, children), feedback and responses to questionnaires concerning satisfaction with the App.

Purpose: this data is used in aggregated and anonymous form for statistical analyses aimed at understanding how the App is used and optimising its performance and services.

Legal basis: the Controller’s legitimate interest in improving its technology and the quality of the service offered to its users (Article 6(1)(f) of the GDPR).

Nature of data provision: the User has the right to object to this processing at any time on grounds relating to their particular situation.

Data for marketing activities

Personal data processed: email address and, if provided, sociodemographic data for personalising offers.

Purpose: sending newsletters, promotions, commercial communications and marketing campaigns concerning the Controller’s services.

Legal basis: the Data Subject’s consent (Article 6(1)(a) of the GDPR).

Nature of data provision: optional. Failure to provide the data does not affect the use of the App’s features.

Data for training and refining the artificial intelligence (AI) model

Personal data processed: images uploaded by the User, which are anonymised and stripped of identifying metadata before being used for this purpose.

Purpose: use of images in anonymous form to train and improve the accuracy, reliability and performance of the AI algorithm underlying the service.

Legal basis: the Controller’s legitimate interest in improving its technology and the quality of the service offered to its Users (Article 6(1)(f) of the GDPR).

Nature of data provision: the User has the right to object to this processing at any time on grounds relating to their particular situation.

Data for technical maintenance and cybersecurity

Personal data processed: browsing data, IP addresses, system logs.

Purpose: ensuring the proper functioning of the App, protecting the technological infrastructure, preventing abuse, fraud or unlawful activities, and establishing any liability in the event of cybercrime.

Legal basis: the Controller’s legitimate interest (Article 6(1)(f) of the GDPR).

Nature of data provision: necessary, as this processing is inherent to the secure operation of the App.

Please note that some IT systems used by the User, such as Apple Store or Google Play, may acquire certain data relating to Data Subjects, collected through the use of devices. In general, the information in this document does not cover the processing of personal data resulting from the User’s use of third-party software or services.

For more information on the processing and protection of personal data in this regard, please consult:

Apple’s privacy notice

Google’s privacy notice

2. Retention period

Your personal data is retained for a limited period of time, which varies according to the purpose of processing, in accordance with the storage limitation principle set out in Article 5(1)(e) of the GDPR. At the end of that period, the data will be irreversibly deleted or permanently anonymised.

Data for the provision of contractual services and account management

The personal data necessary for the provision of contractual services and the management of your account (email address, account status, etc.) will be processed for the duration of the contractual relationship, that is, for as long as your account remains active.

If your account is inactive for a continuous period of 24 months, we will send you a communication notifying you of its impending deletion. If you take no action, the account and its associated data will be deleted.

Following a request to delete the account or its deactivation due to inactivity, the data strictly necessary to comply with legal obligations, such as administrative, accounting and tax obligations, as well as for the establishment, exercise or defence of legal claims, may be retained for a period of 10 years from the termination of the contract, corresponding to the ordinary limitation period.

Data for marketing purposes

Data processed for marketing purposes (sending newsletters, promotions, etc.), collected on the basis of your specific consent, will be retained until the account is deleted or consent is withdrawn.

At the end of that period, the data will be automatically deleted and all further marketing activities will cease, unless you give new, specific consent.

Data for service improvement and statistical analysis

Personal details and sociodemographic data voluntarily provided for this purpose undergo a process of aggregation and irreversible anonymisation. Once anonymised, as they are no longer personal data, they are retained indefinitely for aggregated statistical analysis.

Data for training and refining the artificial intelligence (AI) model

Images uploaded by the User undergo a technical process of irreversible anonymisation, which includes removing all metadata and obscuring any elements that could, even indirectly, lead to the identification of a person. This anonymisation process takes place at the time the image is uploaded, on the User’s device itself. Once the images have been anonymised, they are no longer considered personal data under the GDPR and are retained for as long as necessary to pursue the purposes of training and technological improvement of the algorithm.

Data relating to the Data Subject’s location

Data relating to your geographical location, collected with your prior consent, is processed for the time strictly necessary to provide you with the relevant features and is not permanently stored in association with your account. This data is deleted or anonymised at the end of the usage session.

Data for technical maintenance and cybersecurity

Browsing data and system logs are retained for a maximum period of 12 months to ensure the security of the infrastructure, prevent unlawful activities and establish any liability in the event of cybercrime, without prejudice to any further retention necessary following a specific request from the Judicial Authority or other competent authorities.

In any event, the Controller retains the right to store the data for longer than the specified period in order to comply with specific legal obligations or to defend its rights in legal proceedings, in accordance with the applicable limitation periods.

3. Methods of data processing

Data is processed exclusively using IT tools, for the time strictly necessary to achieve the purposes for which the data was collected and, in all cases, with specific security measures designed to prevent any personal data breach, such as data loss, unlawful or improper use and unauthorised access.

However, due to the nature of online transmission, these measures cannot fully limit or eliminate all risks of unauthorised access or data leakage. We therefore recommend that you periodically check that your device is equipped with appropriate safeguards to protect both incoming and outgoing data transmissions over the network, and that your Internet service provider has adopted appropriate measures to ensure the security of data transmission over the network (e.g. firewalls and anti-spam filters).

We also recommend that you use a unique, strong password, keep your login credentials secure and prevent third parties from accessing your App account or, in any event, your device.

4. Categories of recipients of personal data

The data will be processed by staff within the Controller’s company who are duly authorised to process it. We may also disclose your personal data:

to third parties, such as third-party technical service providers, hosting providers, companies or professionals providing IT services, and the Controller’s legal advisers, appointed as processors on a case-by-case basis where necessary pursuant to Article 4(8) of the GDPR (which defines a “processor” as a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller)

to parties granted the right to access the data by laws or regulations and other parties provided for by law.

In any event, you may always ask us for an up-to-date list of data processors.

5. Data transfers outside the EEA

Personal data will be processed on servers located within the European Union belonging to the Controller and/or third-party companies engaged and duly appointed as data processors.

Any transfer of data outside the European Economic Area or to an international organisation will take place in accordance with applicable legal provisions, for example on the basis of an adequacy decision by the European Commission or through the signing of Standard Contractual Clauses. In such cases, the Controller will provide Data Subjects with any further information regarding the conditions underlying the transfer.

6. Rights of data subjects

You may exercise the rights listed below by submitting a specific request to the Controller using the contact details provided above. For a better understanding of your rights, we encourage you in any event to read Articles 15 et seq. of the GDPR in full.

Right of access

You may request confirmation as to whether or not data concerning you are being processed and, if so, obtain access to your personal data and further information about the processing.

Right to rectification

You may request that data you have provided, or that are otherwise held by the Controller, be corrected or completed if they are inaccurate or incomplete.

Right to erasure (also known as the right to be forgotten)

You may request that data collected or processed by the Controller be erased without undue delay if any one of the following applies:

they are no longer necessary for the purposes for which they were collected

consent has been withdrawn and there is no other legal basis for the processing

you have objected to the processing of your personal data

the data have been processed unlawfully

there is a legal obligation to erase them.

Right to restriction of processing

You may request restriction of the processing of personal data where one of the following applies:

you contest the accuracy of your data, for the period necessary for the Controller to verify their accuracy

the processing is unlawful and you oppose the erasure of the data, requesting instead that their use be restricted

although the Controller no longer needs the data for processing purposes, they are required for the establishment, exercise or defence of legal claims

you have objected to processing pursuant to Article 21(1) of the GDPR, pending verification of whether the Controller's legitimate grounds override your legitimate grounds.

Right to data portability

You have the right to:

receive your data in a structured, commonly used and machine-readable format

have them transmitted directly by the Controller to another controller designated by you, where technically feasible

transmit them to another controller without hindrance from the Controller.

Right to object

You may object at any time, on grounds relating to your particular situation, to the processing of your data carried out on the basis of Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions.

Right not to be subject to automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Right to withdraw consent

You may withdraw any consent given to the Controller at any time, without affecting the lawfulness of processing based on consent given before its withdrawal.

Lastly, we remind you that you have the right to lodge a complaint with the competent Supervisory Authority for personal data protection, which in Italy is the Italian Data Protection Authority (Garante della Privacy).

7. Account deletion through the App

The User may delete their account at any time directly within the App by following the procedure described below.

Deletion procedure

1. Log in to the App using your credentials.

2. Go to the “Profile” section using the bottom navigation bar.

3. Select the “Permanently delete account” button at the bottom of the page.

4. Confirm the operation by entering your password when prompted.

Effects of deletion

Following confirmation, the account will be permanently deleted and all associated personal data (personal details, email address, scan history and preferences) will be erased from our systems, subject to the provisions of current legislation regarding retention obligations.

In particular, any data strictly necessary to comply with legal, accounting or tax obligations may be retained for the period required by applicable legislation, as indicated in section 2 of this privacy notice.

Any images uploaded by the User that have already undergone irreversible anonymisation pursuant to section 1 of this privacy notice cannot be linked to the User and are therefore not subject to the deletion procedure.

Account deletion is irreversible. To use the App's services again, you will need to register again.

8. Automated decision-making

The analyses carried out by the App using the AI algorithm could qualify as fully automated decision-making processes necessary for the performance of a contract between the Data Subject and the Controller. In accordance with Article 22 of the GDPR, we guarantee your right not to be subject to a decision based solely on such processing which produces legal effects concerning you or similarly significantly affects you. You have the right to obtain human intervention on the part of the Controller, to express your point of view and to contest the automated decision by contacting us at the address indicated above.

9. Updates to this privacy notice

This privacy notice may be updated periodically. You will always find the latest version in the relevant section of the App. In the event of substantial changes to the processing of your data, we will send you a specific notification.

10. Data Controller

The Data Controller is Italia Foodtech S.r.l., with its registered office at Via Orti Manara 7, 37121 Verona (VR), tax code, VAT number and registration number in the Verona Companies Register 05188740236, REA no. VR – 477471 (“Controller”). You may contact the Controller for any information regarding the processing of your personal data or to exercise your rights by emailing info@italiafoodtech.com.

Last updated: 16/04/2026