Privacy Policy

Applicable regulation

This notice is provided under Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR). Processing follows the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation and security.

Who is the controller

The controller decides why and how personal data is processed for TerrenoCheck.

Data categories and sources

• data supplied by the buyer: email, chosen language, any optional purpose note, checkout acknowledgements and support messages;
• parcel data: coordinates, address text, selected point and boundary, cadastral reference and readings returned by territorial sources;
• order data: Stripe status, amount, currency, checkout and job identifiers, dossier and delivery link, but not the full card number or CVC;
• technical data: truncated IP address, user agent, browser language, timestamps, link access, error logs and cookie choices needed for security, diagnosis and operation.

Territorial data comes from the buyer’s selection and the public sources named in the dossier. Stripe supplies confirmation or non-completion of payment and the references needed to reconcile the order.

Purposes and legal bases

• contract performance: identify the selected parcel, handle payment and order state, produce, check, deliver and support the dossier;
• legal obligations: retain the required payment and accounting records;
• legitimate interests: protect accounts and links, prevent abuse and fraud, diagnose errors and demonstrate correct delivery;
• consent: activate optional cookies, analytics or advertising only, with a choice that can be withdrawn through Cookie choices.

Terms and immediate-performance acknowledgements are kept as evidence of the contract, not as general consent to process personal data. Refusing optional cookies does not prevent a purchase.

Recipients and processors

Stripe handles payment and fraud prevention; AWS SES delivers messages; TerrenoCheck’s hosting provider stores the application and dossiers; Mapbox supplies storefront maps; the dossier narrative is written with the help of an AI provider (OpenAI, or xAI or Google when OpenAI does not answer). Google receives measurement data only after optional-cookie consent. The site's typefaces are served from terrenocheck.it; no request goes to Google for the text you are reading. Data may also be disclosed where a legal duty or competent authority requires it. TerrenoCheck does not sell personal data.

Each provider receives only the data needed for its task. You may ask the controller for the current list of processors and safeguards.

Transfers outside the EEA

Some providers may process limited data outside the European Economic Area. Where that occurs, the transfer uses a GDPR mechanism such as an adequacy decision or applicable standard contractual clauses. You may request the current processor and safeguards list.

Retention

The dossier, link, email address and operational metadata connected with delivery remain available for 90 days and are then removed from the ordinary delivery workflow. Payment and accounting records remain for the period required by applicable law. Technical logs are kept only as long as security, diagnosis and dispute handling require.

To distinguish visits without saving an identifier in the browser, the server calculates a non-reversible code from the truncated IP address, user agent and browser language. The code joins page views made on the same day and changes each day at midnight UTC.

An early erasure request does not override a legal duty or the need to establish, exercise or defend a legal claim. When the purpose expires, data is erased or anonymised.

Cookies and browser storage

The site does not save a visit identifier in the browser. Language and cookie choices use necessary browser storage. Optional tags stay blocked unless you allow them. Refusing does not prevent reading the site or purchasing; change the choice from Cookie choices in the footer.

Automated and AI-assisted processing

The dossier uses automated processing and AI-assisted text about the parcel readings. The provider that writes it (OpenAI, or xAI or Google if OpenAI does not answer) may receive coordinates, the cadastral reference, source findings and an optional purpose note; it does not receive email or card details. TerrenoCheck does not make an automated decision about the buyer’s personal data that produces legal or similarly significant effects under GDPR Article 22. The dossier remains an information screen and does not replace a qualified professional.

Rights and how to exercise them

Where the GDPR provides, you may obtain confirmation and access, request rectification or erasure, restrict processing, receive supplied data in portable form and object to processing based on legitimate interests. You may withdraw consent to optional services at any time; withdrawal does not make earlier processing unlawful. The EDPB summarises data-subject rights.

To exercise them, email support@kandyb-studio.eu with the order email and, where available, the report ID. Only information needed to verify identity will be requested. You may complain to the data-protection authority where you live or work; the controller’s Polish authority is UODO.