1. Data controller
The controller of personal data processing is:
Identification code: BG208751983
Contact person: Valentina Figliuzzi
Contact email: [email protected]
Phone: +39 345 068 8470
For any request relating to your personal data, write to us: we reply within 30 days of receipt, as required by the GDPR.
2. Types of data collected
Through the eimarta.com website we collect only the data needed to reply to contact requests and to run the service.
Data you provide to us directly
- Identity and contact details: name, email, phone, company.
- Message content: the text you write in the contact form.
- Privacy consent: the mandatory tick required to submit the form.
Data collected automatically
- IP address: recorded in the server logs for security reasons.
- User-Agent: browser and device type, to improve compatibility.
We do not use tracking cookies, profiling, third-party analytics or marketing automation tools.
3. Legal basis and purposes
We process personal data exclusively for the following purposes:
| Purpose | Legal basis |
|---|---|
| Replying to requests sent through the contact form | Performance of pre-contractual measures (art. 6.1.b GDPR) |
| Managing any contractual relationship and invoicing | Performance of the contract (art. 6.1.b GDPR) |
| Complying with legal obligations (accounting, tax, anti-fraud) | Legal obligation (art. 6.1.c GDPR) |
| Website security and abuse prevention | Legitimate interest (art. 6.1.f GDPR) |
4. Data processing through artificial intelligence
marta uses artificial intelligence systems to offer suggestions, analysis and automations on the data that customers enter into the platform.
The data you upload to marta is not used to train third-party AI models, except with your explicit and granular consent. The models are used in "inference" mode, that is, they read your data only to generate the response, without storing it in training datasets.
Switching off individual features
When the platform is live, each AI-based feature can be switched off individually from your account settings. Features that are switched off will not process your data.
5. Sub-processors and LLM providers
To deliver the marta service we rely on selected third-party providers. Personal data is shared with them only to the extent strictly necessary and under a data processing agreement (DPA) compliant with art. 28 GDPR.
| Provider | Service | Location |
|---|---|---|
| To be selected at the first active customer | LLM provider (inference) | EU (preferred) / US |
| Italian hosting provider (named in the DPA) | Hosting, Plesk, Apache, php-fpm | EU (Italy) |
| Postfix on the same server (internal) | Sending the website's transactional emails | EU (Italy) |
The list is current as of 30 August 2026. It will be updated every time a new provider is activated or replaced, with at least 30 days' notice to active customers in the cases set out in the section "Changes and contact".
6. Data entered by the customer (customer data)
The data you upload to marta — customer and supplier records, invoices, warehouse, documents — remains your property. marta acts as data processor (art. 28 GDPR) on this data.
Your rights over the data you upload
- Ownership: the data you upload is yours. We do not sell it and do not use it for purposes outside the service.
- Portability: you can export your data in open formats (JSON, CSV) at any time.
- Deletion: when the account is closed, your data is deleted within 90 days (subject to legal obligations).
- Access: you can request a complete copy of your data by email.
7. Data retention
We keep data only for as long as necessary for the stated purposes.
| Category | Retention period |
|---|---|
| Contact requests that did not convert | 24 months from receipt |
| Data of active customers | For the whole duration of the contract + 10 years (accounting obligations) |
| Server security logs | 12 months (rotation) |
| Website backups | 30 days |
8. Data subject rights
As a data subject, the GDPR (EU Regulation 2016/679) grants you the following rights:
- Access (art. 15): to know whether we are processing data about you and to obtain a copy.
- Rectification (art. 16): to correct inaccurate or incomplete data.
- Erasure (art. 17): to request deletion, in the cases provided for.
- Restriction (art. 18): to restrict processing pending checks.
- Portability (art. 20): to receive your data in a structured, readable format.
- Objection (art. 21): to object to processing based on legitimate interest.
- Withdrawal of consent (art. 7.3): at any time, without affecting the lawfulness of earlier processing.
- Complaint to the supervisory authority: you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it) or, if you live in Bulgaria, with the Commission for Personal Data Protection (www.cpdp.bg).
To exercise these rights write to [email protected]. We reply within 30 days.
9. Security of processing
We adopt appropriate technical and organisational measures to protect personal data from unauthorised access, loss, alteration or disclosure:
- Encrypted connections (HTTPS/TLS) for all communications.
- HTTP security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy).
- Contact data stored on a protected file system, outside the publicly served area.
- Emails sent via authenticated SMTP (SSL 465).
- Validation and sanitisation of all user input.
- Honeypot and rate limiting on the contact form to mitigate abuse.
10. Cookies
The eimarta.com website does not use tracking, profiling or third-party analytics cookies.
- No marketing cookies.
- No analytics cookies (Google Analytics, Matomo, Plausible, etc. are not installed).
- Technical session cookies: when protected areas of the product are live, technical session cookies may be used to manage authentication. They do not profile.
For this reason, no cookie banner is shown on the eimarta.com website.
11. Changes and contact
Any changes to this notice will be published on this page. For substantial changes (for example the introduction of new sub-processors or new purposes), we will notify active customers by email at least 30 days in advance.
For any questions: [email protected] · +39 345 068 8470.
Document version: v1.0.0