1. Data Controller The Data Controller is Alesea srl, with registered office at Corso di Porta Romana, 20122, Milano (MI), VAT no. 10964930969 (“Alesea” or the “Controller”).
For any request concerning the processing of personal data you can write to: Support@alesea.com .
2. Who the App is for Alesea App is a professional tool intended for operators, customers and partners of Alesea for the management and traceability of cable reels, materials, pallets and IoT devices (RevIoT Box and RevIoT Box Light), for reverse logistics and for material check-in/check-out activities. Access is restricted to users holding business credentials issued by Alesea or by their own organisation. The App is not intended for consumers or for persons under 18 years of age.
3. Personal data we process The following categories of data may be processed in connection with the use of the App:
Category Data Purpose Legal basis Identification and login data First name, last name, business e-mail address, organisation, role and authorisation groups, user identifier, authentication tokens. Authentication through Microsoft Entra ID (Single Sign-On) or through SAML on the Alesea portal; management of profiles and permissions; access security. Performance of the contract / legitimate interest of the Controller in the security of its systems. Location data Precise (GPS) and approximate (network-based) location of the device, date and time of the reading. See Section 4. Geolocation of operations on reels, materials and IoT devices; updating the position of assets; pick-up addresses; maps. Consent (permission granted in the operating system) and performance of the contract. Operational data Codes and data of reels, materials, orders, shipments, pick-ups, checklists, notes, photographs of materials and documents, signature entered in checklists, results of barcode/QR code scans, NFC tags and text recognition (OCR). Provision of the App’s features; material traceability; documentation of the activities performed; support. Performance of the contract. IoT device data Identifiers (MAC address) and signal strength (RSSI) of RevIoT Box Light Bluetooth devices and beacons detected nearby. Association of IoT devices with pallets/reels and updating of their position. Performance of the contract. Technical data of the mobile device Model, operating system and version, App version, connectivity status, technical device identifiers. Operation and compatibility of the App; diagnostics and troubleshooting; updates. Legitimate interest of the Controller. The App does not collect data for advertising purposes, does not use advertising or profiling SDKs and does not contain third-party behavioural analytics tools. The Controller does not sell or transfer users’ personal data to third parties.
4. Location data The App requests access to the device location, both precise (GPS) and approximate. Location is used to support the professional activities carried out through the App and exclusively for the purposes described below.
4.1 Use of location while the App is in use When the App is open, the device location may be collected in order to:
record the place where an operation on reels, materials or pallets is performed (for example, association of a RevIoT Box device, material check-in/check-out, completion of a checklist); suggest the current pick-up address when creating a reverse logistics request; centre maps on the user’s position and show the position of nearby reels and devices (“find reel” feature); determine the local time zone so that the date and time of operations are recorded correctly. 4.2 Use of location in the background (Bluetooth device monitoring) The App includes an optional monitoring feature for RevIoT Box Light devices, which the user can enable through a dedicated switch in the relevant section. When the feature is enabled, the App runs a foreground service (on Android, indicated by a persistent notification “Beacon monitor running”) which, even when the App is not visible on screen or the device is locked:
periodically performs a Bluetooth Low Energy scan to detect nearby RevIoT Box Light devices; when a device is detected, obtains the current location of the mobile device and transmits it to Alesea’s servers together with the identifier of the detected IoT device, the date and the time; uses this information to update the position of the asset (pallet or reel) associated with the IoT device. Location is obtained only when an IoT device is detected; the App does not continuously record the user’s movements. The feature is disabled by default and can be stopped at any time through the switch in the App or by revoking the “Always” / “background” location permission in the operating system settings. Without that permission, the other features of the App remain available.
4.3 Permissions requested On Android the App requests the ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION permissions and, only for the feature described in Section 4.2, ACCESS_BACKGROUND_LOCATION and FOREGROUND_SERVICE_LOCATION. On iOS the App requests the “While Using the App” location permission and, for the monitoring feature, the “Always” permission. The request for background location permission is preceded by an in-app disclosure. Please note that on Android and iOS the location permission is also technically required to scan for Bluetooth devices.
4.4 With whom location data are shared Alesea servers, hosted on Microsoft Azure infrastructure, where the location is linked to the operation or asset it refers to and to the account that performed it. Google Maps Platform (Google Ireland Ltd.): coordinates are sent to Google for map display, address search and autocomplete (Places), geocoding and time zone lookup. Google’s processing is governed by Google’s Privacy Policy (https://policies.google.com/privacy). Third-party geocoding services used to convert addresses into coordinates. The user’s organisation and Alesea’s customers/partners involved in the logistics flow, limited to the position of the assets and operations that concern them. Location data are not used for advertising, marketing or profiling purposes and are not sold to third parties.
4.5 Retention of location data Locations linked to operations and assets are retained for 24 months from recording, i.e. for the period required to ensure the material traceability provided for in the contractual relationship with the user’s organisation, and are then deleted or anonymised. The location obtained by the App is stored on the device only temporarily, in the App’s memory, for the time needed to transmit it.
5. Other device permissions To provide its features the App may request the following permissions, all of which can be revoked from the operating system settings:
Bluetooth: searching, connecting to and configuring RevIoT Box and RevIoT Box Light devices, and beacon monitoring. NFC: reading NFC tags attached to reels and materials. Camera: scanning barcodes and QR codes, recognising printed text (OCR) and taking photographs to attach to checklists and reports. Text recognition is performed directly on the device. Photos/Gallery and files: selecting images and documents to attach to activities. Notifications: displaying the monitoring service notification (Android) and service alerts. Background execution and auto-start: keeping the Bluetooth monitoring service running when enabled by the user, including after the device is restarted. 6. Processing methods and retention Data are processed by electronic means, with logic strictly related to the stated purposes and with appropriate security measures. Credentials and access tokens are stored on the device in a protected area (Keychain on iOS, Keystore/EncryptedSharedPreferences on Android). Operational data may be temporarily stored on the device to allow offline use and are synchronised with Alesea’s servers when a connection is available. Communication with the servers takes place over encrypted HTTPS/TLS connections.
Account data are retained for the duration of the relationship with the user’s organisation and deleted or anonymised within 24 months of its termination, subject to legal obligations. Operational and traceability data are retained for the period indicated in Section 4.5. Data stored locally on the device are deleted when the App is uninstalled or when the user logs out.
7. Recipients of data and service providers Data may be processed, as data processors or independent controllers, by:
Microsoft Ireland Operations Ltd.: Microsoft Entra ID and Microsoft Graph identity services for authentication and permission checks; Microsoft Azure cloud infrastructure hosting Alesea’s servers and APIs. Google Ireland Ltd.: Google Maps Platform (maps, Places, geocoding, time zone) and distribution of the App through Google Play. Apple Distribution International Ltd.: distribution of the App through the App Store. Geocoding and technical service providers needed to operate the App. Alesea’s customer and partner organisations involved in the logistics flows managed through the App, limited to data relating to the operations that concern them. Data may also be disclosed to public authorities where required by law.
8. Transfer of data outside the European Union Alesea’s servers are hosted in Microsoft Azure data centres located in the European Union. Some providers (Microsoft, Google, Apple) may also process data in non-EU countries; in such cases the transfer is based on adequacy decisions of the European Commission (including the EU-US Data Privacy Framework) or on the Standard Contractual Clauses approved by the Commission.
9. Your rights Under Articles 15 to 22 of the GDPR you have the right to access your data, to obtain their rectification or erasure, to restrict their processing, to data portability, to object to processing and to withdraw any consent given at any time, without affecting the lawfulness of processing carried out before withdrawal. Permissions granted to the App (location, camera, Bluetooth, etc.) can be revoked directly from the device settings.
Requests can be sent to Support@alesea.com . Since accounts are managed by the user’s organisation, requests to delete the account and the associated data can be sent to the same address and will be handled within 30 days, except for data whose retention is required by law or necessary for material traceability on behalf of the customer organisation.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State in which you reside.
10. Children The App is intended exclusively for adult professional users. The Controller does not knowingly collect data from persons under 18 years of age.
11. Changes to this Privacy Policy The Controller may update this Privacy Policy, including following changes to the App’s features or to applicable law. The updated version will be published at this address with the date of the last update; in the event of material changes, users will be informed through the App.
12. Contact Alesea srl Corso di Porta Romana, 20122, Milano (MI) E-mail: Support@alesea.com Website: www.alesea.com