Privacy Policy

The data controller is PRONTOMIGO S.R.L., società a responsabilità limitata, with registered office at Via Pola Interna n. 51, 41012 Carpi (MO), Italia, VAT number 04273350365, fiscal code 04273350365.

For questions about this notice or to exercise your rights, contact info@prontomigo.com or send certified email (PEC) to prontomigo@pec.it. If a Data Protection Officer is appointed and publication of their contact details is required, those details will be added to this notice.

This Privacy Policy describes how PRONTOMIGO S.R.L. processes personal data when you:

• use the public website, customer web portal or any of the customer, provider and merchant mobile applications;
• register or maintain an account as a customer, merchant, delivery rider, trucker or transport company;
• place food or grocery marketplace orders, book van/truck transport, or use live delivery workflows;
• submit onboarding applications or compliance documents for administrative review, or set up payout details with our payment provider;
• apply for a job through Careers / Lavora con noi;
• communicate with support, safety, compliance, recruiting or admin teams;
• subscribe to marketing communications where offered.

This notice does not apply to third-party websites or services linked from our platform. Merchants and independent providers may process customer data as separate controllers to fulfil an order or transport service; their own notices apply to that independent processing.

PRONTOMIGO S.R.L. acts as a technology intermediary. Regulated road-freight work is made available only to providers that declare and must maintain the authorisations, registrations and insurance required for the job; ProntoMigo separately remains responsible for obligations applicable to its platform role. Stripe processes customer card payments and connected-recipient onboarding, while ProntoMigo's systems coordinate PaymentIntents, refunds, ledger records and separate merchant/provider transfers.

Depending on how you use the platform, we may process the following categories of data:

Account and identity data: name, email address, telephone number, password hash, profile photo, preferred language, role, verification status.

Order and transport data: delivery and pickup addresses, order contents, goods description, declared dimensions/weight/value for van/truck bookings, service type, instructions, temporary delivery PIN and verification record, driver-captured van/truck loading and unloading photos, rider pickup and delivery photos of marketplace orders with the device location, time and distance from the store or delivery address recorded when each photo is taken, problem reports with the affected items and the photos you add to them, merchant dispute evidence, ratings, support tickets, chat or call metadata.

Location data: GPS position during active food/grocery deliveries, scheduled van/truck transport or assigned jobs; for riders, position while you are online and available for delivery offers, including when the app is in the background, used only to offer nearby deliveries and held for a few minutes without building a route history; approximate location derived from IP address on the website; saved addresses you choose to store. For orders delivered by the shop itself there is no live tracking, and we do not collect the location of the shop's driver.

Payment and payout data: payment method tokens, transaction identifiers, amounts, refunds, chargebacks, payout references and, for partners, bank payout details such as account-holder name, IBAN/BIC, country/currency and Stripe Connect verification status. We do not store full payment card numbers and normally rely on Stripe or another approved provider to store sensitive bank credentials.

Provider and merchant compliance data: identity documents, fiscal code, Partita IVA, SDI/PEC details, merchant licences, food-safety/HACCP evidence, driving licences, vehicle registration, insurance certificates, Albo autotrasportatori/REN details, background-check results where permitted by law, and admin review notes.

ProntoMigo Pro device rental data (merchants): serial number and IMEI numbers of the assigned device, contract type (rental or free loan), assignment, installation and return dates, the name of the person who signs the receipts, the signed copy of the rental or free loan contract, contract status, rent, deductions and any charges, and, where remote device management is active, app version, connection status and configuration.

Technical and usage data: device identifiers, app version, operating system, log files, crash reports, anti-fraud signals, your device's push-notification token, cookies and similar technologies on the website, and the data the mobile apps keep on your device (listed in the Cookie Policy). We do not collect your device's advertising identifier.

AI-assistance metadata: where AI features are enabled, we may process limited content you submit for assistance (for example menu/catalog images or text for import drafts, support ticket context already visible to agents, published help-article text, and cargo or document images for extraction suggestions), together with technical run metadata such as model identifiers, token usage and input/output hashes. We do not store raw AI prompts in our audit tables.

Marketing and preferences data: your choices for offers by notification, by email and for personalised offers, with a record of each change (what, when, where and under which version of this notice); the cuisines you like or hide and the places whose offers you muted; the marketing messages sent to you and whether you opened them; and, for website visitors who consent, first-party campaign attribution.

Recruitment / careers candidate data: name, email, telephone number, city/area, optional profile URL, availability notes, answers to vacancy screening questions, PDF curriculum vitae, application locale, source path, optional privacy-safe marketing attribution (for example UTM parameters), privacy-notice version and acknowledgement time, and recruiter workflow metadata (status, assignee, internal notes, access events).

We do not intentionally process special categories of data under Article 9 GDPR unless required by law or explicitly provided by you for a specific purpose (for example, accessibility needs communicated to support). We do not use biometric identification or emotion recognition.

For marketplace riders, we prepare a monthly work and payment reconciliation and retain the reviewed source snapshot, a private copy of the officially issued Libro unico del lavoro (LUL), its reference and version, notification status, signed-link requests and any receipt acknowledgement. An authorised administrator publishes the official document after review; riders can access their own copies in their account. The purpose is compliance with applicable work-record obligations (Article 6(1)(c) GDPR). The PDF and issuance evidence are kept for at least five years after issue; the current archive uses a six-year minimum. They may remain after account deletion for the legal retention period. Transport companies remain responsible for their own drivers' work books. This system does not use face templates or raw GPS in the LUL record.

For company freight operations we also process company membership and invitation records, administrator/driver role and status, company-managed driver contract and licence metadata, signer-authority and agreement records, operating offices, fleet identifiers and availability, driver/vehicle assignment and exceptional handover history, and the company payout-recipient snapshot. We use these records to administer the transport contract, keep company tenants separate, support ProntoMigo's manual company assignment, verify that a named driver and vehicle are eligible, preserve cargo-custody history and pay the accepted company. The typical bases are contract performance, legitimate interests in lawful and secure transport operations and legal obligations where applicable.

We collect personal data:

• directly from you when you register, place orders, upload documents or contact support;
• automatically through your device when you use location-enabled features or our apps;
• from merchants and providers to the extent necessary to fulfil your request;
• from payment processors such as Stripe;
• from authentication providers if you choose social login;
• from public registers or verification partners where required for provider onboarding.

We process personal data only where a legal basis applies under Article 6 GDPR:

Where we rely on legitimate interest, we balance our interests against your rights and implement safeguards such as minimisation, access controls and retention limits. You may object to processing based on legitimate interest as described in Section 11.

ProntoMigo can send you offers and promotions from merchants in your area and from ProntoMigo itself. You choose separately:

• Offers by notification: push notifications and messages in the app inbox;
• Offers by email;
• Personalised offers: using your favourite places, your orders and the tastes you tell us to choose and order the offers you see and receive.

All three are off until you switch them on: at sign-up (the box is never pre-ticked), when the app asks you, or in the notification settings of the app or website. You can switch each one off at any time in the same place, and every marketing email has a link to unsubscribe in one click. Saying no does not change your orders, order updates or prices.

What we send. Offers and discounts that merchants in your city publish on ProntoMigo; an alert when a place you saved as a favourite launches an offer, or, with personalised offers, a place you ordered from in the last 120 days or one serving a cuisine you like; and ProntoMigo campaigns for customers in a city or with a given interest.

How we choose. Without personalised offers we use only your consent, the city of your saved addresses and the places you saved as favourites, and we list offers in order of expiry. With personalised offers we also use the places you ordered from in the last 120 days and the cuisines you like, to show the most relevant offers first and to decide which alerts and campaigns reach you. This is profiling based on your consent; it never changes prices and has no legal or similarly significant effect on you. The cuisines you hide and the places whose offers you mute are always respected, with or without personalised offers.

How often. At most one marketing message a day and three a week, and never at night: unless you set your own quiet hours, messages wait between 21:00 and 10:00 (Italian time).

What merchants see. Merchants never receive your contact details or a list of the customers who received their offer; they see only how many customers were reached.

Results. We count, in aggregate, how many customers received a campaign, opened it and ordered in the following 72 hours.

Records of your choices. Each time you switch a marketing choice on or off we record what you chose, when, where (app, website or unsubscribe link) and which version of this notice applied, so that we can demonstrate your consent and honour its withdrawal. These records are kept while your account exists and are deleted with it.

Personal data may be shared, according to the feature used, with:

• Merchants and independent providers involved in fulfilling the order or transport booking. A customer sees the first name and vehicle type of the rider or driver assigned to them and, only while the delivery is in progress and for 15 minutes after it is completed, that person's telephone number and vehicle plate. The assigned rider or driver sees the customer's delivery address and telephone number for the same period. After it, or immediately if the order is cancelled, neither can see the other's telephone number, the customer no longer sees the plate and the rider keeps only the postal code and city of the delivery; any later contact goes through ProntoMigo support. The first name of the person who delivered remains in the customer's order history;
• Merchants that deliver their own orders. Some orders are delivered by the shop itself, with its own staff or drivers, instead of a ProntoMigo rider; the checkout tells you before you pay. For those orders the shop receives your first name, telephone number, delivery address, the map coordinates of that address and your delivery notes. It can see them while the order is open and until 2 hours after the order is delivered, cancelled or refunded; after that our systems no longer show them to the shop. The shop may use them only to deliver that order and to contact you about it, not for marketing or any other purpose. For the delivery, the shop acts as an independent controller and is responsible for its own handling of these data, including by its staff and drivers;
• Pickup and delivery photos. For orders delivered by a rider, the customer sees the delivery photo of their order in the app for 48 hours after delivery, while a problem can be reported; the merchant sees the rider's pickup photo only inside a problem report or dispute about its own order; the rider sees their own photos; and authorised ProntoMigo staff see them to handle problem reports, disputes and support. Photos you add to a problem report are seen by authorised ProntoMigo staff and, when the refund is charged to the merchant, by that merchant. Photos are kept in private storage and shown only through short-lived links;
• Supabase for authentication, hosted PostgreSQL data and object storage;
• Stripe for card processing, fraud/payment controls, connected-recipient verification and payouts;
• Google Maps Platform for Places, geocoding, route distance, ETA and map display;
• Resend for contact, recruiting and transactional email when configured, and for marketing email if you chose offers by email; Expo for mobile build/update and push-delivery infrastructure;
• Sentry (Functional Software, Inc.) for error and crash diagnostics in the signed-in web apps and the mobile apps when enabled: reports contain the technical error, the app version and the device model and operating system, and are stripped of your identity, page addresses, request data and activity trail before they leave your device;
• Vercel, Railway and other selected hosting/infrastructure providers for the website, dashboards, API and workers, according to the production deployment;
• OpenAI only when a flag-enabled AI feature is used, to generate a draft or cited help answer from limited submitted content. API requests use the provider's available no-storage setting; raw prompts are not stored in ProntoMigo's AI audit table;
• verification providers, professional advisers, auditors, insurers and claims handlers where actually engaged and necessary;
• public authorities and regulators where disclosure is required by law or necessary to protect rights and safety.

Processors are appointed under Article 28 GDPR where required. Provider roles, configurations and subprocessors can change; an updated list and relevant safeguards are available from info@prontomigo.com.

Provider and project locations follow the accounts and production regions configured for each service. Some providers or their subprocessors may process data outside the European Economic Area. Where Chapter V GDPR applies, we rely on an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required.

You may request information about the transfers relevant to your data and a copy or summary of the applicable safeguards at info@prontomigo.com.

We retain data only for the relevant purpose. The current application defaults are:

• Account and profile: while the account is active. When you delete your account (in the app or web dashboard, confirmed with a code sent to your email), it is deactivated at once and permanently erased 30 days later; signing in before then lets you restore it. Deletion is refused while orders or jobs are in progress or while refunds, payouts owed, collected cash to remit, merchant dues or invoices, open support cases or a rented or lent ProntoMigo Pro device remain unresolved, and erasure waits until they are settled. At erasure we delete or redact the authentication identity, profile, saved addresses, the Stripe customer records holding saved payment methods, uploaded files and role-specific personal data. Any Sign in with Apple authorisation is revoked when you confirm deletion. We email you when deletion is scheduled, if you restore the account and when erasure is complete. A minimal record of the deletion request (dates and status, with the email address cleared once erasure is complete) is kept as evidence that the request was carried out. Erasure may be paused under a documented legal hold, for example for a dispute, claim or authority request, only for the data and period necessary.
• Orders, transport, payment, ledger, invoice and tax records: generally up to 10 years where required for accounting, tax, DAC7, contract or claims compliance; retained rows are minimised or redacted after account deletion where possible.
• Rider pickup and delivery photos, their capture location, and photos added to problem reports: 120 days from capture, unless a problem report, merchant dispute or card dispute on the order is still open, in which case they are kept until it is closed and then deleted.
• Delivery proof, support and safety evidence: for the applicable complaint, insurance or limitation period, or longer only under a documented legal hold.
• Live job locations: intermediate points on completed trails are trimmed after 7 days; location records are deleted after 30 days by default, unless a documented dispute, safety or legal hold applies. Exact retained provider points are not exposed after a terminal or revoked job.
• Provider compliance evidence: 10 years from upload by the current default. Merchant compliance documents: 7 years from upload by the current default. Access remains restricted and the record may survive account deletion until its retention date.
• Worker identity and activity: a validated personal fiscal-code claim prevents two operational worker logins. After account deletion, the claim is restricted and kept for five years before routine removal unless a legal hold applies. Rider and company-driver access, availability, offers, assignments, work-status and transfer-reference events are kept for at least five years from each event; raw GPS and device biometrics are not kept under this rule.
• Operational records: published outbox records 90 days; audit logs 365 days; terminal notification-delivery records 180 days; expired quotes, revoked device tokens and expired tracking shares 30 days. These worker defaults may be changed only through controlled retention configuration.
• AI catalog-import source files: 30 days after a terminal state (published, failed or cancelled). AI audit metadata contains feature/model identifiers, hashes and usage metrics rather than raw prompts; it is kept only for security, budget and quality governance under the applicable audit schedule.
• Anonymous help: server session and browser pseudonymous key up to 24 hours.
• Careers applications and CVs: 730 days from the last status change by default, followed by CV deletion and irreversible anonymisation of identifying fields. A separate employee notice applies if a candidate is hired.
• Marketing choices and their record: while the account exists; deleted with the account. Marketing messages leave the inbox when the offer ends or, for campaigns, 72 hours after sending; delivery records follow the operational schedule above.
• Cookie choice: 180 days unless changed or cleared sooner; first-party campaign attribution, if consented, 30 days.

When a period ends, data is deleted or irreversibly anonymised. Restricted backup copies may persist only for the documented technical backup cycle and are not returned to ordinary production use. A legal hold overrides automated deletion only for the data and duration necessary.

Providing account, contact, payment and service data is necessary to create an account, place orders, book van/truck transport and receive services. Without this information we cannot perform our contract with you.

For merchants, riders and transport providers, onboarding and compliance information is necessary for admin review, legal eligibility checks and account approval, and payout information is necessary for Stripe Connect activation. Merchants provide payout details during onboarding; riders and transport companies provide them to Stripe only after approval. Without required documents we may be unable to approve your account, and without required payout details we may be unable to activate payouts: an approved rider cannot go online, and an approved transport company cannot accept jobs, until its payout account is active.

Location data is necessary for live tracking during active deliveries by ProntoMigo riders and scheduled van/truck transport and, for riders, to receive delivery offers while online. You may disable location permissions in device settings, but certain features will not function.

Marketing and personalised-offers consents are optional. Refusing or withdrawing them does not affect your orders, order updates, prices or access to core services.

PRONTOMIGO S.R.L. uses deterministic systems to calculate quotes and ETAs, validate eligibility and detect operational or fraud signals. For food/grocery marketplace rider dispatch only, eligible candidates are ordered by proximity to pickup, current active workload, longest-wait/fairness rotation and a stable tie-breaker; service/vehicle eligibility and online availability are gates. Lawful refusal of an offer is not a punitive ranking factor. Commercial van/truck jobs are not ranked or dispatched automatically: ProntoMigo Operations manually selects a transport company, and that company's administrator assigns a named driver and vehicle. Operating-office, capacity and compliance indicators support but do not replace those human decisions.

Merchant browse results are ordered alphabetically after service-area and account-status eligibility filtering; customers may optionally apply an open-now filter. Product search uses text relevance with product-name ordering as a tie-breaker. The current code has no paid merchant placement or personalised merchant ranking.

The Offers screen lists offers from merchants in your city in order of expiry. If you consent to personalised offers (Section 5A), offers from your favourite places, from places you ordered from in the last 120 days and in cuisines you like come first, and the same signals decide which offer alerts and campaigns you receive. This profiling is based on your consent, never changes prices, has no legal or similarly significant effect and stops when you withdraw consent.

Problem reports. A problem report under EUR 20 may be approved automatically when fixed checks pass: the problem type allows it, the required photos are attached, the customer has an earlier delivered order and few recent claims, and the rider's pickup and delivery photos exist and are not location-flagged. A report is never rejected automatically: every report that is not approved automatically is decided by a person, and you can ask for a review through support. A merchant charged for an automatically approved refund can dispute it. A rider photo taken further than expected from the store or delivery address is flagged for a person to check; a flag or a claim never leads to an automatic payout deduction or account decision.

When separately enabled by feature flag, AI may generate draft-only suggestions for catalog import, internal support/operations briefs, cited public help answers and cargo/document extraction. AI does not autonomously set prices, approve refunds, publish catalogs, approve compliance documents, assign or suspend providers, close support tickets, or block payments or payouts. Humans remain responsible for those actions.

We do not use AI for biometric identification, emotion inference, hidden punitive scoring of job refusals or automated recruitment ranking/rejection. Significant account, work-access and payout restrictions are subject to human decision or review where required by law.

Providers are not required to share job tracking outside an authorised active target. A rider's availability position is shared only while the rider has chosen to be online and stops when the rider goes offline or signs out. You may request information, human intervention or review of a significant algorithm-supported decision at info@prontomigo.com.

If you apply through https://www.prontomigo.com/careers, PRONTOMIGO S.R.L. is the controller of your candidate data.

Categories: identity and contact details, location/city area, screening answers, optional profile URL and availability notes, PDF CV, technical metadata needed to secure the submission, and the privacy-notice version you acknowledged.

Purpose: assess suitability for the role you applied for and manage the recruiting pipeline.

Legal basis: pre-contractual steps at your request and legitimate interest in recruiting (Art. 6(1)(b), (f) GDPR).

Recipients: authorised ProntoMigo recruiting staff (SUPER_ADMIN in v1); cloud storage and email processors under Article 28 GDPR agreements. CVs are stored in a private bucket and accessed only through short-lived audited download links.

Retention: normally 24 months from the last status change, then CV deletion and anonymisation of candidate-identifying fields. A minimal non-identifying operational record (for example that a retention deletion occurred for a vacancy) may remain.

No automated hiring: we do not score, rank, or reject candidates by automated means in this system.

Marketing: Careers applications do not create marketing consent. Marketing remains optional and separate if offered later.

Your rights: email info@prontomigo.com to request access, correction, withdrawal of an application, or deletion. Verified requests are handled by authorised recruiting admins with reason, confirmation and audit trail — not by ordinary support roles.

Subject to applicable law, you have the right to:

• Access your personal data and obtain a copy (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erase data in certain circumstances (Art. 17);
• Restrict processing in certain circumstances (Art. 18);
• Data portability for data you provided, where processing is based on contract or consent and automated (Art. 20);
• Object to processing based on legitimate interest, including profiling (Art. 21);
• Withdraw consent at any time without affecting prior lawful processing (Art. 7(3));
• Object to direct marketing at any time, including the profiling used for it (Art. 21(2)–(3)): switch it off in the notification settings or use the unsubscribe link in any marketing email;
• Obtain human intervention and contest a qualifying solely automated decision (Art. 22).

Customers, riders/drivers and merchants can also act themselves in the account or settings area of the app or web dashboard: download a copy of the main personal data linked to their account (the link is also emailed and works for 24 hours), and delete the account as described in Section 8 and at https://www.prontomigo.com/account-deletion. For a complete copy of your data, or if you cannot sign in, email info@prontomigo.com. We respond without undue delay and within one month, extendable by two months where legally permitted for complex requests, and may request proportionate identity verification.

You may lodge a complaint with the Italian Data Protection Authority at https://www.garanteprivacy.it or with the supervisory authority in your EU Member State of residence.

We implement appropriate technical and organisational measures under Article 32 GDPR, including encryption in transit, role-based access controls, secure development practices, logging, monitoring and staff training.

If you believe your account has been compromised, contact info@prontomigo.com immediately.

Customer and partner accounts are intended only for persons aged 18 or over. We do not knowingly provide accounts to children. If you believe a child has submitted personal data, contact info@prontomigo.com so we can investigate and take the action required by law.

Our website uses cookies and similar technologies. Essential cookies are necessary for security and basic functionality. Analytics and marketing cookies are used only with your consent through our cookie banner.

For full details, see our Cookie Policy at https://www.prontomigo.com/cookies. You may change your preferences at any time from the cookie settings link in the website footer.

The mobile apps do not use cookies. They keep on your device only the data they need to work, such as your sign-in session, language, cart and recently viewed screens, listed in the Cookie Policy, and contain no advertising or analytics tracking.

We may update this Privacy Policy to reflect legal, technical or business changes. The "Last updated" date at the top indicates the current version. Material changes will be notified through the app, website or email where appropriate.

If you continue using our services after the effective date of an update, you acknowledge the revised policy unless applicable law requires express consent.

Data controller: PRONTOMIGO S.R.L. Registered office: Via Pola Interna n. 51, 41012 Carpi (MO), Italia Privacy requests: info@prontomigo.com Phone: 059 3970958 PEC: prontomigo@pec.it General support: info@prontomigo.com