Privacy policy

1. Data controller

The controller of the personal data described in this notice is Design Web Multimedia Agency, with registered office at Piazza Roma 82, 22066, Mariano Comense (IT), VAT number 04018830135, privacy email: info@cursusoffice.com (the "Controller"), which provides the Cursus Office service.

This notice covers the personal data of people who visit cursusoffice.com, cursusoffice.it and cursusoffice.be, sign up for the service or use it as a user. It does not cover the personal data of customers, suppliers and collaborators that our customer enters in the business manager: for that data the Controller acts as processor on behalf of the customer, under the Data Processing Agreement (DPA).

2. What data we process

• Sign-up and account data: first and last name, email address, company name, country, language, chosen plan, sign-up date, users and roles created in the account.
• Sign-in and security data: credentials (the password is stored only as a hash), passkeys and two-step verification data, active sessions, the security event log, IP address and device information (user agent).
• Proof of acceptance of the legal texts: version and language of the texts accepted, date and time, IP address and user agent.
• Payment and billing data: card data is handled directly by Stripe; we only receive the outcome, the amount and a reference of the transaction. For subscription invoices we keep name, address, VAT number, tax code and recipient code or PEC.
• Communications: the messages you send us and the service emails we send you (address verification, invitations, notices about the free trial, payments and deletion, security notifications).
• Technical data: server log files and rate limits to prevent abuse.
• Integrations you switch on: if you connect third-party services (for example Google Calendar), the data strictly needed for the connection, as described below.

3. Why we process it and on what legal basis

Purpose	Legal basis
Creating and managing the account, providing the service, support	Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR)
Collecting fees, invoicing, meeting tax and accounting obligations	Performance of a contract and legal obligation (Art. 6(1)(b) and 6(1)(c))
Platform security, fraud and abuse prevention, access log, protecting the sign-up form from bots	Legitimate interest of the Controller (Art. 6(1)(f))
Keeping proof of acceptance of the legal texts, defending a right in court	Legitimate interest and legal obligation (Art. 6(1)(f) and 6(1)(c))
Remembering your cookie choices	Legal obligation and legitimate interest (Art. 6(1)(c) and 6(1)(f))
Marketing communications about the service, if you ask for them or consent	Consent (Art. 6(1)(a)), which you can withdraw at any time

Providing the sign-up data is necessary to use the service: without it we cannot create the account. We do not carry out profiling or automated decisions that produce legal effects on you.

4. Cookies and similar tools

• Necessary cookies (no consent needed): the sign-in session of the private area and abuse protection. The co_consent cookie remembers your cookie choice and lasts 180 days.
• Display preferences (light or dark theme, sidebar), saved in your browser because they are a feature you request.
• Optional cookies (statistics, marketing): we do not use them at the moment. If we introduce them in the future, we will switch them on only after your consent, which you can change at any time from "Cookie preferences" at the bottom of the page or from the user menu. We do not run advertising or profiling.
• The sign-up form uses Cloudflare Turnstile, an anti-bot check that processes technical browser data to tell people from automated programs.
• Some pages load files (scripts, fonts, icons, flags) from content delivery networks (jsDelivr, Cloudflare cdnjs, jQuery CDN), which receive your IP address to deliver them.

5. Who we share data with

Data is processed only by authorised persons and by suppliers acting on our behalf as processors, including:

• IONOS SE (Germany): server infrastructure and hosting;
• Google Ireland Limited: delivery of service emails;
• Stripe Payments Europe Ltd.: card payments;
• Cloudflare, Inc.: form protection (Turnstile) and content delivery network.

We may disclose data to advisers (accountant, lawyer) bound by confidentiality and to authorities when the law requires it. We do not sell your data.

Google Calendar (optional integration)

If you choose to connect your Google account to the Google Calendar synchronisation, we ask you to grant access only to a calendar created by Cursus Office (scope calendar.app.created). We use this access solely to copy the deadlines you select (for example payments due, quotes, contracts and tasks) to that calendar, in one direction only, and to update or remove them when they change. We do not read your other calendars or events. The access token is stored encrypted and you can disconnect at any time from the product (which also deletes the calendar we created) or from your Google account permissions.

Cursus Office's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it, and do not allow humans to read it except with your consent, for security purposes or to comply with the law.

6. Transfers outside the European Economic Area

Some suppliers (for example Stripe, Google and Cloudflare) may also process data outside the EEA. In that case the transfer relies on an adequacy decision (for example the EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses, with supplementary measures where necessary.

7. How long we keep it

• Account data: for the duration of the contract. You can request permanent deletion of the account and all data from the "Account and data" page when you have no plan in progress; you will receive a confirmation email.
• Free trial not followed by a plan: when the trial ends you have 7 days to download your data and choose a plan; we notify you by email. If you do not choose a plan, the workspace and all its data, issued documents included, are permanently deleted. Keeping the documents you issued remains your responsibility.
• Unconfirmed or rejected sign-ups: deleted after 30 days.
• Security event and session log: for the period set in the account (normally 12 months).
• Proof of acceptance of the legal texts, payments and subscription invoices: for the time required by law (tax documents up to 10 years) or for the defence of rights. When we delete an account we anonymise the email and IP address in the proofs of acceptance.
• Server log files: for a limited period, only for security and troubleshooting.

8. Your rights

You may request access to your data, rectification, erasure, restriction and portability, and object to processing based on legitimate interest; you may withdraw consent where it is required. Write to info@cursusoffice.com. You have the right to lodge a complaint with the Italian data protection authority (www.garanteprivacy.it) or with the authority of your country. If your request concerns data entered in the business manager by one of our customers, we will direct you to that customer, who is the controller.

9. Security

We adopt appropriate technical and organisational measures: hashed passwords, encrypted secrets of connected services, a separate database for every account, two-step verification and passkeys, revocable sessions, a security event log, and rate limits against abuse.

10. Changes

We may update this notice; the version in force is the one published on this page, with its effective date. We will notify you of significant changes.