The data controller for end-user data (hotel staff) is the hotel that subscribes to the service. Kambio Turno, represented by Michelangelo Melis, acts as an external data processor under Article 28 of the GDPR.
Kambio Turno collects and stores exclusively the data voluntarily entered by users while using the service:
We do not collect sensitive data, health data, or personal data belonging to hotel guests.
Data is processed exclusively to:
Data is never sold, transferred, or shared with third parties for commercial purposes.
Operational data is stored on Supabase (servers in Ireland, EU) and Netlify (GDPR-compliant servers). Billing data is handled by Paddle.com, which acts as Merchant of Record and data processor for payment data, in compliance with the GDPR. All providers maintain high security standards.
As data processor, Kambio Turno has technical access to stored operational data solely for maintenance, technical support, and troubleshooting purposes. Such access only occurs upon the hotel's explicit request or for documented technical necessity. Kambio Turno does not have access to full payment card data, which is handled entirely by Paddle.
Operational data (tasks, notes) is retained for the duration of the service contract. Upon termination, data is deleted within 30 days at the hotel's request. Billing data is retained by Paddle in accordance with applicable tax and accounting obligations.
Every user has the right to access, rectify, erase, restrict, and port their data. To exercise these rights: michelangelo@kambioturno.com
Kambio Turno does not use profiling, marketing, or tracking cookies, and does not share any data with advertising platforms.
We only use browser local storage (localStorage) for purposes that are strictly necessary for the service to function, exempt from consent requirements under the ePrivacy Directive:
The site loads fonts via Google Fonts (Google Ireland Limited); this involves sending the visitor's IP address to Google's servers when the page loads.
Some technical libraries (PDF generation, database connection) are loaded from trusted third-party content delivery networks (CDNs); these do not set cookies or collect personal data, but do involve standard technical requests (common to any website) sent to those providers' servers.
Our payment provider (Paddle) may use its own technical cookies, strictly necessary for secure transaction processing and fraud prevention, in accordance with its own privacy notice.
For any privacy-related question: michelangelo@kambioturno.com