Privacy Policy
1. Data controller
RobyOne by Abram Germano
Via Sospello 123A, 10147 Turin (TO)
VAT ID: 07636130010
E-mail: Show email address
Website: www.robyone.it
For any questions regarding the processing of personal data, you can contact us at the email address indicated above.
2. Data collected and purposes of processing
2.1 Navigation data
The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols (e.g. IP address, browser type, operating system, pages visited, time of request). This data is used exclusively to obtain anonymous statistical information about website usage and to monitor its correct operation; it is retained for the strictly necessary time and deleted after processing.
2.2 Data voluntarily provided by the user
The optional, explicit and voluntary sending of messages or completion of forms on the website results in the acquisition of the sender's contact data and all data entered in the form. The forms on the website are:
- Repair booking form — name, surname, telephone, e-mail, device and reported defect; purpose: management of the appointment and related operational communications.
- Processing status form — case number or device data; purpose: verification of repair progress status.
- Home pickup form — name, surname, telephone, e-mail, pickup address (street, number, postal code, city, unit), preferred time slot, device category and description; purpose: organization of the courier pickup service.
- Contact form — name, e-mail, message; purpose: response to information request.
Legal basis: performance of pre-contractual or contractual measures (art. 6, par. 1, lit. b GDPR); legitimate interest of the Controller in the management of operational communications (art. 6, par. 1, lit. f GDPR).
2.3 Payment data
The website allows payment of deposits or balances via PayPal and Satispay. Transactions take place directly on the platforms of the respective providers; RobyOne does not collect or store credit card data or credentials for access to payment services. For the respective notices, please refer to:
2.4 Data collected for the laboratory repair service
At the time a device is received at the laboratory, the following personal data are collected: name, surname, telephone number and/or e-mail, description of the defect, brand and model of the device, serial number/IMEI.
Purpose: management of the repair case, operational communications
(progress status, estimate, ready for pickup), issuance of tax documents,
compliance with legal obligations.
Legal basis: performance of the contract (art. 6, par. 1, lit. b GDPR);
legal and tax obligations (art. 6, par. 1, lit. c GDPR).
Retention: 10 years from issuance of the tax document, in
compliance with legal obligations.
2.5 Data contained in the device submitted for repair
The device submitted to the laboratory may contain personal data of the customer (photographs, messages, documents, access credentials, etc.). Such data:
- do not constitute the subject of processing by the laboratory;
- are accessed only to the extent strictly necessary for the performance of the repair or verification of the correct functioning of the device;
- are not copied, transmitted to third parties or retained by the laboratory.
Customers are advised to back up their data before delivering the device. The laboratory is not responsible for any data loss that occurs during repair.
2.6 Video surveillance
The laboratory premises are equipped with a closed-circuit video surveillance system (CCTV). Images are collected exclusively for security purposes of the premises and protection of goods under repair.
Legal basis: legitimate interest of the Controller (art. 6, par. 1,
lit. f GDPR) — Privacy Authority Ruling April 8, 2010.
Retention: 7 days, with automatic overwriting. In case
of theft, damage or incident, relevant images may be retained until
conclusion of the related proceedings.
Appropriate summary notice is displayed at the entrance to the premises, pursuant to
Privacy Authority Ruling April 8, 2010.
2.7 Recording of telephone communications
Telephone communications between the customer and the laboratory may be
recorded for service improvement purposes and protection in case of disputes.
The customer is informed of the recording via automatic or verbal notice
at the beginning of the call; by continuing the communication, the customer gives
consent to the recording.
Legal basis: legitimate interest of the Controller (art. 6, par. 1,
lit. f GDPR).
Retention: 90 days, unless longer retention is necessary
for ongoing legal proceedings.
2.8 Messages on WhatsApp, Facebook Messenger and Instagram
If you write to us on WhatsApp, Facebook Messenger or in Direct messages on Instagram, or
comment on our posts or ads, we receive and store in our management system: your profile
name; the identifier that the platform assigns to the conversation or interaction with us
(for WhatsApp the phone number); the text of messages or comments and any photos or files
you send us. We use this data only to reply to you, to prepare the estimate and to manage
the repair.
Legal basis: pre-contractual and contractual measures requested by you
(art. 6, par. 1, lit. b GDPR).
To respond faster, message text can be read by an artificial intelligence service (Anthropic PBC, United States), which proposes a draft response or a short automatic message when the laboratory is closed. Every non-automatic response is written or reviewed by a laboratory staff member. Voice messages are transcribed to text by an OpenAI service (OpenAI Ireland Ltd). The Anthropic service also monitors public comments and hides offensive or spam ones, to keep the page clean (legitimate interest, art. 6, par. 1, lit. f GDPR). Providers process data on our behalf and do not use it to train their own models; the transfer to the United States takes place with the safeguards provided by arts. 45-46 GDPR.
Messages remain on Meta Platforms Ireland Limited's platforms according to their rules. In our management system we retain them for the time indicated in point 8.
How to request deletion: write us «delete my data» in the same chat (WhatsApp, Messenger or Instagram), or to the email address indicated at point 11. Within 30 days we will delete from our management system the messages, photos and profile data, except those that the law requires us to keep (for example tax documents of a repair performed). We will confirm the deletion in the same chat or by email.
3. Cookies and tracking technologies
The website uses cookies and similar technologies. Below is a description of the categories used.
| Category | Name / Provider | Purpose | Duration |
|---|---|---|---|
| Technical / functional | PHP session cookie (PHPSESSID) |
User session management (booking cart, authentication status) | Session (deleted on browser close) |
| Technical / functional | Cookie policy acceptance cookie | Stores the consent given by the visitor to the cookie banner | 1 year |
| Analytics (third party) | Google Analytics (via Google Tag Manager) | Statistical analysis of traffic in aggregated and anonymized form | Up to 2 years |
| Security (third party) | Google reCAPTCHA | Protection of forms from spam and abuse | 6 months |
| Maps (third party) | Google Maps | Display of map on the "Where we are" page | Variable |
You can disable analytics and third-party cookies by modifying your browser settings or using opt-out tools provided by individual providers (e.g. Google Analytics Opt-out). Disabling technical cookies could compromise the correct functioning of the website.
4. Google Tag Manager and Google Analytics
The website uses Google Tag Manager (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for centralized management of tracking scripts, including Google Analytics 4. Data collected by Google Analytics is transmitted and stored on Google servers, including in the United States, in compliance with the safeguards provided by GDPR (EU-US Data Privacy Framework Adequacy Decision, Standard Contractual Clauses).
The IP address is anonymized before transmission. For Google's full notice: policies.google.com/privacy.
5. Google reCAPTCHA
The website's forms use Google reCAPTCHA (Google Ireland Limited) to distinguish human requests from automated ones. The service analyzes the visitor's behavior (mouse movements, visit duration, pre-existing cookies) and sends the results to Google. Legal basis: legitimate interest of the Controller in website security (art. 6, par. 1, lit. f GDPR). Google notice: policies.google.com/privacy.
6. Google Maps
The "Where we are" page incorporates maps provided by Google Maps (Google Ireland Limited). Loading the map may result in the transfer of data (including IP address) to Google servers. For the full notice: policies.google.com/privacy.
7. Email and SMS communications
Following a booking or home pickup request, the Controller sends operational communications (appointment confirmation, repair status updates) to the email address and/or phone number provided. These communications have no promotional purpose and are sent exclusively within the scope of managing the requested service. Legal basis: performance of the contract (art. 6, par. 1, lit. b GDPR).
Emails are sent via Gmail service (Google Ireland Limited). SMS are sent via third-party provider. Data is processed exclusively for delivery of the communication.
8. Data retention period
| Data type | Retention period |
|---|---|
| Booking and processing data | 10 years (tax and legal obligations) |
| Contact form data | 2 years from date of last communication |
| Home pickup request data | 2 years from date of pickup |
| Video surveillance images (CCTV) | 7 days (automatic overwriting); longer in case of ongoing proceedings |
| Telephone call recordings | 90 days; longer in case of ongoing proceedings |
| Website access logs | 30 days |
| Analytics data (Google Analytics) | 14 months (default setting) |
After the indicated period, data is deleted or anonymized, unless retention obligations are provided by law.
9. Recipients and data processors
Data may be disclosed, to the extent strictly necessary for the purposes indicated, to the following categories of recipients:
- IT and hosting service providers (web servers, databases)
- Google Ireland Limited (Analytics, reCAPTCHA, Maps, Gmail)
- PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processor
- Satispay S.p.A. — payment processor
- UPS Italia S.r.l. — courier for home pickup service
- SMS service providers
Recipients act as Data Processors (art. 28 GDPR) or, in some cases, as independent Controllers. No dissemination or transfer of personal data to third parties for their own purposes is carried out.
10. Extra-EU data transfers
Some providers (Google, PayPal) process data in the United States. Such transfers take place in compliance with Regulation EU 2016/679, based on the European Commission's Adequacy Decision regarding the EU-US Data Privacy Framework (July 2023) and/or Standard Contractual Clauses approved by the European Commission.
11. Rights of the data subject
As a data subject, you have the right to:
- Access (art. 15 GDPR) — obtain confirmation of processing and a copy of data concerning you
- Rectification (art. 16 GDPR) — request correction of inaccurate or incomplete data
- Erasure (art. 17 GDPR) — request deletion of data in cases provided for by the regulation
- Restriction (art. 18 GDPR) — request restriction of processing in certain cases
- Portability (art. 20 GDPR) — receive data provided in a structured, commonly used and machine-readable format
- Objection (art. 21 GDPR) — object to processing based on legitimate interest
- Withdrawal of consent — at any time, without prejudice to the lawfulness of processing prior to withdrawal
- Lodge a complaint — lodge a complaint with the Data Protection Authority (www.garanteprivacy.it)
To exercise your rights, write to us at Show email address. We will respond within 30 days of receiving your request.
12. Android application «Joypad Tester»
The Joypad Tester application, distributed via Google Play, is used to test a game controller connected to the phone with a USB cable. It does not collect, save or transmit any data.
This is not a statement of intent but a technical feature: the application does not declare internet access permission, so the Android system prevents it from sending anything, to us or to anyone else.
- What it reads — from the connected controller: model, serial number, Bluetooth address, battery level and position of analog sticks, buttons and triggers
- Where it goes — only on the screen, for the time the application is open. Closing it, they disappear: they are not written to any file
- What's not there — no account, no advertising, no advertising ID, no usage statistics, no automatic error reporting
- Permissions requested — only access to the connected USB device, which you authorize from the Android system
Controller data are technical data of a device, not personal data. They are listed here for transparency: they remain on your phone and never reach us.
13. Updates to this notice
The Controller reserves the right to update this notice at any time, in particular following regulatory changes or changes to the services offered. Substantial changes will be notified by prominent notice on the website. The date of the last update is indicated at the top of this notice.