Privacy policy

The data controller is TP53 S.r.l., with registered office at Via Pomposa 153, 44121 Ferrara (FE), Italia, VAT no. 02203290388 ("TP53" or "we"). For any privacy request you can write to support@tp53health.com.

This policy covers the data that TP53 processes as controller, namely the data of:

• visitors to the Styla website;
• people who request a demo or a quote, or contact us;
• owners, managers and staff of the businesses that subscribe to Styla (account and billing data).

The data of end clients and staff that businesses enter in Styla (profiles, appointments, client cards, notes) is processed by TP53 as a processor on behalf of the business, which remains the controller. This processing is governed by the Data processing agreement (DPA). End clients who wish to exercise their rights should first contact the business they are clients of; TP53 will help it respond.

• Contact and identification data: first name, last name, email, phone, name and type of business, city, number of locations and staff.
• Contract and billing data: company name, VAT number, tax code, SDI recipient code or certified email (PEC), address, subscribed plan, payment history. Card data is handled directly by the payment provider and is not stored by TP53.
• Usage and technical data: IP address, device and browser type, access logs, pages visited, actions performed in the software, for security and operational purposes.
• Communications: the content of requests sent through forms, email, support chat or during the demo.

We do not ask for special categories of data (art. 9 GDPR) for the purposes described in this policy. Please do not enter them in contact forms.

Providing the data needed for the demo, the contract and billing is necessary: without it we cannot respond to the request or provide the service. Providing data for marketing purposes is optional, and refusing has no consequence on the service.

Data may be disclosed, to the extent necessary, to:

• TP53 staff and collaborators authorised to process it and bound by confidentiality;
• providers acting as processors: hosting and cloud infrastructure, database, email and SMS delivery, payments, customer support, artificial intelligence tools;
• tax advisers, accountants and lawyers, banks;
• public authorities, where required by law.

The up-to-date list of sub-processors is in the DPA. Data is never sold or made public.

We favour providers that store data in the European Economic Area. When a provider processes data outside the EEA, the transfer is based on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies) or on the Standard Contractual Clauses adopted by the Commission (art. 46 GDPR), with supplementary measures where needed. A copy of the safeguards can be requested by writing to us.

Data is kept for the periods shown in the table in the Purposes section. When the contract ends, the data entered in the software is returned on request and deleted within 90 days, unless the law requires otherwise. Encrypted backup copies are overwritten according to the normal rotation cycle within a further 30 days.

The Styla AI assistant processes the user's requests to prepare drafts and suggestions (for example messages, client card updates, proposed time slots). Proposals are always shown to the user, who reviews and confirms them: we do not take decisions based solely on automated processing that produce legal or similarly significant effects under art. 22 GDPR. Data processed by the assistant is not used by providers to train their models. AI is used in compliance with Regulation (EU) 2024/1689 (AI Act).

The website uses technical cookies, necessary for its operation and security, for which no consent is required. Any analytics cookies are used in aggregate form with minimised IP addresses, or subject to consent; profiling and marketing cookies are set only with explicit consent, as required by art. 122 of the Privacy Code and the Italian Data Protection Authority's guidelines of 10 June 2021. You can change your choices at any time from your browser settings or from the cookie banner, when present. Details are in the cookie policy.

We adopt appropriate technical and organisational measures under art. 32 GDPR, including encryption of data in transit (TLS) and at rest, role-based access control, secure authentication, regular backups, access logging and staff training. Data breaches are handled in accordance with arts. 33 and 34 GDPR.

Under arts. 15-22 GDPR you may, at any time and free of charge:

• access your data and obtain a copy;
• ask for it to be corrected or completed;
• ask for it to be erased, where applicable;
• ask for processing to be restricted;
• receive the data in a structured format and transmit it to another controller (portability);
• object to processing based on legitimate interest and, always, to direct marketing;
• withdraw consent, without affecting the lawfulness of prior processing.

Write to support@tp53health.com. We respond within one month, extendable by two months for complex requests (art. 12 GDPR).

If you believe the processing infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or take legal action.

We may update this policy to reflect changes in the law or in the service. The version in force is always published on this page with its update date; for material changes we will notify clients by email.