This notice explains how Centinn processes personal data on the centinn.com website, in demo requests, in the Centinn app and in the read-only bank connection.
1. Controller and contact
The data controller is Centinn.
For privacy requests, to exercise your rights or to report a data protection issue, write to info@centinn.com.
2. The service
Centinn builds tools to organise and understand a business’s financial data. The product can show cash, transactions, due dates, invoices and other operational information.
The public demo uses sample data only. Centinn accesses real bank data only after the user authorises it.
Centinn does not give legal, tax or financial advice. Its information and AI features help you read your data. They do not make decisions with legal effects without human involvement.
3. Personal data we process
Centinn applies the principle of data minimisation. The product uses only the data needed for the feature you request.
Demo requests
- Email address and chosen language.
- Confirmation that you have read this notice, and your choice about receiving news from Centinn.
- Date of the request, date of access and expiry of your demo access.
- A code derived from your IP address, used only to limit repeated requests and deleted within 24 hours.
Data you give us
- The user’s first name, last name and verified email.
- The business’s legal name, VAT number, city and essential details.
- Tax regime, VAT frequency, ATECO sector and organisational details chosen during setup.
- Questions asked to Ivo, messages, support requests and information you send us voluntarily.
- Confirmations about the terms, the privacy notice and your authority to act on behalf of the business.
Data from the bank connection
- Account identifiers and information about the bank.
- Available balance and booked balance, if the bank provides them.
- Transactions, amounts, currencies, dates, descriptions and transaction status.
- Details of the counterparties shown in transactions, if the bank provides them.
- Status, duration and technical identifiers of the bank authorisation.
Technical data
- IP address, device type, browser, date and time of the request.
- Security events, errors and technical data needed for diagnosis and protection.
- Technical identifiers of the account, session and organisation.
Centinn never asks for your bank credentials. It does not ask for your bank password, device codes or strong authentication codes.
Fields marked as required in our forms are needed to provide the feature you ask for: without them, Centinn cannot create your account or open the demo for you. Consent to receive news is optional.
4. Bank connection and Enable Banking
Centinn uses Enable Banking as its Open Banking provider. The connection uses the bank interfaces provided for by payment services law.
- The user chooses the bank and starts the connection from Centinn.
- Enable Banking sends the user to the bank’s own flow.
- The bank authenticates the user and shows the data requested.
- The user authorises access to the selected accounts.
- Enable Banking sends Centinn the authorised data.
The connection is read-only. Centinn cannot make payments through this flow.
The user can revoke the authorisation or choose not to renew it. Revoking it stops further updates. To delete the data already imported as well, the user can ask at info@centinn.com.
The bank authorisation gives technical access to the account data. It does not replace the legal basis required by the GDPR. Centinn processes the data needed to provide the feature requested within its relationship with the user.
5. Purposes and legal bases
| Purpose | Main data | Legal basis |
|---|---|---|
| Opening the demo and managing access to it. | Email, language, dates of the request and of access. | Your request (pre-contractual steps). |
| Sending news about Centinn by email. | Email and language. | Consent, which you can withdraw at any time. |
| Creating the account and setting up the business. | User and business data. | Contract and pre-contractual steps. |
| Providing dashboards, analysis, Ivo’s answers and the features requested. | Business, financial and bank data. | Performance of the contract. |
| Protecting accounts, the service and the infrastructure. | Logs, identifiers and security events. | Legitimate interest in security. |
| Answering requests and fixing errors. | Contact details, messages and technical data. | Contract or legitimate interest. |
| Complying with legal obligations and valid requests. | Data required by the applicable law. | Legal obligation. |
When Centinn relies on legitimate interest, it assesses necessity, proportionality and the impact on people’s rights. You can object on grounds relating to your particular situation.
6. Where the data comes from
Centinn receives data from the user, from the business that authorises them and from the technical providers used for the service.
Bank data comes from the selected bank through Enable Banking. Transactions may contain personal data of customers, suppliers or other counterparties.
7. Recipients and providers
Centinn limits access to the data to the people and providers who perform a necessary function.
- Enable Banking, for the read-only Open Banking connection.
- Cloudflare, for hosting the website and the demo, the demo request database and network security.
- Google, for storing the demo requests received.
- Google (Google Tag Manager and Google Analytics), for website visit statistics, only if you accept them.
- Amazon Web Services (Amazon Bedrock), for processing the questions asked to Ivo and generating the answers. Under AWS’s terms, Amazon Bedrock does not use this data to train models.
- Authentication, email and support providers, appointed as data processors.
- The accountant or firm the user invites, for the data of the connected business.
- Professional advisers bound by confidentiality obligations.
- Public authorities, when a law or a valid request requires disclosure.
Centinn does not sell personal data. Centinn does not use bank data for behavioural advertising. The up-to-date list of providers is available on request at info@centinn.com.
8. Transfers outside the European Economic Area
The demo request database is located in the European Union. Some providers, such as Cloudflare, Google and Amazon Web Services, are based in the United States and may process data outside the European Economic Area.
In these cases the transfer relies on the European Commission’s adequacy decision for providers certified under the EU-U.S. Data Privacy Framework, or on the standard contractual clauses approved by the Commission.
9. Retention and deletion
Centinn keeps data only for as long as the stated purpose requires.
- Demo requests: access is valid for 7 days; the email and request details are kept for 24 months, then deleted.
- Consent to receive news: until you withdraw it, which you can do at any time by writing to info@centinn.com.
- Messages sent to info@centinn.com: 24 months from the last contact.
- Account and business data: for as long as the account exists, then deleted within 30 days of closure.
- Bank data: while the connection and the account remain active, then deleted within 30 days of a deletion request or of the account’s closure.
- Security logs: up to 12 months.
- Data needed for legal obligations or to defend legal claims: for the period required by law.
Backups follow a protected 30-day replacement cycle.
10. Security
Centinn limits access to data according to the authorised functions. The bank connection uses secure connections and the bank’s own authentication.
No system removes every risk. Report suspicious access or security issues to info@centinn.com.
11. Your rights
Where the GDPR provides for it, you can request:
- access to your personal data;
- correction of inaccurate data;
- erasure of your data;
- restriction of processing;
- portability of the data you provided;
- objection to processing based on legitimate interest;
- withdrawal of consent, where consent is the legal basis.
Send your request to info@centinn.com. Centinn may ask for the information needed to verify the requester’s identity.
You can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.
13. Minors
Centinn is a product for businesses and professionals. The service is not intended for minors. Contact the controller if you believe a minor has provided personal data.
14. Changes
Centinn updates this notice when the product, the legal framework or the list of providers changes. The date at the top shows the latest revision.
This English version is a translation; if it differs from the Italian text, the Italian text prevails.
Privacy contact
For any question about this notice, write to info@centinn.com.