1. Introduction and scope
This notice describes how WECOOP APS processes personal data of users of the WeCoop mobile app (iOS and Android) and related digital services, under Regulation (EU) 2016/679 (GDPR) and Italian privacy law.
This page complements the general website Privacy Policy and focuses on app data use: registration, profile, documents, service requests, payments, notifications and support features.
2. Data controller
WECOOP APS
Codice fiscale: 97977210158
P.IVA: 14933240963
RUNTS: n. 142852
Codice ATECO: 94.99.10
Sede: Via Benefattori dell'Ospedale 3, 20159 Milano (MI)
E-mail: info@wecoop.org
For any request about personal data processing (access, rectification, erasure, objection, portability, complaint) write to info@wecoop.org.
3. Categories of data processed in the app
Depending on the features you use, the app may process the following categories of data:
- Identity and contact data: first name, last name, phone prefix and number, email, nationality, date of birth, tax code (if provided).
- Account and authentication data: login credentials, session tokens, local biometric settings on the device (if enabled by the user), language preferences.
- Profile and membership data: member/user status, practice or card number, avatar, profile completion data.
- Uploaded documents and content: ID documents, administrative files, CVs, case attachments, digital signatures and related evidence (e.g. OTP).
- Service data: guidance, work, study, housing requests, events, listings, support messages and case history.
- Payment data: amount, payment status, transaction references. Card data is processed by Stripe and is not fully stored on WeCoop servers.
- Technical and device data: push identifiers (Firebase Cloud Messaging), device/OS type, technical and security logs, usage data needed for operation.
- Consents: acceptance of the GDPR/privacy notice, and any specific consents for services (e.g. job applications, sharing with partners).
4. Purposes of processing
- Account creation and management: registration, login, access recovery, account security.
- Delivery of WeCoop services: managing cases, documents, events, listings, guidance and local support.
- Operational communications: push notifications, emails or messages about request status and service updates.
- Payments and receipts: handling payments for fee-based services and retaining legally required evidence.
- Legal and associative obligations: legal duties, unique document / notices, GDPR rights handling, abuse prevention.
- Service improvement: aggregated and anonymised analysis to improve app stability, usability and quality.
5. Legal basis
Processing is based on one or more of the following legal bases (Art. 6 GDPR):
- (a) Consent — e.g. acknowledging the notice at registration, optional marketing, some third-party sharing.
- (b) Contract performance or pre-contractual steps — delivering services requested via the app.
- (c) Legal obligation — tax/admin retention, responses to authorities.
- (f) Legitimate interest — account security, fraud prevention, technical improvement, within the limits of your rights.
6. Nature of provision
Providing first name, last name and phone number is required to register and use the app. Without these data an account cannot be created.
Other data (email, documents, CV, payments, preferences) are requested only for specific features: not providing them may block that feature, but not necessarily the whole account.
7. Processing methods and security
Data is processed with electronic tools and adequate organisational measures: authenticated access, encryption in transit (HTTPS/TLS), role segregation, security logging and backups.
Passwords are stored hashed. Tokens and credentials on device may be saved in the OS secure storage. Biometric authentication, if enabled, remains managed locally by the device.
8. Recipients and processors
Data is not sold. It may be disclosed, within the stated purposes, to:
- Authorised WeCoop staff and desk operators involved in case management.
- Technical providers (hosting, cloud, email, document storage) appointed as processors where required.
- Firebase / Google (push notifications) and Stripe (card payments), under their terms and contractual safeguards.
- Institutional or project partners, only if needed to deliver the requested service or with specific consent.
- Public authorities and supervisory bodies, where legally required.
9. Extra-EU transfers
Data is preferably processed in Italy and the EEA. If some providers process data outside the EEA (e.g. global notification or payment infrastructures), the transfer uses adequate GDPR safeguards (Arts. 46-49).
10. Retention period
- Account and profile data: for the duration of the relationship and, after closure, for as long as needed for residual requests or legal duties.
- Documents and cases: until service completion and any documentary/admin retention periods.
- Payment and tax data: up to 10 years where required by law.
- Technical and security logs: generally no more than 12 months, except for defence or investigation needs.
- Push tokens and device preferences: until uninstall, logout or permission revocation.
11. Rights of the data subject
Under Arts. 15-22 GDPR, you may at any time:
- Access your personal data
- Request rectification or update
- Request erasure (right to be forgotten), within legal limits
- Restrict or object to processing
- Request data portability
- Withdraw consents given, without affecting prior lawful processing
- Lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it)
To exercise your rights: info@wecoop.org. To request account deletion from the app or website: Delete account.
12. Consent at registration and acknowledgement
During app registration, users must declare they have read this GDPR notice on app data use. The checkbox is mandatory to complete account creation.
The notice link remains available in the app profile and can also be consulted before login. Acceptance is logged with registration data for accountability.
13. Minors
WeCoop app services are not intended for users under 16. We do not knowingly collect minors’ data. If you believe a minor provided personal data, contact info@wecoop.org immediately for removal.
14. Updates
WeCoop may update this notice for legal, organisational or technical reasons. The updated version is published on this page with the modification date. Material changes may require a new in-app acknowledgement.
For the general website policy also see the Privacy Policy.