How we handle the data you trust us with

• Your data stays yours. We do not sell it, pass it on, or make it available to another client.
• We read from your systems. Wherever possible we work through delegated access that you revoke at will, without handing over your personal credentials. The working copy our services run on resides on infrastructure from selected providers, and your data is kept distinct from other clients' data.
• You can have personal data deleted whenever you want. It is a right in law, not a contractual concession: you ask, and you do not have to give a reason.
• We ask for the minimum, and use it only for that. Where the work requires it — order management, building remarketing audiences — we also process your customers' personal data, but only for those purposes. Payment card data never reaches us.
• You contribute to a market picture, anonymously. You can opt out at any time, and while you are in, you get to see it. The section «The market picture» sets out exactly how.

It depends on the project, but it falls into these families.

On your end customers' data we say it as it is. When we work on order management or remarketing campaigns, that data passes through our system: it is what makes the service you are asking for possible. The point is not that we never touch it — it is that we use it only for the two purposes you have authorised and for nothing else: never to profile, never to enrich another client, never to sell.

What never reaches us. Payment card data: we do not need it and we do not ask for it. And if an analysis were to require a category of data not provided for, we tell you first and discuss it: it never arrives as an implicit request buried inside an access grant.

Your systems remain the source and carry on working as before: when we need to read them, we do so through access you grant and revoke, with no exchange of personal credentials. We work through a service email address registered to you and accessible to both sides: it is the only address the connections to your data pass through, so you can check what we are connected to at any time without having to ask us.

Our software services are delivered on a subscription basis. The data they process resides in infrastructure operated by J-Action LLC — the company behind EurekaGO and EurekaBike — on servers in the European Union and the United States provided by specialist operators, named in the technical annex. It is not an archive we take from you: it is the working copy the services run on, and you govern it through the rights set out below.

How your data is kept apart from everyone else's. The services are multi-client: several clients' data may reside in the same database, where every record is associated with the client it belongs to, and access is limited to the people and processes authorised for that client. Internal technical processes — data import, automated processing and platform administration — run with broader privileges instead: they run only on systems under our control, and only authorised technical staff can access them. For those with particular requirements, a dedicated, isolated installation is available as an option on different terms.

Because processing involves infrastructure in the United States and access from countries outside the Union, transfers of personal data from the European Union rely on the standard contractual clauses approved by the European Commission, which we attach to the contract.

It is seen by the people on our team assigned to your project and, for technical and platform administration work, by authorised technical staff. Our team is distributed: we work from several countries, inside and outside the European Union. Anyone who touches your data does so on behalf of J-Action, on our instruction and bound in writing to confidentiality and to the same data protection obligations we take on; transfers to countries outside the European Union rely on the European Commission's standard contractual clauses. You still have a single counterparty, answerable for everything that happens to your data: J-Action.

We rely on technology suppliers for the database and storage, for domains and hosting of websites and applications, for processing with artificial intelligence models, for automated processing runs, and for managing the commercial relationship and project work; they are contractually bound by the same obligations we take on, and the technical annex names them.

Part of the value we build is understanding how the market moves: volumes, seasonality, how product categories perform, pricing dynamics. That picture is built partly from the projects we run, and you are entitled to know how.

Only derived, anonymous values go into it: raw data never goes into it. And there are three limits we do not cross.

• Never below five A statistic is published only where it aggregates at least five distinct companies. Below that, the figure does not exist, because it could be reconstructed.
• Never at a granularity that identifies you No statistics on segments narrow enough to single out one operator, even unnamed. This applies to category, territory and period taken together, not one at a time.
• Never towards those across the table from you No data attributable to you is shared with a competitor, a supplier of yours, or the brand you distribute, in any form or for any commercial purpose.

You can opt out whenever you want, in writing, with no change to the service or the price. And while you are in, you see the picture too: it is something we give you, not something we take.

Retention follows two different rules, because not all data is the same.

Product data, channel metrics and derived values are kept with no preset expiry: they are the material the services run on, and on which they keep improving over time. A year-on-year comparison is worth something precisely because the historical series is not thrown away.

Personal data follows a tighter rule. Operational contacts are kept for the duration of the engagement plus twelve months. End-customer data contained in orders is kept for as long as it serves order management and measurement of the period, and in any case no longer than the terms we set together in the contract. Identifiers used for remarketing audiences follow the life of the audience on the advertising platform, and are cleared when that audience is closed.

At any point you can ask us to return your data in a readable format, or to delete it: we do so within thirty days and confirm in writing.

Deleting personal data is your right, not a concession on our part. European law lets you ask, at any time, for the portion of data relating to identifiable people to be deleted. You do not have to give a reason, it does not go through a renegotiation of the contract, and it does not interrupt the service on everything else.

When an engagement ends, access is closed first. You should not have to remind us.

There is one obligation that stays with you, and it is fair to know it before we start: from the moment we process data on your behalf, your own privacy notice has to state that data is also processed by us, with our company details. You owe it to your users and customers, not to us.

There is a second point if we work on remarketing: the legal basis for using your customers' data for marketing stays with you. That means the consent collected on your site — the cookie banner and the boxes in your order forms — has to cover that use. We process the data on your instruction; you are the one who has to be able to demonstrate it.

We do not leave you to it: we give you the wording for the notice and the company details to insert, and we tell you what the consent has to say for the campaigns to be compliant.

If a breach affects your data, you hear it from us rather than noticing it yourself: within twenty-four hours of our becoming aware, with what we know at that moment and what we are doing about it. We would rather send an incomplete notice on time than a complete one late.

J-Action LLC is a United States company, based in California. We say so plainly because it changes two concrete things for a European client: processing also takes place outside the European Union, and transfers of personal data are covered by the European Commission's standard contractual clauses, which we attach to the contract.

Where we process personal data on your behalf, you are the controller and we act as processor; the relationship is governed by the agreement in the technical annex, signable before work starts. For most of our projects, however, the data we need is not personal data at all: it is product and channel figures.

For any request — a copy, a deletion, a clarification, opting out of aggregate statistics — write to info@eurekago.it. We respond within thirty days.