Notice on the Processing of Personal Data through the Mative Cloud TC - Mobile Application

Last updated 12 November 2026

This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and to Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (the “Privacy Code”). It describes how the personal data of natural persons (the “Data Subject”) who use the Mative Cloud TC - Mobile application, for Android and iOS operating systems (the “App”), is processed. The App gives access to the Mative Cloud TC – Things Connector cloud platform (the “Platform”) of Mative S.r.l. (“Mative”).

This notice covers the App. Processing carried out through the website www.mative.cloud is described in its own privacy notice.

Summary of the processing of location data

• The device's location is detected and transmitted only if the Data Subject has granted the permission to the operating system and has activated, in the App, the feature that uses it. The feature may be deactivated at any time.
• Location data is transmitted only to the Platform. It is not disclosed to advertisers or advertising networks, it is not transferred to third parties, and it is not used for commercial profiling.
• The App does not include behavioural analytics or advertising tools.
• The data controller varies according to who created the Data Subject's account (§ 1).

1. Data controller and roles

The App gives access to the Platform from a mobile device. Depending on how the Data Subject's account was created, processing is carried out under one of the two arrangements below.

a) Account created by an organisation. Where the account was created by a company, a public body or another organisation (the “Organisation”) which provided the Data Subject with the Account ID, the Organisation is the data controller: it determines the purposes and means of the processing and is accountable for it to the Data Subject. Mative acts as data processor under Article 28 GDPR: it makes the Platform available and processes the data solely on the documented instructions of the Organisation. A Data Subject wishing to exercise their rights should contact the Organisation in the first instance; Mative assists the Organisation in responding and, if contacted directly, indicates to the Data Subject the party to be contacted.

b) Subscription entered into directly with Mative (for example to the Drive module, for one's own vehicle). In this case the data controller is Mative S.r.l.

In both cases Mative is the controller of the technical data needed to ensure the security and operation of the Platform (§ 4, letter e).

The controller is identified by reference to the party that provided the Data Subject with the Account ID: where that party is an Organisation, it is the controller; where the Data Subject subscribed to the Drive service independently, the controller is Mative.

Mative S.r.l.

• Registered and operating office: Via San Pio da Pietrelcina 81, 83100 Avellino (AV), Italy
• Tax code / VAT number: 03190070643
• E-mail: info@mative.ai
• Certified e-mail (PEC): mative@pec.cloud
• Telephone: +39 0825 1920080

For any matter relating to the protection of personal data, the contact form may be used, with “Privacy” as the subject, or the contact details above.

2. Processing of location data

The App may use the device's location. This is an optional feature, and it does not activate by itself.

2.1 Cases in which the App detects and transmits the location

a) “Phone as a vehicle” feature. The feature represents the Data Subject's device in the Platform as a vehicle, making its location, route and trips visible in the same way as for a vehicle fitted with a GPS tracker. The App detects the device's location and transmits it to the Platform only if both of the following conditions are met:

1. the Data Subject has granted the App the permission to access location in the operating system settings (Android or iOS);
2. the Data Subject has activated the feature in the App by an explicit action.

If either condition is not met, the App neither detects nor transmits the location. For as long as the feature remains active, the location is detected and transmitted periodically, including when the App is not in the foreground (for example, with the screen off), as this is necessary to record the route during the trip. The operating system notifies the Data Subject that the location is in use. Deactivating the feature in the App, or revoking the permission, stops the detection.

b) Single reading requested by a screen. Some Platform screens displayed in the App (for example, to place a device on a map) include a control that requests the device's location. When the control is activated, the App detects the location once only and passes it to the requesting screen, which stores it in the Platform. If the permission has not yet been granted, the operating system requests it at that moment; if it is denied, the App does not detect the location.

c) No location detection for device search. To set up a new device (Bluetooth and Wi-Fi), some versions of Android require the location permission solely to allow scanning. In that case the App uses the permission only for scanning and does not detect or store the Data Subject's location.

2.2 Location data processed

• geographic coordinates (latitude and longitude);
• the date and time of the reading;
• where supplied by the device, accuracy, speed and direction of travel.

The data is linked to the Data Subject's account and to the vehicle representing their device and therefore constitutes personal data that identifies the Data Subject.

2.3 Purposes

Location data is processed to make visible to the Data Subject, and to whoever manages their account, the position of the device-vehicle, its route, its trips and the related statistics, and to generate the alarms configured in the service. Location data is not used for advertising, marketing or commercial profiling purposes and is not transferred for consideration.

2.4 Destination of and access to location data

• The location is transmitted to the Platform (my.mative.cloud) over an encrypted connection (HTTPS). It does not pass through Google, Apple or other third parties, except the infrastructure providers on which the Platform operates (§ 5).
• Location data may be accessed by: the Data Subject; the party that manages the account, namely the Organisation that created it, within the permissions it has assigned to its users, or Mative in the case of the Drive service; and Mative's authorised personnel, solely for support and maintenance purposes and bound by confidentiality obligations.

2.5 Retention period

Location data is retained for the history retention period set for the service used, which currently ranges from 30 days to three years depending on the service. After that period the data is deleted automatically. The Data Subject may ask what period applies to their service and, at any time, for earlier deletion (§ 11).

2.6 Control by the Data Subject

• Deactivation of the feature in the App: the detection stops.
• Revocation of the permission in the device settings. On Android: Settings → Apps → Mative Cloud TC - Mobile → Permissions → Location → Don't allow. On iPhone: Settings → Privacy & Security → Location Services → Mative Cloud TC - Mobile → Never.
• Request for access to, or deletion of, the location data already stored (§ 11).

Deactivating the feature or denying the permission does not prevent use of the other functions of the App.

2.7 Account managed by an Organisation

The Organisation, as controller, decides whether and how to use the feature within its own service and is required to inform the Data Subject and to comply with the rules applicable to it, including those on the remote monitoring of workers (Article 4 of Italian Law 300/1970) where the users are its employees. Even in that case, the App does not transmit the location without the operating system's permission and without the Data Subject's explicit activation.

3. Other categories of data processed

Sign-in and account. Access is by entering the Account ID, typed or scanned from a QR code. The sign-in page is Mative's, opened in the device's browser: username and password are entered there and are neither displayed nor stored by the App. At the end of sign-in the App receives session codes, which allow it to remain connected and which are kept in an encrypted store on the device. Where the Data Subject activates fingerprint or face unlock, the verification is carried out by the operating system: only the outcome is communicated to the App, not the biometric data.

Data displayed in the App. The App displays the data of the account and of the Platform service: first name, last name, e-mail address and, if provided, telephone number; role and Organisation; and the vehicles, devices, dashboards, alarms and notifications for which the Data Subject is enabled. This data is stored in the Platform; the App displays it and, when a feature is used, updates it.

Push notifications. Where the Data Subject enables them, the App registers in the Platform an identifier of the device for notifications, together with the platform (Android or iOS) and the App's package name. Notifications are delivered through Google's Firebase Cloud Messaging service and, on iPhone, through the operating system's notification service: the text of the notifications passes through these services (§ 5). Notifications may be deactivated in the device settings.

Camera, photos, files and microphone. The camera is used to scan QR codes (for example the Account ID or device codes) and to take photographs where a feature so provides (for example the photograph of the vehicle). Photographs and files are only those selected by the Data Subject and are uploaded to the Platform when sent. The microphone is used only when a screen records a video with sound.

Device setup (Bluetooth and Wi-Fi). To add a new device, the App searches for nearby Bluetooth devices and connects to the one selected, in order to set it up. The name and password of the selected Wi-Fi network are transmitted to the device being set up. Bluetooth is not used to detect the location.

Technical and security data. IP address, date and time of requests, device model and operating system version, sign-in outcomes and errors are recorded by the Platform's servers to ensure the security and operation of the service and to prevent abuse.

Data stored on the device. The App stores locally its settings, the quick-sign-in preferences and a temporary copy of the data displayed. The Platform screens displayed in the App use the device's storage to maintain the session. No cookies or other tools are used to track the Data Subject's behaviour for advertising purposes. Uninstalling the App or clearing its data deletes this local information.

Processing not carried out. The App does not include behavioural analytics tools or third-party advertising systems and does not access the Data Subject's contacts, calendar or messages.

4. Purposes, legal bases and retention period

The App does not use personal data for direct marketing, advertising, commercial profiling or transfer to third parties.

Legitimate-interest balancing. For the purposes in letters e) and g), Mative has weighed its own interest against the Data Subject's rights and concluded that the processing is limited to what is necessary and does not cause disproportionate prejudice. The Data Subject has in any case the right to object under Article 21 GDPR (§ 11).

Nature of the provision of data. To use the App it is necessary to sign in with one's own Account ID. The provision of location data and the granting of permissions for camera, microphone, notifications and Bluetooth are optional: if they are denied, the App remains usable, but without the features that require them.

5. Recipients of personal data

The data is processed by Mative's authorised personnel, duly instructed and bound by confidentiality, and may be disclosed to the following recipients.

All processors are appointed under Article 28 GDPR and are contractually bound to process the data solely on the controller's instructions, applying appropriate technical and organisational measures.

Location data is not disclosed to Google, Apple or other third parties: it is transmitted solely to the Platform, hosted by the infrastructure providers indicated above. Personal data is in no case disseminated or sold and is not transferred to third parties for their own marketing purposes.

6. Transfers of data to third countries

Location data and account data are processed in the European Union. The only possible transfer outside the European Economic Area concerns push notifications (Google, § 5) and is carried out with the Chapter V GDPR safeguards indicated in the table. A copy of the safeguards adopted may be requested using the contact details in § 1.

7. Permissions requested by the App

All permissions are optional and may be changed at any time in the device settings.

8. Security measures

Mative applies technical and organisational measures appropriate under Article 32 GDPR, including:

• encryption of the connection between the App and the Platform (https://my.mative.cloud);
• storage of session codes in an encrypted store on the device, with biometric unlock handled by the operating system;
• role-based access control, under which each user accesses only the data permitted by their role;
• automatic deletion of location data when the retention period expires (§ 2.5).

9. Minors

The App is addressed to professionals, businesses, public bodies and those who use the Drive service for their own vehicle, and is not intended for persons under eighteen years of age. Mative does not knowingly collect personal data from minors. A holder of parental responsibility who believes that a minor has provided their data may report this through the contact form, and the data will be deleted without delay.

10. Automated decision-making and profiling

Pursuant to Article 13(2)(f) GDPR, Mative does not carry out solely automated decision-making that produces legal effects concerning the Data Subject or similarly significantly affects them (Article 22 GDPR) and does not carry out profiling for marketing purposes.

The Platform may make available to whoever manages the account statistics on trips, such as kilometres driven. Where an Organisation uses such data for assessments of the use of the vehicle, the relevant decision, and the related information to the Data Subject, are the responsibility of the Organisation as controller.

11. Rights of the Data Subject

The Data Subject has the right to:

• access their personal data and obtain a copy of it (Art. 15);
• obtain rectification of inaccurate data or completion of incomplete data (Art. 16);
• obtain erasure of the data, in the cases provided for, including location data (Art. 17);
• obtain restriction of processing (Art. 18);
• receive their data in a structured format and obtain its portability (Art. 20);
• withdraw consent at any time, by deactivating the feature in the App or revoking the permission in the operating system, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3));
• object to processing based on legitimate interest, on grounds relating to their particular situation (Art. 21).

For the exercise of these rights, § 1 applies: where the controller is an Organisation, the request is addressed to it; where the controller is Mative, to Mative. To have the account and the data linked to it deleted, including location data, a request to the controller is sufficient. A response is given within one month of receipt of the request; that period may be extended by two further months, taking into account the complexity and number of requests, with reasoned notice given to the Data Subject within the first month (Article 12(3) GDPR). Exercising these rights is free of charge, save in the case of manifestly unfounded or excessive requests.

12. Complaint to the supervisory authority

A Data Subject who considers that the processing of their personal data infringes applicable law has the right to lodge a complaint with the Italian supervisory authority:

Garante per la protezione dei dati personali Piazza Venezia 11 — 00187 Rome, Italy www.garanteprivacy.it — protocollo@pec.gpdp.it

without prejudice to the right to an effective judicial remedy (Articles 77 and 79 GDPR).

13. Changes to this notice

Mative reserves the right to update this notice to reflect legislative changes or the evolution of the App's features. The version in force is always published on this page, with the date of the last update. Where the location data collected by the App or the way in which it is used changes, or where changes materially affect processing based on consent, this will be highlighted and, where necessary, consent will be requested again.