1. Legal bases for the processing of personal data

Siigo processes personal data in the context of the development, operation and maintenance of B2B digital platforms.

For each processing purpose, a specific legal basis pursuant to Article 6 GDPR has been identified, documented in the Record of Processing Activities and duly communicated to data subjects through privacy notices.

1.1 User account creation and management

Purpose: Creation, authentication and management of user accounts within the platforms.

Categories of data: Identification and professional data, (e.g. name, surname, business email address, role).

The processing is strictly necessary to allow access to and use of the contractually agreed services.

1.2 Authorization workflows and operational processes

Purpose: Management of requests, approvals, validations and tracking of operational activities within the platform.

Categories of data: Identification data, role-related data and process logs.

The processing is essential for the provision of the requested service and limited to what is necessary for the proper functioning of the workflows.

1.3 Audit, security and operational continuity

Purpose:

• Access monitoring
• Prevention of unauthorized access
• Security incident management
• Technical and compliance audits

Categories of data: Access logs, technical identifiers, timestamps and security-related information.

The legitimate interest consists in ensuring platform security, data protection and accountability. A Legitimate Interest Assessment (LIA) has been conducted to balance this interest against the rights and freedoms of data subjects.

1.4 Exclusion of marketing-related processing

Siigo does not process personal data for marketing, profiling or promotional communication purposes.

Therefore, consent is not used as a legal basis for the processing activities described above.