Privacy Policy issued on 30 September 2026 by N-and Italia Srl pursuant to European Regulation GDPR 2016/679 and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.
The policy on the processing of personal data collected by our Company, as the owner of the CREDÌ application (hereinafter CREDÌ and/or the Application), has been established in compliance with the obligations arising from the relevant European Community legislation (Regulation (EU) 2016/679 of 27 April 2016, known as the G.D.P.R. General Data Protection Regulation – hereinafter GDPR), and with the laws of the individual countries in which CREDÌ will be marketed and distributed. In particular, in Italy, it complies with the data protection legislation set out in Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, and with the decisions of the Italian Data Protection Authority. The Company respects and safeguards the privacy of registered and unregistered users, making every possible and proportionate effort to protect their data in accordance with the purposes and principles set out in this Privacy Notice and in the Terms of Use, also referred to as the Terms of Service.
Use of Credì is restricted to persons who are at least 14 years of age, pursuant to Article 2-quinquies of Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.
The Company reserves the right to carry out spot checks, on its own initiative and/or in response to specific reports, regarding the age of its users and in the event of breaches of the Terms of Service.
1. Data Controller
N-and Italia Srl, via delle Gere 15, 24024 Pognano (BG) – Italy – is the Data Controller for the data collected through the “CREDÌ” application. The Company owns Credì and manages its development, publication and updates on the application stores listed below:
- Google Play;
- App Store.
Requests for information and/or clarification regarding processing, storage arrangements, rectification and erasure, as well as requests for data portability, may be made without any specific formalities by sending an email to the following address: dpo@n-anditalia.com.
2. Processing activities and purposes
N-and Italia Srl (hereinafter also referred to for brevity as N-and) wishes to inform you that the personal data you enter when registering with CREDÌ will be collected and processed for the following purposes:
- to provide the payment service for the sale of products available in vending machines and any other functionality related to that service: by way of example and without limitation, communicating information of any kind about the products available in the machines used by the user; handling requests for information or assistance initiated by service users, such as checking a credit balance or the availability and price of a product; and providing information, including commercial and promotional information, about products in the specific machines visited by users, made available in the public and/or restricted sections of CREDÌ, including, where necessary or envisaged, in cooperation with the companies operating the vending service in the area;
- to send informational and promotional communications, including commercial communications, advertising material and/or offers of goods and/or services, by any means (known or otherwise), by the Company and, subject to obtaining appropriate consent, by third-party companies operating in the area that supply the vending machines at the location where the user uses the application;
- subject to obtaining appropriate consent, where required by applicable law, to prepare and carry out statistical and market studies and research, to analyse tastes, preferences, habits, needs and consumption choices, and to assess the level of satisfaction with the quality of the products and services offered by the Company.
Users will be asked to give their consent to processing where required by the provisions of the GDPR. Withholding consent for the purposes referred to in points (b) and (c) does not affect the ability to use the service referred to in point (a).
For the purposes indicated, personal data will be processed using appropriate paper-based and/or electronic tools, in a manner strictly related to those purposes and, in all cases, capable of ensuring the security and confidentiality of the data.
The processing activities described above involve automated decision-making processes carried out through an IT system that enables user profiling activities.
The consequences of such processing consist of receiving targeted commercial communications prepared on the basis of the user's previous choices when using Credì.
3. Legal basis for processing
Processing is carried out on the basis of a legitimate interest, as there is a relevant and appropriate relationship between the Data Subject and the Data Controller, justified by the user's registration specifically for the purpose of using CREDÌ's services.
4. Provision of data
The provision of personal data is optional. Refusal to provide data, or the provision of inaccurate and/or incomplete information, may make it impossible to:
- provide the payment service for the sale of products through CREDÌ at enabled vending machines;
- send informational and promotional communications, including commercial communications, advertising material and/or offers of goods and services, by any means (subject to consent);
- prepare and carry out statistical and market studies and research, analyse tastes, preferences, habits, needs and consumption choices, and assess the level of satisfaction with the quality of the products and services offered by the Company.
The activities referred to below may only be carried out after obtaining express, freely given and specific consent for each processing purpose.
5. Disclosure of data and scope of dissemination
Data may be disclosed to the following categories of parties engaged by the Company to perform certain activities necessary for the provision of the service:
- any parties providing the Company with services that support the purposes indicated above;
- companies that own and/or operate vending machines;
- suppliers, contractors, subcontractors, banking and/or insurance institutions or, more generally, other parties and/or entities that carry out (on behalf of the Company or independently) the activities referred to in paragraph 2 above, or activities related or ancillary to them;
- consultants assisting the Company in various capacities, particularly in relation to legal, tax, social security, accounting and organisational matters;
- any other party to whom data must be disclosed pursuant to an express legal provision.
6. Disclosure and transfer of data
Subject to obtaining the Data Subject's express consent, data may be disclosed and transferred to third-party companies that directly provide product dispensing services through vending machines in the area, for the same processing purposes stated in this Privacy Notice. The list of such companies and their respective Data Processors is continually updated and can be obtained by sending an email to crediapp@n-and.com.
7. Transfer of users' Personal Data outside the EU
Personal Data may be transferred outside the European Union to countries where there will be vending machines at which CREDÌ can be used. An up-to-date list of non-European countries to which data may be transferred can be requested by sending an email to crediapp@n-and.com.
8. Duration of processing and data retention
Data will be retained for the time necessary to fulfil the purposes set out above, in compliance with statutory time limits, for the period required for tax, accounting and administrative purposes and to document our activities, as well as to meet your data recovery needs. In any event, the Data Controller will process Personal Data for no longer than is necessary to achieve the purposes for which the personal data are processed, or for a longer period for purposes permitted by law, and the data will in all cases be erased without undue delay.
9. Rights of the Data Subject
Under the GDPR, the Data Subject has the right:
- to access personal data;
- to obtain rectification or erasure of personal data or restriction of processing concerning them;
- to object to the processing of their data;
- to data portability;
- to withdraw consent (the information to be provided to the Data Subject about the right to withdraw consent clearly cannot concern cases in which processing is, for example, necessary for compliance with a legal obligation to which the Data Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller);
- to lodge a complaint with the supervisory authority (the Data Protection Authority of the relevant country).
10. Data Protection Officer (DPO)
We hereby inform you that the Company has appointed a Data Protection Officer, also referred to in Italian as the Responsabile della Protezione dei Dati personali (RPD). Email: dpo@n-anditalia.com.
Any concerns may be reported to the DPO by email or by post, addressing the request to the Company at its address, for the attention of the DPO.
11. Exercise of the Data Subject's rights
N-and and/or any third-party companies to which the Data Subject's data have been lawfully transferred will cease processing without delay upon receiving a request from the Data Subject to withdraw previously given consent. Such withdrawal may also relate solely to profiling activities (paragraph 2(c)), while keeping the service active. These rights may be exercised by sending an email to crediapp@n-and.com or by writing to N-and Italia Srl, Via delle Gere 15, 24024 Pognano (BG), Italy, or to one of the companies to which the Data Subject's data have been transferred with their prior express consent.
12. Final provisions – minimum age for using the application
As Credì is an APP primarily used to purchase soft drinks, coffee, water and packaged products that are not prohibited for minors, it may also be used by persons under 16 years of age (the age specified in the GDPR as the minimum age where individual countries have not enacted national legislation lowering that age, which may in no case be below 13), provided that users are at least 14 years old in Italy, 15 in France and 13 in Spain. Each country has, under the discretion granted by the GDPR, chosen the minimum age at which its citizens may register for digital services within its territory. Article 8 of the GDPR – Conditions applicable to child's consent in relation to information society services – is reproduced in full below.
- Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
- The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.
- Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.
Requests for consent
Shown for completeness, but managed in-app.
Having read the Privacy Notice above, I expressly consent to the processing of my personal data in the manner indicated above and for the following purposes:
- to send informational and promotional communications, including commercial communications, advertising material and/or offers of goods and/or services, by any means (known or otherwise), except for content made available within the CREDÌ application.
I consent [ ] I do not consent [ ]
- to prepare and carry out statistical and market studies and research, to analyse tastes, preferences, habits, needs and consumption choices for profiling purposes in order to provide a better service to users registered with CREDÌ, and to assess the level of satisfaction with the quality of the products and services offered;
I consent [ ] I do not consent [ ]
- for the disclosure/transfer of data to third-party companies, as well as by natural or legal persons contractually linked to the Company and/or otherwise cooperating in commercial activities, for the sending of their informational and promotional communications, including commercial communications, advertising material and/or offers of goods and/or services, by any means known or otherwise, except for content made available within CREDÌ.
I consent [ ] I do not consent [ ]
Last updated on 30 September 2026 (previous versions archived).