Read together with the other Legal Centre documents and the signed order. For relationships governed by Italian law, the Italian version prevails over the bilingual version unless otherwise agreed.
1. Controller, contacts and privacy roles
For registration, contractual relationship, security, invoicing, UESE marketing and service management data, the controller is UESE ITALIA S.p.A., with registered office at Piazza Trivulziana 4/A, 20126 Milan (MI), Italy, VAT and tax code IT04398760274, REA MI 2679515. Privacy requests may be sent to info@uese.eu or other published contacts.
For personal data uploaded by the Customer into projects, the Customer normally acts as controller and UESE as processor under Article 28 GDPR and the DPA. In some cases the parties may act as independent controllers for their own purposes, such as security, fraud prevention and legal obligations.
2. Scope and data sources
This Notice covers visitors, users, company administrators, consultants, business contacts and individuals whose data appears in uploaded documents. Data is collected directly, from authorised administrators, from Customer-specified sources (such as a company website), from uploaded or generated documents, and automatically through technical logs.
Where the Customer provides third-party data, it must give them required information and ensure a valid legal basis. UESE does not use public sources for indiscriminate enrichment: analysis is initiated on user instruction and limited to the project.
3. Categories of personal data
- identity, professional and contact data;
- corporate, tax, contractual and billing data;
- hashed credentials, 2FA, roles and permissions;
- chat content, prompts, feedback, revisions and approvals;
- uploaded files and extracted data, potentially concerning employees, customers, suppliers or directors;
- technical data: IP, user agent, sessions, security events, audit logs and metadata;
- language preferences, plan, usage and support requests.
Special-category or criminal-conviction data should not be uploaded unless strictly necessary, supported by a legal basis, appropriate safeguards and organisational authorisation.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Registration, trial, authentication, SaaS delivery and support | Contract or pre-contractual steps |
| Invoicing, accounting and compliance | Contract and legal obligation |
| Security, abuse prevention, audit and legal defence | Legitimate interests and security obligations |
| Service notices and contractual changes | Contract and legitimate interests |
| Direct marketing to customers for similar services where allowed | Legitimate interests with opt-out, or consent |
| Document analysis and AI on Customer instruction | Article 28 GDPR and documented controller instructions |
5. Document processing and artificial intelligence
To generate analyses and drafts, ISOPILOT may transmit relevant portions of Inputs to authorised AI model providers. Configuration is designed to minimise transmitted data, segregate tenants and use business/API services. Content must not be used for independent purposes incompatible with contractual instructions.
The Customer must select appropriate data, remove unnecessary elements and assess whether anonymisation or pseudonymisation is required. Outputs are retained in the project for versioning, continuity and audit until deletion or expiry under applicable rules.
6. Recipients, authorised personnel and subprocessors
Data may be processed by authorised UESE personnel, Customer administrators, and hosting, email, support, security, backup, invoicing and AI service providers. Providers receive only necessary data and are bound by contracts, confidentiality and security measures.
The current list of relevant subprocessors is available on request or in the contractual area. Specific infrastructure may depend on the configured hosting environment. Data may also be disclosed to authorities, advisers or counterparties where required by law or necessary to defend rights.
7. International transfers
Some providers may process data outside the European Economic Area. In that case UESE relies on a valid mechanism such as an adequacy decision, the Data Privacy Framework where applicable, standard contractual clauses and risk-based supplementary measures. The Customer may request information on relevant safeguards.
8. Retention and deletion
- account and contract: relationship term plus the period required for compliance and legal defence;
- tax data and invoices: statutory retention periods;
- security and audit logs: risk-proportionate period, normally 6 to 24 months unless an incident occurs;
- sales leads: up to 24 months or earlier objection;
- project content: account term plus the Plan/DPA export and deletion window;
- backups: technical rotation with progressive overwrite.
Deletion may be deferred for legal obligations, disputes, security or immediate technical impossibility in backups, with isolation and restricted access.
9. Data subject rights
Where applicable, individuals may request access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and may complain to the Italian Data Protection Authority or competent supervisory authority. Requests may be subject to identity verification.
Where UESE processes data on behalf of the Customer, it forwards or assists with the request under the DPA; individuals should first contact the organisation that uploaded the data.
10. Security measures and breaches
Measures include, according to configuration and risk, logical multi-tenant segregation, role-based permissions, hashed passwords, 2FA, TLS, secret encryption, private storage, logging, backups, updates, vulnerability management and response procedures. No system can guarantee zero risk.
Breaches are assessed and managed according to privacy roles: where UESE is processor, it informs the Customer without undue delay after becoming reasonably aware and provides available information for Articles 33 and 34 GDPR obligations.
11. Automated decisions, children and updates
ISOPILOT is not intended for solely automated decisions producing legal effects on individuals. AI features support drafting and require human oversight. The B2B service is not directed to children; children’s data should be uploaded only where indispensable and appropriately protected.
This Notice may be updated. Material changes will be notified in-account or by email. The framework includes GDPR, the Italian Privacy Code and applicable legislation and guidance.
12. Trust Center, certifications and verification links
The Trust Center may publish professional and documentary information intended for disclosure, such as issuing body, certificate number, scope, dates and verification links. Where a certificate contains personal data, publication is limited to what is necessary for transparency, trust and demonstration of the operator’s credentials.