Information notice on the processing of personal data (GDPR and nFADP)
Welcome to the NordOvest Informatica website. Information security and privacy protection are the core foundation of our activity as a Managed Security Service Provider (MSSP). This privacy policy, drafted pursuant to Regulation (EU) 2016/679 (GDPR) and the new Swiss Federal Act on Data Protection (nFADP), describes how the site is managed with regard to the processing of the personal data of users who visit it and interact with our web services.
1. Type of data processed. During navigation and interaction with our site, we exclusively collect the data strictly necessary for the provision of the requested services and the maintenance of IT security. Navigation data and system logs: the computer systems responsible for the operation of this site acquire some data whose transmission is implicit in the use of Internet protocols. These include IP addresses (kept for a maximum of 30 days for the exclusive purpose of security monitoring and DDoS attack prevention) and parameters related to the user's operating system. Data voluntarily provided by the user: by filling out the contact form, the user voluntarily provides data such as Name, Company, Email, and the content of the Message. The explicit sending of such communications entails the acquisition of the data necessary to respond to the requests.
2. Purposes and Legal Basis of Processing. The collected data are processed for the following purposes: management of requests (Contact form) to provide answers to requests for quotes, consulting, or information (legal basis: execution of pre-contractual measures adopted at the request of the data subject ex Art. 6 lit. b GDPR); infrastructure security to ensure the security of networks and information, preventing fraud or cyber attacks (legal basis: legitimate interest of the Data Controller ex Art. 6 lit. f GDPR).
3. Interaction with Artificial Intelligence Systems (AI Act Compliance). Our site provides a virtual assistant (Chatbot) based on Artificial Intelligence to provide quick first-level answers. In full compliance with the European Artificial Intelligence Act (AI Act) and the principles of Privacy by Design, the user is transparently informed that they are interacting with an automated system and not with a human operator. The AI infrastructure supporting the website exclusively uses language models from primary providers whose APIs reside on servers located within the European Union (e.g., Mistral EU / Google EU models). Zero Data Retention & No Training: we contractually guarantee that no textual data entered by the user in the chat will ever be used by API providers for the training or fine-tuning of their base models.
4. Data Retention. In compliance with the principle of data minimization, data are kept for the time strictly necessary: security logs are overwritten or deleted after 30 days; transcriptions and textual interactions of the virtual assistant (Chatbot) are kept on our secure servers for a maximum period of 60 days for the sole purpose of security monitoring, abuse prevention, and response quality control, after which they are permanently destroyed; requests from the contact form (non-customer users) are kept for a maximum of 24 months from the last contact, in order to guarantee continuity in case of subsequent requests; if the user becomes a Customer, administrative and accounting data will be kept for 10 years in compliance with legal obligations (Civil Code and current tax legislation), extendable in case of legal disputes or outstanding payments until their resolution.
5. Infrastructures, Security and B2B Customer Services. As an MSSP, security is our mandate. The data collected through this website are hosted on Cloud infrastructures (IaaS/PaaS) equipped with the highest standards of encryption in transit and at rest, protected by multi-factor authentication (MFA) and located in the European Union. Regarding the architectural services provided to our B2B Customers (e.g., implementation of corporate Chatbots, log analysis, hosting), we design custom infrastructures ensuring that data reside in the required jurisdictions, in full compliance with the NIS2, GDPR, and nFADP directives: Italy (EU) ACN (National Cybersecurity Agency) qualified infrastructures, ideal for Public Administration; Switzerland (CH) servers in Swiss territory compliant with the nFADP, FINMA-compliant certificates, and Cyber-Safe standards; France and Germany (EU) cloud infrastructures with sovereign SecNumCloud (ANSSI) and BSI C5 certifications; B2B Sovereign AI Solutions with LLMs implemented locally (On-Premise) or on European sovereign clouds, ensuring total segregation of corporate data.
6. Data Transfer. Processing takes place mainly within the EU or in Switzerland (a country recognized as adequate by a specific adequacy decision of the European Commission). If, for exceptional technical reasons, the use of non-EU providers becomes necessary, the transfer will only take place towards entities adhering to the Data Privacy Framework or upon signing Standard Contractual Clauses (SCC).
7. Data Controller and Contacts. The Data Controller of the personal data described in this policy is the sole proprietorship NordOvest Informatica di Luca Tallone, with registered office in via antica Croce 20, Imperia (IM), VAT number 01836810083. For any request concerning privacy, the exercise of one's rights or the early deletion of data, it is possible to contact the email address directly: contatti@nordovestcyber.com.
8. Data Subject Rights. Pursuant to articles 15-22 of the GDPR and the Swiss nFADP, the user has the right to request access to their data, rectification, erasure (right to be forgotten), restriction of processing, or data portability. Without prejudice to any other administrative or judicial remedy, the data subject also has the right to lodge a complaint with the competent Data Protection Authority (in Italy) or the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland.