Privacy Policy

General information pursuant to art. 13 Reg. 679/2016 EU
Under the terms of art. 13 of Regulation 679/2016 EU and the current legislation in Italy regarding the processing of personal data, we inform you of the following.
‍
a1) Data Controller and Contact Information
The Data Controller of the data collected, provided and/or obtained during navigation on this site is INDIGO AI S.r.l., located at Piazza Vetra 17, 20123, Milan (MI), Italy, email: admin@ndg.ai, PEC: indigoai@legalmail.it.
a2) Data Protection Officer (DPO)
The Data Protection Officer (DPO) appointed under art. 37 regulation 679 2016 EU is lawyer Aldo Benato from Castelfranco Veneto (TV), who can be contacted via PEC at aldobenato@pec.it
b) Personal Data Processed and Purpose of Processing
Only and exclusively the following data will be processed:
b1. Technical cookies, in case of mere consultation of the site;
b2. Email, in case of request for newsletter subscription;
b3. All data necessary for the identification of the subject and payment, and voluntarily provided by them, in case of purchase of products or activation of services, also in demo format.
b4. The site, with prior consent, also processes analytical and profiling cookies. Please refer to the specific Cookie Policy for more specific information on this.

Please note that cookies are small text files that the sites visited by the user send and record on his computer or mobile device, to be then transmitted back to the same sites on the next visit. Technical cookies, in particular, are those strictly necessary to ensure the operation of the site, remembering, for example, the user's actions and preferences when selecting the language or purchasing a product. - Manage the purchase of resources, materials and products available on the site.

5) Legal basis for processing
The legal basis for processing your data is:
- regulatory, concerning technical cookies;
- consensual, concerning data processed for sending the newsletter;
- contractual, in case of data processing necessary for the purchase of a product or service. The personal data collected during navigation on our website will be processed exclusively for the purpose of:
- allowing access and navigation of the site;
- allowing subscription to the newsletter;
- managing the purchase of resources, materials and products available on the site.

c) Purpose and Legal Basis of Processing
The purposes of processing the aforementioned personal data and their respective legal bases can be identified as follows:
- Technical cookies are processed to allow access, use and navigation of the site (purpose), and the legal basis legitimizing their processing is of a regulatory nature (regulatory legal basis);
- Analytical and profiling cookies are processed to allow the improvement of the web platform used by Indigo.ai to offer its services and to study user behavior in order to improve the browsing experience (purpose); their processing is based on consent, freely expressed by the user at the time of first access to the site through the appropriate Cookie banner and can be modified at any time by the user himself through the appropriate procedure for changing preferences contained in the Cookie Policy;
- The email address for subscribing to the newsletter is processed to allow subscription to the newsletter service managed by Indigo.ai (purpose) and the legal basis legitimizing its processing is the user's consent expressed by activating the appropriate checkbox (consensual legal basis); it is reminded that consent to the sending of the newsletter can be revoked at any time either by using the appropriate "opt-out" button provided at the bottom of each newsletter, or by contacting Indigo.ai at the above mentioned contacts;
- The data necessary for the purchase of a product or a service, also in "Demo" mode, are processed in order to allow the User to use a service or a product of Indigo.ai (purpose) and, therefore, the legal basis legitimizing their processing is contractual in nature (contractual legal basis) for all the information strictly necessary for the provision of the service, and consensual in nature (consensual legal basis) for any additional personal information not strictly necessary and that the user has in any case made available to Indigo.ai. In the event that a data processing based on consent is initiated, the right to revoke consent at any time remains unchanged, without however affecting the lawfulness of the processing based on the consent given before the revocation.

d) Legitimate interest of the Data Controller
The processing of your data may also occur due to the legitimate interest of the Data Controller. Specifically, this may happen for purposes related to company security, network and data security, and communications following the termination of the contract in accordance with art. 130 co. 4 D.lgs. 196/2003. In the event that data processing occurs due to the legitimate interest of the Data Controller, the processing will not be implemented before adequately evaluating the potential prevalence of interests or fundamental rights and freedoms of the concerned party that require the protection of personal data. In any case, your right to object to data processing based on legitimate interest remains. You can exercise this right by writing to: admin@ndg.ai.

e) Recipients of personal data
Your personal data will only be communicated to:
- all subjects authorized for processing by the Data Controller as per art. 29 par. 4 GDPR due to their inclusion in the company staff and the existence of a subordinate relationship;
- any subjects appointed by Indigo.ai as external managers as per art. 28 GDPR and who are systematically involved in the processing of employee data;
- subjects to whom the right to access such data is recognized by virtue of general regulatory provisions in force or specific lawful measures of a public authority.
The complete list of external managers is held by the company. In no case will there be any dissemination of such data.

f) Transfer of data to third countries
Your personal data is not transferred to Third Countries, or to countries outside the European Economic Area (EEA). If access to your data were allowed by the aforementioned countries, the strictest logistical-information security measures would be adopted to prevent and hinder the risk of access to them by unauthorized subjects or for purposes different from those referred to in the previous point b). In any case, no data processing is carried out by subjects belonging to Third Countries without prior control and compliance with the rules referred to in articles 44 and following GDPR.

g) Data Retention Period
The data you provide will be processed for the time strictly necessary to achieve the purposes mentioned above and will then be stored for the time strictly necessary as provided by the current legislation relating to the individual categories of personal data. In particular:
- Technical cookies will be processed and stored for the duration of the browsing session only;
- Analytical cookies will be stored in accordance with the processing duration provided by each provider, as highlighted in the cookie policy;
- The email address for newsletter subscription will be processed only for the duration of the subscription and subsequently stored, for protection purposes, for 5 years;
- The data collected and processed for the purchase of a product or service or for the performance of a "Demo" will be processed for the duration of the contract and subsequently stored for 5 years.
The duration of data storage may be extended in case of disputes from the User or the Customer, both judicial and extrajudicial. In case of extrajudicial disputes, no personal data processed will be stored beyond the maximum limit of 10 years from the withdrawal of consent or the termination of the contract/service.

h) Rights of the Data Subject
As data subjects, you have the right to exercise all the rights provided by articles 12 and following of the GDPR against the Data Controller. In particular, you may request information about your data, access to it, its rectification, deletion, restriction of processing, or you may object to its processing. You also have the right to data portability. To exercise these rights, you can send a specific request to the Data Controller or to the possible DPO using the contacts indicated above.

i) Right to withdraw consent
Your personal data has been collected in a pre-contractual and contractual context aimed at fulfilling obligations towards the data subject based on the existing employment relationship, as well as legal obligations, rules and regulations in force. Therefore, as a rule, no further data processing based on the data subject's consent is envisaged, and consequently, there is, as a rule, no consent to which you can exercise the right of withdrawal. However, if further processing were carried out on a consensual legal basis, not only would you have the right to refuse to give consent, but, in the event of giving the same, you would retain the right to withdraw it at any time.

l) Right to complain
You have the right to lodge a complaint against the processing or the methods of processing your data with the Guarantor for the protection of personal data, based in Rome, or before the competent judicial authorities.

m) Data Obligation
The processing of technical cookies is mandatory, as it is necessary for the operation of the website. The processing of data based on consent is optional. The provision of your data in the pre-contractual and contractual phase in relation to the purchase of a product, a service or a Demo, must be considered mandatory as it is necessary for the establishment and performance of the service. In case of failure to provide the data, it will not be possible to start or continue the service.

n) Automated decision-making processes
The Data Controller does not carry out any data processing based on automated decision-making processes.