Privacy notice on the processing of personal data.

1. Data controller

The data controller is EQUA S.r.l., with registered office in Viale Carmelo Bene 320, 00139 Roma (RM), VAT no. 18490391002. For any request relating to data processing you can write to info@gruppoequa.it (certified email: societaequa@legalmail.it).

2. Types of data processed

Depending on how you interact with the site and our services, we process:

• Registration and account data: name, email address, any phone number and profile data you choose to provide.
• Contact data: the data entered in forms (e.g. requests for information, call bookings), including the content of your message.
• Documents uploaded for analysis: contracts, deeds, tax bills and documents you voluntarily upload to obtain the technical report. They may contain personal data and, in some cases, financial information concerning you.
• Payment data: purchases are handled by the payment provider Stripe; we do not process or store your full card details, which are handled directly by Stripe.
• Browsing and technical data: IP address, browser/device type, language, time zone, pages visited and data collected via cookies and similar technologies (see the Cookie Policy).
• Special categories of data (health data): in the Legge 3 (over-indebtedness) pre-assessment questionnaire you may optionally provide information about your health or that of your household members (e.g. illnesses, disabilities or recognitions under Italian Law 104, medical expenses), including in the free-text narrative. This data belongs to the special categories referred to in Art. 9 GDPR and is processed only if you provide it voluntarily.

3. Purposes and legal bases

• Provision of the requested services (registration, document analysis, purchases, support) — legal basis: performance of a contract or pre-contractual measures (Art. 6.1.b GDPR).
• Responding to contact requests — legal basis: performance of pre-contractual measures and legitimate interest in replying to you (Art. 6.1.b/f GDPR).
• Legal obligations (tax, accounting, anti-money-laundering where applicable) — legal basis: legal obligation (Art. 6.1.c GDPR).
• Analytics and marketing cookies and sending promotional communications — legal basis: your consent (Art. 6.1.a GDPR), revocable at any time.
• Security, abuse prevention and legal defence — legal basis: the controller's legitimate interest (Art. 6.1.f GDPR).
• Preliminary assessment of your situation through the Legge 3 questionnaire, where it includes health data — legal basis: your explicit consent (Art. 9.2.a GDPR), collected before the questionnaire is submitted and revocable at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. How data is processed

Data is processed using electronic tools, adopting technical and organisational measures suitable to ensure its security, integrity and confidentiality, and is accessible only to authorised personnel and the appointed data processors. Documents uploaded for analysis are used exclusively to produce the requested report.

5. Recipients and data processors

Data may be disclosed to parties carrying out ancillary activities on our behalf, appointed as data processors, including:

• Google / Firebase — hosting, database, authentication and cloud infrastructure;
• Google Cloud (Vertex AI – Gemini models) — automated processing of uploaded documents and free text for the analysis (see section 6);
• Stripe — payment handling;
• Brevo (Sendinblue) — sending transactional emails;
• consultants, professionals and authorities, within the limits set by law.

Some providers may process data outside the European Economic Area: in that case the transfer takes place in compliance with Art. 44 et seq. of the GDPR (e.g. standard contractual clauses).

6. Processing by a third-party artificial intelligence provider

To produce some analyses we use the Gemini artificial intelligence models, provided by Google through the Google Cloud platform, acting as data processor. In particular, the following is sent to the provider:

• Documents uploaded for analysis (e.g. mortgage or loan agreements, revolving credit card statements, tax bills, enforcement deeds): the content of the files is processed to extract the data and draft the report;
• Legge 3 questionnaire: your answers to the questionnaire, including any health information, and the free text you write (the account of your situation and the items you add manually), in order to interpret it and link it to your answers. Your first name, surname, email address, phone number and the names of your family members are not sent.

Our processing functions are hosted in the Google Cloud European region (europe-west1, Belgium); the model service, however, may also process data in data centres located outside the European Economic Area, including the United States. In that case the transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, to which Google LLC adheres, and/or on the standard contractual clauses approved by the European Commission (Art. 45 and 46 GDPR) included in Google Cloud's data processing terms.

Under the contractual terms of the paid service we use, Google does not use the data sent or the responses generated to train or improve its models, and processes them only to provide the service (and, within the limits of its terms, for security and abuse-prevention purposes). Analysis results are stored in your account as set out in section 7. You may withdraw your consent and request erasure of the data at any time, as set out in section 8.

7. Retention period

Data is retained for as long as necessary for the purposes for which it was collected and, thereafter, for the periods imposed by legal obligations (e.g. accounting and tax documents for 10 years). Data processed on the basis of consent is retained until that consent is withdrawn.

8. Your rights

As a data subject you may exercise at any time the rights set out in Art. 15-22 of the GDPR: access, rectification, erasure, restriction, portability, objection to processing and withdrawal of consent (without affecting the lawfulness of processing based on consent given before withdrawal). To exercise them, write to info@gruppoequa.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

9. Nature of the provision of data

Providing the data necessary for the delivery of the services is optional, but refusal may make it impossible to provide the requested service.

10. Automated decision-making

Document analysis uses automated processing systems to produce a technical report. The result is informative and supportive in nature and does not replace the assessment of a qualified professional on the specific case.

11. Changes

The controller may update this notice; the current version is always published on this page with the relevant update date.