Privacy Policy

Notice given under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

1. Controller

The controller is Archiva Group (the “Controller”), which operates the Perlegis service. The Controller's contact details and, where appointed, those of the Data Protection Officer are published on the Controller's official channels and reachable at [email protected].

2. Categories of data processed

• identification and contact data (name, email address);
• credentials and authentication data, handled by a self-hosted authentication service on the Controller's own infrastructure;
• service usage data: calendar events, deadlines, matters, shares, preferences and backups;
• documents and attachments uploaded to the archive or to the assistant, together with the text extracted from them (including by optical character recognition);
• the content of tasks handed to the assistant and of its replies, including any voice dictation;
• notification identifiers (push tokens) for the devices on which alerts are enabled;
• billing data and subscription status;
• technical metadata (IP address, user agent, timestamp) processed for security and audit purposes.

3. Purposes and legal bases

• performance of the contract and provision of the service (Art. 6.1.b GDPR);
• legal, accounting and tax obligations (Art. 6.1.c GDPR);
• platform security, abuse prevention and protection of rights (Art. 6.1.f GDPR);
• operation of the assisted features — extracting data from uploaded filings and preparing the assistant's proposals — as part of the service requested (Art. 6.1.b GDPR);
• commercial communications, only where an appropriate legal basis exists.

4. How data is processed

Processing uses electronic tools and organisational measures suited to ensuring confidentiality, integrity and availability. Data is encrypted in transit and at rest, and isolation between users is enforced at the database layer, not only in the application.

5. Retention

Data is kept for as long as necessary for the purposes stated and in line with legal obligations. Periods may vary with the user's requests, tax obligations and the need to establish or defend a legal claim. On account closure data is deleted or returned at the user's request.

6. Recipients and processors

Data may be processed by suppliers appointed as processors, including:

• the infrastructure provider hosting the servers, located in the European Union;
• the network and edge protection provider;
• the payment services provider, for subscription management;
• the artificial intelligence provider that processes the text, documents and audio sent to the assistant, established in the United States of America.

Service email is sent through a relay operated directly by the Controller. Text extraction from uploaded documents, optical character recognition included, also runs on the Controller's own infrastructure, with no third-party supplier.

7. Transfers outside the EU

The servers hosting the service, the backups and the document archive are located in the European Union. The exception is the artificial intelligence provider named in section 6: text, documents and audio sent to the assistant are transmitted to the United States of America solely to produce the reply. For that transfer the Controller applies the safeguards required by Chapter V GDPR, including Standard Contractual Clauses, and has agreed terms with the provider that exclude use of the content for model training.

8. Data subject rights

Data subjects may exercise the rights under Articles 15-22 GDPR: access, rectification, erasure, restriction, objection, portability and withdrawal of consent where applicable. A complaint may also be lodged with the Italian Data Protection Authority.

9. Whether provision is required

Providing the data needed to operate the service is required to conclude and perform the contract; refusal makes provision of the service impossible.

10. Automated decision-making

No decisions are taken solely on the basis of automated processing producing legal effects for the data subject. Automatic computation of procedural deadlines is a support tool: the proposed dates require the practitioner's verification, and the practitioner remains solely responsible for meeting the terms. The same applies to the assistant's proposals and to data extracted from uploaded filings: they stay proposals until the practitioner confirms them, and produce no effect on their own.

11. Updates

This notice may be updated over time. The version in force is always available on the site's legal pages.