Information on the Processing of Personal Data Related to the Use of the Chatbot
This notice supplements the website privacy policy and explains how the Controller processes data related to the use of the virtual assistant (the “chatbot”) made available on the website. Users are therefore invited to read the website browsing privacy notice.
Identity and Contact Details of the Data Controller
Samoa S.r.l. (hereinafter also “Samoa” or the “Controller”), with registered office at Via I Maggio 9/11, 31014 Colle Umberto (TV), Italy, may be contacted at info@samoadivani.com, by certified electronic mail (PEC) at pec@pec.samoadivani.com, or by telephone at +39 0438 433428.
Purposes and Legal Bases
- Information assistance service: data entered in the conversation are processed to handle the user request and generate a response based on the website content and the Controller’s knowledge base.
- Improvement of browsing experience and service usability: information strictly necessary to ensure the continuity of the conversation during website navigation is stored in the browser’s session memory. For further information on the tools used, please refer to “Cookie” section.
- Defence of legal claims: the Controller may process personal data where necessary for the establishment, exercise or defence of legal claims in judicial or out-of-court proceedings.
The Controller also performs statistical analyses using only aggregated, non-personal data relating to users who interact with the service, in order to assess usage levels, identify topics of greatest interest, and determine the most frequently accessed or requested sections of the website.
| Purpose | Legal Basis |
|---|---|
| A. | Performance of pre-contractual and/or contractual measures. |
| B. | The Controller’s legitimate interest in ensuring the proper functioning of the tool, supported by the data subject’s request to initiate a chat session. |
| C. | The Controller’s legitimate interest in establishing, exercising or defending a legal right. |
Retention Period
| Purpose | Retention Period |
|---|---|
| A. | The content of the conversation is processed in real time and is not retained by the Controller. The data remain exclusively within the user’s browser session memory until the browser tab is closed. The context transmitted to the language model provider is limited to the last 10 interactions and is not retained any further, as the data retention feature has been disabled. |
| B. | Use of the chatbot involves the temporary storage of information in the user’s browser session storage. These are first-party technical markers, accessible only from the website’s domain and automatically deleted when the browser tab is closed. |
| C. | 10 years from the final resolution of the dispute. |
Nature of Provision and Consequences of Refusal
| Purpose | Nature | Consequences |
|---|---|---|
| A. | Optional | Inability to obtain a response from the automated system. The provision of personal data is neither required nor necessary. |
| B. | Necessary | Inability to use the tool with continuity of the conversation throughout website navigation. |
| C. | Necessary | Inability to manage disputes. |
Disclosure of Data
Personal data are processed by authorised members of staff for the performance of their respective duties and may be disclosed to third parties as set out below:
| Purpose | Categories of External Recipients |
|---|---|
| A. | Provider of the language model (OpenAI) and its subprocessors (https://openai.com/it-IT/policies/sub-processor-list/) |
| B. | N/A |
| C. | External legal counsel; Judicial Authorities. |
Transfer of Data to Third Countries or International Organisations
The Controller transfers personal data to the countries and under the conditions summarised below:
| Purpose | Country | Lawfulness of the Transfer |
|---|---|---|
| A. |
|
|
| B. | N/A | |
| C. | N/A |
Rights of Data Subjects
The data subject is entitled to exercise the following rights in relation to their personal data:
Right of Access: data subjects have the right to obtain confirmation as to whether or not their personal data are being processed and, where that is the case, to access such data and obtain a copy thereof.
Right of Rectification: data subjects may request the updating of their personal data, the correction of any inaccurate personal data, and the completion of any incomplete personal data.
Right to Erasure: data subjects may request the erasure of their personal data where the relevant legal requirements are met (for further information, please contact the Controller).
Right to Restriction of Processing: data subjects may request the restriction of processing where the relevant legal requirements are met (for further information, please contact the Controller).
Right to Object: data subjects may object to the processing of their personal data, on grounds relating to their particular situation, where the processing is based on the Controller’s legitimate interests or is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.
Right of Data Portability: data subjects may receive the personal data provided to the Controller in a structured, commonly used and machine-readable format and request its transmission to another controller where the processing is based on consent or on a contract and is carried out by automated means.
Right to Withdraw Consent: where processing is based on consent, data subjects may withdraw their consent at any time, without affecting the lawfulness of processing carried out prior to such withdrawal.
The rights that may be exercised in relation to the processing activities carried out are as follows:
| Purpose | Applicable Rights | ||||||
|---|---|---|---|---|---|---|---|
| Access | Rectification | Erasure | Restriction of Processing | Objection | Data Portability | Withdrawal of Consent | |
| A. | X | X | X | X | X | ||
| B. | X | X | X | X | X | ||
| C. | X | X | X | X | X | ||
Please note that, due to the operating methods described above, the Controller does not retain conversations and is not able to identify the user. Consequently, pursuant to Article 11 of the GDPR, the exercise of the rights referred to above may require the data subject to provide additional information enabling their identification.
To exercise the above rights, data subjects may use the form available at the following link: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924 and send it to the following contact address: privacy@samoadivani.com. Data subjects may also use the same contact details to request further information regarding the matters described above (e.g. the legitimate interest balancing test or the list of data processors).
A complaint may be lodged with a supervisory authority. In Italy, the competent supervisory authority is the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it).