PROMETEO
Privacy

Privacy Notice

Last updated: 29 August 2026 · Italiano

This notice describes how PROMETEO (the "Platform") processes personal data under Regulation (EU) 2016/679 ("GDPR") and applicable Italian data protection law.

1. Data controller

Cluster Energia Basilicata ETS (Italian tax code 96090160769), registered office Via di Giura snc, 85100 Potenza (PZ), c/o Confindustria Basilicata — Centro Direzionale, Italy, is the data controller for personal data collected through the Platform. For any request, or to exercise your rights, write to info@clusterenergiabasilicata.it.

SEN Consulting SRLS (Italian VAT 01404200774), registered office Via Pomarico SNC, 75015 Pisticci Scalo (MT), designed and operates the Platform and processes data on the controller's behalf as a data processor under GDPR article 28.

2. Categories of data

  • Identification data. First and last name, email, job role, phone (optional), collected at onboarding or via invitation.
  • Company data. Legal name, VAT, sector, size, business model, internationalization data, registered address.
  • Assessment responses. Qualitative ratings submitted in the ESG questionnaire and any free-text evidence.
  • Technical data. Hashed IP, access timestamps, session IDs, application logs (PII-sanitised per docs/security.md).

3. Purposes and legal basis

  • Service provision (art. 6.1.b GDPR — contract performance): authentication, scoring, tool recommendation, Documento Zero generation, lead management.
  • Legal obligations (art. 6.1.c): security logs and audit trail for compliance.
  • Legitimate interest (art. 6.1.f): aggregate usage measurement to improve the Platform (only with the user's consent).
  • Observatory on the Basilicata production system (art. 6.1.f — the controller's legitimate interest in describing the region's maturity): statistics that are strictly aggregated and non-nominative, shared with Cluster Energia Basilicata and regional policy-makers. Aggregation prevents re-identification of any individual company, and single-company data is never visible to other members.
  • Consent (art. 6.1.a): enabling non-essential cookies and trackers (see the Cookie policy).

4. Retention

  • Account and assessment data — up to 5 years from contract termination, consistent with standard Italian commercial limitation periods.
  • Security logs and audit trail — 12 months from creation.
  • Contact requests and leads — 24 months from last contact, unless converted to a customer.
  • Application logs — 30 days rolling.

5. Recipients

Data may be processed by the controller's authorised personnel, by SEN Consulting SRLS as data processor, and by external sub-processors:

  • Microsoft Corporation (Azure / Entra External ID) — EU infrastructure hosting.
  • Microsoft Azure Communication Services — transactional email (invitations, Documento Zero, OTP codes).
  • Any other cloud vendors documented in docs/architecture.md.

All processors are bound by a data processing agreement (DPA) under GDPR article 28.

6. Transfers outside the EU

Data is hosted in Azure West Europe data centres. Any extra-EU transfer is protected by Standard Contractual Clauses approved by the European Commission.

7. Data-subject rights

Data subjects may exercise their rights under GDPR articles 15-22 — access, rectification, erasure, restriction, portability, objection — by writing to info@clusterenergiabasilicata.it. Complaints may also be lodged with the Italian DPA (garanteprivacy.it).

8. Changes

This notice may be updated; the current version is always available at /en/privacy with the last-updated date at the top.

This notice is also available in Italian at /privacy.