PROMETEO
Privacy

Privacy Notice

Last updated: 21 October 2026 · Italiano

This notice describes how PROMETEO (the "Platform") processes personal data under Regulation (EU) 2016/679 ("GDPR") and applicable Italian data protection law.

1. Data controller

Cluster Energia Basilicata ETS, tax code (C.F.) 96090180769, registered office Via di Giura snc, 85100 Potenza (PZ), c/o Confindustria Basilicata — Centro Direzionale, Italy, is the data controller for personal data collected through the Platform. For any request, or to exercise your rights, write to info@clusterenergiabasilicata.it.

The Platform is run on the Cluster's behalf by SEN Consulting S.r.l.s. (Pisticci, MT), which hosts it and handles its technical operation and support as data processor under GDPR article 28. For some services SEN Consulting in turn engages the sub-processors listed in section 6.

2. Categories of data

  • Identification data. First and last name, email, job role, phone (optional), collected at onboarding or via invitation.
  • Company data. Legal name, VAT, sector, size, business model, internationalization data, registered address.
  • Assessment responses. Qualitative ratings submitted in the ESG questionnaire and any free-text evidence.
  • Technical data. Hashed IP, access timestamps, session IDs, application logs. Credentials and session cookies, one-time access codes and the data entered in forms (email addresses, names, message texts, assessment evidence) are removed from the requests written to the logs.
  • Prometeo AI conversations. If you choose to use the assistant, the messages you write and the answers it generates — see section 4.
  • Browsing data (on consent only). If you enable the Analytics category in the cookie banner, Google Analytics 4 collects pages visited, interaction events, device and browser type, approximate geographic area and a pseudonymous browser identifier; the IP address is anonymised. Without your consent none of this is collected, because the script is never even loaded into the page — see the Cookie policy.
  • Cookie consent record. A random consent identifier, the categories accepted, the date and manner of the choice, the user agent, a salted hash of the IP address, and — only if you were signed in at the time — your account identifier.

3. Purposes and legal basis

  • Service provision (art. 6.1.b GDPR — contract performance): authentication, scoring, tool recommendation, Documento Zero generation, the Prometeo AI assistant (section 4).
  • Contact and kick-off requests (art. 6.1.b GDPR — pre-contractual steps taken at the data subject's request): requests sent through the contact form or from the results page are handled by Cluster Energia Basilicata ETS, with technical support from SEN Consulting, which does not use them for purposes of its own, and are not passed on to consultants or any other third party.
  • Platform security (art. 6.1.f GDPR — the controller's legitimate interest in protecting the Platform and the data it holds): keeping security logs and an audit trail, to prevent unauthorised access and misuse and to reconstruct what happened after an incident.
  • Consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code): measuring use of the Platform through Google Analytics 4, to improve it. The legal basis is consent rather than legitimate interest, because the processing involves storing information on your device. You can withdraw it at any time from the cookie preferences, without affecting the lawfulness of processing carried out before then.
  • Observatory on the Basilicata production system (art. 6.1.f — the controller's legitimate interest in describing the region's maturity): statistics that are strictly aggregated and non-nominative, shared with Cluster Energia Basilicata and regional policy-makers. Aggregation prevents re-identification of any individual company, and single-company data is never visible to other members.
  • Demonstrating consent (art. 7.1 GDPR): keeping the record of the choices made in the cookie banner, so that consent can be proven. See the Cookie policy.

4. Prometeo AI

Prometeo AI is an optional assistant based on artificial intelligence. When you use it you are interacting with an automated system, not a person. Its answers are indicative, may contain errors and do not replace professional advice.

  • Data processed. The messages you write and the answers generated. To answer, the assistant may consult Platform data your account can already access, such as your company's assessments and reports, and a collection of public reference documents on sustainability.
  • Legal basis. Contract performance (art. 6.1.b GDPR): processing takes place only when you write to the assistant.
  • Provider and place of processing. Answers are generated by language models provided by Microsoft through the Azure OpenAI service in Azure AI Foundry, with processing inside the European Union.
  • No training. Under the terms of the Azure OpenAI service, conversations are not used to train the models.
  • Abuse monitoring. Microsoft may retain prompts and answers for up to 30 days, solely to detect and prevent misuse of the service.
  • Confidentiality. Conversations are personal: they are not visible to other users or to the Platform's administrators. An administrator may extract a copy only to answer your request for access to your data (section 8), and the operation is logged.
  • Retention. Conversations are kept for as long as your account exists. You can delete them at any time: a deleted conversation disappears at once and is permanently erased 30 days later. Deleting your account erases all of them.
  • What not to enter. Please do not enter personal data about other people, or special categories of data (for example data concerning health, political opinions or religious beliefs), into your conversations.

The same models are also used to write the comparison with comparable companies, in the results report and in the Documento Zero, based on the company's data and its assessment answers.

5. Retention

  • Account and assessment data — up to 5 years from contract termination, consistent with standard Italian commercial limitation periods.
  • Security logs and audit trail — 12 months from creation.
  • Contact requests and leads — 24 months from last contact, unless converted to a customer.
  • Application logs — 30 days rolling.
  • Prometeo AI conversations — for the lifetime of the account; those you delete are permanently erased 30 days after deletion. Microsoft may retain prompts and answers for up to 30 days for abuse monitoring (section 4).
  • Cookie consent record — 24 months from creation. The consent itself lasts six months; the proof has to outlive it, because a complaint can arrive after it lapses.
  • Google Analytics 4 data — 14 months, the shortest period Google allows. Held by Google, not by us.

6. Recipients

Data may be processed by the controller's authorised personnel, by the data processor and by the sub-processors it engages:

  • SEN Consulting S.r.l.s. (Pisticci, MT) — data processor: hosting, technical management and support of the Platform.
  • Sub-processor: Microsoft Ireland Operations Ltd. (Azure, Entra External ID, Azure OpenAI in Azure AI Foundry) — infrastructure hosting in the EU, user authentication and the language models behind Prometeo AI, with processing in the EU.
  • Sub-processor: Mailgun Technologies, Inc. (Sinch group) — transactional email (invitations, Documento Zero, OTP codes), processed in the EU region.
  • Sub-processor: Google Ireland Ltd. (Google Analytics 4, Google Tag Manager) — measuring use of the Platform, only if you granted consent to the Analytics category.

The processor and the sub-processors are bound by data processing agreements under GDPR article 28.

The Cluster's staff authorised in writing, that is the Platform's operators, have read-only access to the data of the companies assigned to them: company details, assessments, results and documents uploaded to the archive, for the Cluster's support and outreach activities. SEN Consulting staff in charge of administering the Platform access it for technical management and support. Other registered companies never see your company's data.

7. Transfers outside the EU

Data is hosted in Azure data centres in the West Europe region, and Prometeo AI requests are processed inside the European Union. Any extra-EU transfer is protected by Standard Contractual Clauses approved by the European Commission.

Transactional email is processed in Mailgun's EU region. As Mailgun Technologies, Inc. is based in the United States, any access to the data on its part from the United States is protected by the SCCs in its data processing agreement.

If you consent to the Analytics category, the browsing data collected by Google Analytics 4 may be transferred to Google LLC in the United States, on the basis of the SCCs and Google LLC's certification under the EU–US Data Privacy Framework. Withdrawing consent ends the transfer; the Platform simultaneously deletes the Google cookies already present in your browser.

8. Data-subject rights

Data subjects may exercise their rights under GDPR articles 15-22 — access, rectification, erasure, restriction, portability, objection — by writing to info@clusterenergiabasilicata.it. Complaints may also be lodged with the Italian DPA (garanteprivacy.it).

9. Changes

This notice may be updated; the current version is always available at /en/privacy with the last-updated date at the top.

This notice is also available in Italian at /privacy.