PROMETEO
Privacy

Privacy Notice

Last updated: 12 September 2026 · Italiano

This notice describes how PROMETEO (the "Platform") processes personal data under Regulation (EU) 2016/679 ("GDPR") and applicable Italian data protection law.

1. Data controller

Cluster Energia Basilicata ETS (Italian tax code 96090160769), registered office Via di Giura snc, 85100 Potenza (PZ), c/o Confindustria Basilicata — Centro Direzionale, Italy, is the data controller for personal data collected through the Platform. For any request, or to exercise your rights, write to info@clusterenergiabasilicata.it.

Cluster Energia Basilicata ETS also operates the Platform itself; the only parties processing data on its behalf as data processors under GDPR article 28 are the cloud sub-processors listed in section 5.

2. Categories of data

  • Identification data. First and last name, email, job role, phone (optional), collected at onboarding or via invitation.
  • Company data. Legal name, VAT, sector, size, business model, internationalization data, registered address.
  • Assessment responses. Qualitative ratings submitted in the ESG questionnaire and any free-text evidence.
  • Technical data. Hashed IP, access timestamps, session IDs, application logs (PII-sanitised per docs/security.md).
  • Browsing data (on consent only). If you enable the Analytics category in the cookie banner, Google Analytics 4 collects pages visited, interaction events, device and browser type, approximate geographic area and a pseudonymous browser identifier; the IP address is anonymised. Without your consent none of this is collected, because the script is never even loaded into the page — see the Cookie policy.
  • Cookie consent record. A random consent identifier, the categories accepted, the date and manner of the choice, the user agent, a salted hash of the IP address, and — only if you were signed in at the time — your account identifier.

3. Purposes and legal basis

  • Service provision (art. 6.1.b GDPR — contract performance): authentication, scoring, tool recommendation, Documento Zero generation, lead management.
  • Legal obligations (art. 6.1.c): security logs and audit trail for compliance.
  • Consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code): measuring use of the Platform through Google Analytics 4, to improve it. The legal basis is consent rather than legitimate interest, because the processing involves storing information on your device. You can withdraw it at any time from the cookie preferences, without affecting the lawfulness of processing carried out before then.
  • Observatory on the Basilicata production system (art. 6.1.f — the controller's legitimate interest in describing the region's maturity): statistics that are strictly aggregated and non-nominative, shared with Cluster Energia Basilicata and regional policy-makers. Aggregation prevents re-identification of any individual company, and single-company data is never visible to other members.
  • Demonstrating consent (art. 7.1 GDPR): keeping the record of the choices made in the cookie banner, so that consent can be proven. See the Cookie policy.

4. Retention

  • Account and assessment data — up to 5 years from contract termination, consistent with standard Italian commercial limitation periods.
  • Security logs and audit trail — 12 months from creation.
  • Contact requests and leads — 24 months from last contact, unless converted to a customer.
  • Application logs — 30 days rolling.
  • Cookie consent record — 24 months from creation. The consent itself lasts six months; the proof has to outlive it, because a complaint can arrive after it lapses.
  • Google Analytics 4 data — 14 months, the shortest period Google allows. Held by Google, not by us.

5. Recipients

Data may be processed by the controller's authorised personnel and by external processors:

  • Microsoft Corporation (Azure / Entra External ID) — EU infrastructure hosting.
  • Microsoft Azure Communication Services — transactional email (invitations, Documento Zero, OTP codes).
  • Google Ireland Ltd. (Google Analytics 4, Google Tag Manager) — measuring use of the Platform, only if you granted consent to the Analytics category.
  • Any other cloud vendors documented in docs/architecture.md.

All processors are bound by a data processing agreement (DPA) under GDPR article 28.

6. Transfers outside the EU

Data is hosted in Azure West Europe data centres. Any extra-EU transfer is protected by Standard Contractual Clauses approved by the European Commission.

If you consent to the Analytics category, the browsing data collected by Google Analytics 4 may be transferred to Google LLC in the United States, on the basis of the SCCs and Google LLC's certification under the EU–US Data Privacy Framework. Withdrawing consent ends the transfer; the Platform simultaneously deletes the Google cookies already present in your browser.

7. Data-subject rights

Data subjects may exercise their rights under GDPR articles 15-22 — access, rectification, erasure, restriction, portability, objection — by writing to info@clusterenergiabasilicata.it. Complaints may also be lodged with the Italian DPA (garanteprivacy.it).

8. Changes

This notice may be updated; the current version is always available at /en/privacy with the last-updated date at the top.

This notice is also available in Italian at /privacy.