Product privacy notice and GDPR roles

Preamble, nature and effect of this document

Niltech Europe S.r.l., with registered office at Via Calmaggiore 5, 31100 Treviso (TV), Italia, VAT No. IT 05614380268 (“Niltech”), adopts this document in order to transparently describe GDPR roles, product data, customer instructions and responsibilities that remain separate.

This document is a notice provided to data subjects. Consent is not required where processing relies on another lawful basis; where consent is necessary, it is requested separately in a freely given, specific, informed and withdrawable manner.

This document applies the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability under Articles 5, 24, 25 and 32 GDPR, while keeping the customer’s position distinct from Niltech’s position.

Personal and material scope

The objective scope includes Context, its public interfaces and processing strictly connected with the described functions. The Context website and service are made available through context.andreaaiagent.com and use Bluehost infrastructure. OpenAI provides AI processing services; MySQL, Redis, ClamAV, Tesseract, Poppler, ImageMagick and Exim/sendmail are technical components managed within the service environment and are not, for that reason alone, separate subprocessors. Legal-research functions, where enabled by the Customer and relevant to the request, may query public institutional sources including Cassazione/SentenzeWeb, Normattiva, AGCM and ANAC; an institutional source does not relieve the user from verifying currency, relevance and the applicable official text.

The relevant operations concern document upload and classification, text extraction and OCR, assisted analysis and synthesis, report drafting, review and research over enabled legal sources. Potential information categories are: authorised accounts, case files, documents, extracted text, OCR results, notes, legal sources, operational logs and assisted outputs. The actual privacy role, lawful basis and extent of processing depend on the contractual relationship and the lawful instructions of the party determining purposes and essential means.

Definitions and interpretation

• “Service” means the Context functions made available under the agreement.
• “Customer” means the legal person or professional entering into the agreement with Niltech.
• “Authorised User” means an individual enabled by the Customer to use the Service under its responsibility.
• “Customer Data” means data, documents, images, instructions and other content submitted or generated on the Customer’s behalf.
• “Assisted Output” means a result produced through automated rules or artificial-intelligence components and subject to the stated controls.
• “Further Supplier” means a third party providing Niltech with a technical service relevant to the documented scope.
• “Incident” means an event compromising or capable of compromising confidentiality, integrity, availability, authenticity or resilience.
• “Business Day” means a day other than Saturday, Sunday or an Italian national public holiday.

Specific duties and safeguards

1. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall define by contract when Niltech is processor and when it acts as independent controller. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

2. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall document data subjects, data, sources, purposes and operations. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

3. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall apply minimisation to uploads, prompts, logs, support and exports. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

4. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall restrict access to users and staff with documented need. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

5. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall assist the controller with rights, DPIA, incidents and consultations. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

6. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall cease, return or delete data according to instructions and applicable constraints. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

Roles

The customer normally acts as controller for data entered into the product; Niltech generally operates as processor on documented instructions. Niltech remains controller for accounts, security, billing, compliance and its own contacts.

Data and data subjects

authorised accounts, case files, documents, extracted text, OCR results, notes, legal sources, operational logs and assisted outputs

Data subjects may include users, end customers, insured parties, counterparties, advisers or persons mentioned in documents. The customer must limit data to necessity and provide a lawful basis and notices.

Purposes and instructions

Context supports document upload and classification, text extraction and OCR, assisted analysis and synthesis, report drafting, review and research over enabled legal sources.

Niltech does not use customer data for purposes incompatible with the contract. Any further use requires a separate basis and notice.

Rights and assistance

Requests concerning product data normally go to the customer controller. Niltech assists with search, export, restriction, rectification and deletion within the service and DPA.

Scope, audience and status of this document

This document is intended for customers, prospects, authorised users, advisers and control functions needing to understand the Context scope. Its specific objective is to transparently describe GDPR roles, product data, customer instructions and responsibilities that remain separate. It applies to the stated document revision and date and must be read with the applicable agreement, order, DPA, technical specifications and controlled procedures.

The Context website and service are made available through context.andreaaiagent.com and use Bluehost infrastructure. OpenAI provides AI processing services; MySQL, Redis, ClamAV, Tesseract, Poppler, ImageMagick and Exim/sendmail are technical components managed within the service environment and are not, for that reason alone, separate subprocessors. Legal-research functions, where enabled by the Customer and relevant to the request, may query public institutional sources including Cassazione/SentenzeWeb, Normattiva, AGCM and ANAC; an institutional source does not relieve the user from verifying currency, relevance and the applicable official text.

Executed agreements and actually approved configurations prevail in case of inconsistency. Public information describes the control programme; it does not turn optional provider capabilities into Niltech controls or automatically attest legal applicability or satisfaction.

Exceptions, non-conformity and escalation

A deviation is not accepted by custom. The owner records the affected requirement, cause, impact, exposed data and persons, compensating measures, approver, expiry and closure criterion. The exception is reviewed if risk changes or a measure does not work as expected.

Incidents, possible unlawful processing, loss of data control, outputs with severe impact, contractual breaches, unapproved suppliers or unreliable evidence must be escalated without delay. Current Legal and functional scope: The documented scope includes the website, application service, technical components and external sources used under the agreement.

• contain risk and suspend the affected phase where needed
• preserve evidence, timing, decisions and communications
• involve privacy, security, product, legal or management owners as appropriate
• resume only after measure verification and documented authorisation

Review, change and improvement

The document is reviewed at least every six months and earlier when purpose, audience, data, GDPR or AI Act role, supplier, model, architecture, location, contractual terms or legal requirements change. Incidents, complaints, failed tests and new vulnerabilities trigger an extraordinary review.

Each review records inputs, participants, decision, changes, superseded evidence, remaining gaps and next date. Material corrections are published without retroactively altering the prior document revision. Contact and requests: info@nil-tech.net.

• check change register and related documents
• retest affected controls
• update manifest, PDF, HTML and hashes
• notify recipients where the change affects their rights or duties

Allocation of roles and own purposes

For content submitted by the Customer, the Customer ordinarily determines purposes and essential means and acts as controller; Niltech processes on its behalf under Article 28 GDPR. Classification nevertheless depends on facts, not the contractual label. If two parties jointly determine purposes and essential means, an Article 26 arrangement is required; if Niltech independently determines a further purpose, it acts as controller for that processing and must provide a separate notice.

Niltech normally acts as controller for account and contract administration, security of its service, abuse prevention, establishment or defence of claims, accounting duties and compliance requests. Those purposes do not authorise reuse of Customer content to train general models or for incompatible purposes.

Legal case files may contain special-category data, criminal-conviction and offence data, trade secrets, confidential correspondence and material protected by professional secrecy. The Customer must verify the Article 6 GDPR basis, the applicable Article 9 or 10 condition, relevant procedural and professional rules, and limit submissions to material necessary for the engagement.

Customer obligations and safeguards for individuals

Before submission, the Customer must identify purposes, lawful basis, data-subject categories, retention periods and authorised persons; provide required notices; manage objections, restrictions and other rights; carry out a DPIA or prior consultation where required; and issue lawful documented instructions.

Niltech forwards to the Customer requests received concerning data processed on its behalf and does not answer substantively unless authorised or legally required. Assistance reflects the nature of processing and information available, without collecting unnecessary additional data.

Allocation of responsibility and reliance limitations

Within its sphere of responsibility, the Customer warrants the lawfulness of submitted data and instructions, user authorisation, suitable lawful bases and notices, and professional verification of outputs. Niltech remains responsible for activities directly under its control and does not assume the Customer’s regulatory, professional or decision-making functions.

Outputs from Context are auxiliary. Unless expressly agreed and subject to mandatory law, they are not legal advice, an expert determination, insurance decision, liability finding, credit assessment or other reserved professional act. The recipient must examine sources, completeness, consistency and consequences before use.

Nothing excludes liability that cannot lawfully be excluded. Outside those cases, attribution, remedies, limitations and quantification principles follow the applicable agreement, taking account of contributory conduct, mitigation duties and foreseeability under the governing law.

Evidence, review, requests and governing law

Every material assertion must be traceable to a contract, approved configuration, register, minutes, test, log or other reliable evidence. Supplier statements and Niltech controls are kept distinct. Absence of incidents is not, by itself, proof that a measure is effective.

Revisions are dated, reasoned and approved. A later revision does not retroactively alter facts or commitments applicable to earlier periods. Published copies are identified by code, date and cryptographic digest; those elements evidence copy integrity, not the substantive effectiveness of described controls.

Reports, clarification requests, rights requests and complaints may be sent to info@nil-tech.net. Niltech verifies identity and authority where necessary, records the request, responds within applicable periods and communicates any reasoned extension or refusal.

Unless mandatory law or a written agreement provides otherwise, Italian law governs interpretation. The Italian text is controlling; the English translation is provided for convenience.

Official sources

• Regulation (EU) 2016/679 (GDPR)
• EDPB — Guidelines 07/2020 on controller and processor concepts