Privacy Policy

The company NextAI Srl, represented by its legal representative pro tempore, VAT No. IT02717930743, with registered office at Viale Francia snc – 72019 San Vito dei Normanni (BR), Italy, certified e-mail address: nextai.srl@pec.it (hereinafter, the "Controller"), acting as Data Controller pursuant to Art. 1 of Legislative Decree No. 196 of 30 June 2003 – Privacy Code (hereinafter the "Code") and Articles 4(7) and 24 of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter, the "Regulation"), hereby informs, pursuant to Art. 13 of the Regulation, that it will process the personal data of its clients.

Preamble

Pursuant to the European regulation on the protection of personal data, legal entities cannot be considered data subjects and therefore the European regulation does not apply to them. However, if personal data relating to a natural person are entered in the context of corporate data collection, that person shall be considered a data subject within the meaning of the aforementioned regulation.

1. Definitions

1.1 Agency: a marketing agency, digital agency, consultant or freelancer, whether a natural or legal person, acting in the context of its commercial activity related to marketing and corporate communication.

1.2 Client: a legal entity or a natural person acting in the context of its business, commercial, artisanal or professional activity, who is interested in using the Services through the Web App.

1.3 End Clients: the Client's end clients who communicate, through the Web App, with Users and, more generally, with the Client.

1.4 Contract: the contract entered into from time to time by NextAI with the Data Subjects for the purpose of the Services through the consent forms on the Website, represented by the Agency Contract in the commercial relationship between NextAI and the Agency, by the Client Contract or the Spoki For Free Contract in the commercial relationship between NextAI and the Client, and by the General Terms and Conditions in the commercial relationship between NextAI and the Users.

1.5 Agency Contract: the agency contract by virtue of which the Agency accesses a control panel on the Website, in order to purchase the Web App licence for the use of the Services on behalf of its Clients.

1.6 Client Contract: the Web App licence contract for the provision of the Services entered into between NextAI and the Client.

1.7 Spoki For Free Contract: the contract for the provision of Free Services entered into between NextAI and the Client.

1.8 General Terms and Conditions: the general terms and conditions of the Services entered into between NextAI and the User.

1.9 Cookies: cookies are text files (letters and/or numbers) that contain packets of information stored on the Data Subjects' computer or mobile device each time they visit a website through a browser. On each subsequent visit, the browser sends the cookies to the website that originated them or to another website. Cookies may be stored only for the duration of use of a particular website (i.e. session cookies), or for a longer period independent of the session (i.e. persistent cookies).

1.10 Fees: any fee charged by NextAI to the Agency or the Client for the use of the Services through the Web App.

1.11 Personal Data: any information relating to a natural person, identified or identifiable, directly or indirectly, by reference to a name, an identification number, location data, an online identifier or to factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

1.12 GDPR: Regulation (EU) 2016/679 of 27 April 2016.

1.13 Privacy Notice: this document.

1.14 Data Subjects: the natural persons to whom the Personal Data relate, within the meaning of Art. 4 of the GDPR.

1.15 NextAI: NextAI S.r.l. with registered office in San Vito dei Normanni, Viale Francia s.n.c., Tax Code and VAT No. 02717930743.

1.16 Profiling: the processing of Personal Data by evaluating personal aspects of Data Subjects using wholly or partly automated procedures.

1.17 Processor: the natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller within the meaning of Art. 4 of the GDPR.

1.18 Services: the services used by Users through the Web App, as described in the Contract.

1.19 Website: this website.

1.20 European Economic Area: comprising EU Member States, Norway, Iceland and Liechtenstein.

1.21 Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data within the meaning of Art. 4 of the GDPR.

1.22 Processing: any operation or set of operations performed on Personal Data, such as, by way of example, collection, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure, combination, restriction, erasure and destruction.

1.23 Users: all natural persons belonging to and/or connected with the Client who individually use the Web App in the name and on behalf of the Client or in their own name and for the benefit of End Clients.

1.24 Web App: the web application for the provision of the Services offered by NextAI.

2. Data Controller

a) NextAI: the Controller of the Processing referred to in point 3 of this Privacy Notice is NextAI. Any request by Data Subjects relating to Processing carried out by NextAI concerning their Personal Data (including the exercise of the rights referred to in point 11 below), shall be addressed to NextAI, by post to its registered office, or by e-mail to: info@spoki.it.

b) Client: the Controller of the Processing referred to in point 4 of this Privacy Notice is the Client of reference of the User or of the End Clients, on the basis of the Client's privacy notice, which NextAI invites you to consult. With regard to such Processing, NextAI acts as Processor on behalf of the Client, who is the Controller from time to time. Such Processing is therefore not governed by this Privacy Notice.

3. Purposes and legal basis of NextAI's Processing

NextAI collects and uses Personal Data for the following purposes:

a) Facilitating navigation on the Website, essentially through the use of Cookies: the Processing for the purpose referred to in paragraph a) is governed by the cookie policy, available on the banner on the Website, which NextAI recommends reading.

b) Registration on the Website by the Data Subject: Processing necessary to enable the execution of the Contract, based on the Data Subject's execution of the Contract and the related pre-contractual measures proposed by NextAI.

c) Managing contact requests: Processing necessary for sending a contact request to NextAI; refusal prevents receiving a response from NextAI regarding one's contact request. This Processing is based on NextAI's legitimate interest in responding to contact requests, which NextAI considers to prevail over the Data Subjects' right to privacy. Opposition to this Processing (where the requirements are met) may be exercised at any time following the instructions set out in point 11(e) of this Privacy Notice.

d) Enabling Agencies and Clients to make payments of the Fees on the Website: Processing necessary for the use of the Services; refusal prevents the use of the Services as provided for in the applicable Contract, and is based on the execution of the Contract and the related pre-contractual measures proposed by NextAI.

e) Storing the payment details of Agencies or Clients (e.g. credit cards) solely to facilitate further purchases on the Website: optional Processing to facilitate subsequent purchases by Agencies or Clients, without prejudice to the possibility of purchasing and accessing available Services even in the absence of prior storage of payment details. This Processing is based on the free, specific, informed and unambiguous consent of the Agency or Client, expressed by declaration or positive action (e.g. flag or click) on the Website. Consent may be withdrawn at any time, following the instructions set out in point 11(a) of this Privacy Notice.

f) Sending direct marketing communications to Clients by NextAI (so-called soft spam) relating to Services by e-mail or other channels (e.g. WhatsApp): optional Processing for sending direct marketing communications; refusal by a Client who has already used the Services prevents the Client from remaining informed about the Services and benefiting from direct marketing communications for the sale by NextAI of Services similar to those already purchased. This Processing is based on NextAI's legitimate interest consisting in the benefit that NextAI may obtain from sending direct marketing communications that promote the sale of Services to its Clients, involving them in NextAI's growth and development, which NextAI considers to prevail over Clients' right to privacy (who, moreover, can reasonably expect to receive such communications). Opposition to this Processing may be exercised by the Client, at any time, without any justification, following the instructions set out in point 12 of this Privacy Notice.

g) With prior optional consent, carrying out Profiling: optional Processing; refusal prevents receiving personalised Direct Marketing Communications referred to in the preceding paragraph f). This Processing is based on the free, specific, informed and unambiguous consent of the Data Subject, expressed by declaration within the form on the Website. Consent may be withdrawn at any time, following the instructions set out in point 11(a) of this Privacy Notice.

h) Preventing and suppressing fraud and abusive behaviour (including by third parties) in breach of applicable laws and the rules of fairness and good faith: Processing necessary to protect the proper functioning and use of the Website and the Web App. This Processing is based on NextAI's legitimate interest in protecting its company and Data Subjects from fraud or abusive behaviour, which NextAI considers to prevail over the Data Subjects' right to privacy. Opposition to this Processing (where the requirements are met) may be exercised at any time following the instructions set out in point 11(e) of this Privacy Notice.

i) Collecting and processing usage data of the Web App in aggregate form: Processing necessary to improve the functionalities of the Web App and the Website, provided that any Personal Data relating to Data Subjects are previously and irreversibly anonymised by NextAI. This Processing is based on NextAI's legitimate interest, consisting in the benefit that NextAI may obtain from producing statistics in aggregate form, involving Data Subjects in NextAI's growth and development, which NextAI considers to prevail over the Data Subjects' rights. Opposition to this Processing (where the requirements are met) may be exercised at any time, following the instructions set out in point 11(e) of this Privacy Notice.

j) Complying with legal obligations and enabling NextAI to ascertain, exercise and defend its rights in court or before any other competent authority: Processing necessary to protect NextAI's legal position, rights and interests in connection with the execution, interpretation and performance of the Contract. In particular, should a User upload content (such as text, images and videos) to the Web App, NextAI may retain the User's Personal Data to protect itself in the event of potential inspections or investigations by competent authorities or claims by third parties arising from the uploading of unlawful content or content in breach of the Contract. This Processing is based on: i) NextAI's legitimate interest, consisting in the benefit that NextAI may obtain from protecting its legal position, rights and interests, which NextAI considers to prevail over Users' right to privacy; and ii) where the involvement of third-party authorities is necessary or appropriate, NextAI's legal obligation to cooperate with competent authorities in conducting investigations relating to the execution, interpretation and performance of the Contract. Opposition to this Processing (where the requirements are met), in the case of legitimate interest, may be exercised at any time following the instructions set out in point 11(e) of this Privacy Notice.

4. Purposes and legal basis of the Client's Processing

The Client collects and uses Personal Data for the following purposes:

a) Enabling Users and End Clients to use the Services: the Processing for the purpose referred to in paragraph a) is necessary for the use of the Services through the Web App as provided for in the Client Contract and the General Terms and Conditions. This Processing is based on the contractual relationship between the Client and the Users and between the Client and the End Clients, and the related pre-contractual measures proposed by the Client.

b) Ensuring the IT security of access to and use of the Web App by Users and End Clients: the Processing for the purpose referred to in paragraph b) is necessary to ensure the IT security of the Web App. This Processing is based on the contractual relationship between the Client and the Users and between the Client and the End Clients, and the related pre-contractual measures proposed by the Client.

5. Methods of collecting Personal Data

The Personal Data of Data Subjects are collected through the following methods:

a) Personal Data collected automatically by the Website: these are the Personal Data collected automatically by the Website through, but not limited to, Cookies (for further information, NextAI recommends reading the cookie policy available on the banner on the Website).

b) Personal Data voluntarily provided by the Data Subject through registration on the Website and/or contact request: these are the Personal Data of the Data Subjects, voluntarily provided to NextAI through registration and/or contact request.

c) Personal Data collected during the provision of Services: these are the Personal Data of the Data Subjects provided during the use of the Services by the Agency or by the Users.

d) Data protection by design and by default: NextAI adopts appropriate technical and organisational measures, pursuant to Art. 25 of the GDPR, to ensure that, by default, only Personal Data which are necessary for each specific purpose of the processing are processed. In particular, such measures ensure that, by default, Personal Data are not made accessible without the individual's intervention to an indefinite number of natural persons. The principle of data minimisation is applied at all stages of processing, from collection to erasure.

6. Categories of recipients of Personal Data

Personal Data are processed by NextAI and/or by third parties, selected for reliability and competence, to whom they may be disclosed where necessary or appropriate, within the European Economic Area. Personal Data may be transferred outside the European Economic Area; in such cases, the Data Controller undertakes to use adequate transfer safeguards, entering into, where applicable, the standard contractual clauses approved by the European Commission with Decision No. 914 of 4 June 2021. In particular, Personal Data may be processed by, and/or disclosed to:

• a) employees and/or collaborators of NextAI;
• b) the Clients;
• c) third-party providers of services necessary to ensure the functioning of the Website and the Web App (e.g., hosting service providers);
• d) third parties contractually bound to NextAI, necessary for the performance of the Services;
• e) third parties providing Website navigation data analysis services.

NextAI selects its suppliers and sub-processors also on the basis of the security guarantees they offer pursuant to Art. 28 and Art. 32 of the GDPR. All sub-processors are contractually bound to comply with appropriate technical and organisational security measures suitable for the nature of the data processed. The updated list of sub-processors and their respective safeguards (including the legal bases for any extra-EEA transfers, such as the EU-US Data Privacy Framework and Standard Contractual Clauses) is available upon request by the Data Subject and can be consulted at NextAI.

7. Personal Data Security Measures

Pursuant to Art. 32 of the GDPR, NextAI adopts appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

a) Technical measures

• Encryption of data in transit using TLS/SSL protocols for all communications between Data Subjects, the Website and the Web App;
• Encryption of data at rest using industry-standard encryption algorithms (AES-256 or equivalent) for databases and storage systems containing Personal Data;
• Firewall systems protecting the IT infrastructure;
• Regular data backups to ensure the availability and resilience of systems;
• Continuous monitoring of IT systems and access logging for the timely detection of any anomalies or unauthorised access;
• Data hosting on servers located within the European Economic Area, with certified providers (including Google Cloud, Amazon Web Services and Digital Ocean, with servers in the EU area);
• Periodic software and operating system updates to address known security vulnerabilities.

b) Organisational measures

• Access control policies based on the "need-to-know" and "least privilege" principles, with multi-factor authentication for access to systems containing Personal Data;
• Contractual and statutory confidentiality obligations for all employees, collaborators and persons authorised to process Personal Data;
• Periodic staff training programmes on personal data protection and IT security;
• Documented security incident management (data breach) procedures, providing for notification to the competent supervisory authority within 72 hours of discovery of the breach, pursuant to Art. 33 of the GDPR, and communication to Data Subjects pursuant to Art. 34 of the GDPR, where required;
• Periodic Data Protection Impact Assessments (DPIAs) pursuant to Art. 35 of the GDPR, where the processing is likely to result in a high risk to the rights and freedoms of Data Subjects;
• Internal review and audit procedures to verify compliance of processing operations with the adopted security policies.

c) Review and update of measures

NextAI undertakes to regularly test, assess and evaluate the effectiveness of technical and organisational measures adopted, in order to ensure the security of the processing, in accordance with Art. 32(1)(d) of the GDPR. Security measures are periodically updated in light of technological developments, emerging threats and changes in the risk level associated with the processing carried out.

8. Special Categories of Personal Data (Sensitive Data)

a) Definition

"Special Categories of Personal Data" means, pursuant to Art. 9 of the GDPR, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health and data concerning a natural person's sex life or sexual orientation.

b) General principle

NextAI does not request and does not intend to intentionally collect Special Categories of Personal Data through the Website and the Web App. The data collection forms on the Website and the Web App are not designed for the collection of such categories of data.

c) Possible processing in the context of the Services

Where, in the context of the use of the Services — in particular within conversations managed through the Web App (e.g. WhatsApp conversations) — Data Subjects or End Clients spontaneously communicate Personal Data belonging to Special Categories, the following provisions shall apply:

• NextAI acts exclusively as Data Processor pursuant to Art. 28 of the GDPR, on behalf of the Client, who retains the status of Data Controller;
• The Client, as Data Controller, is required to ensure the existence of a suitable legal basis pursuant to Art. 9(2) of the GDPR (e.g. explicit consent of the Data Subject under paragraph (a), or another applicable legal basis);
• The Client undertakes to take all reasonable measures to ensure that Data Subjects do not share Special Categories of Personal Data through the Web App without an adequate legal basis;
• NextAI applies to such data the same security measures referred to in Section 7 above, strengthened as specified below.

d) Enhanced protection measures for Special Categories of Personal Data

In addition to the general security measures set out in Section 7, NextAI adopts the following specific measures for the protection of any Special Categories of Personal Data that may be processed:

• Access strictly limited to authorised personnel, specifically designated and trained for the processing of such categories of data;
• Enhanced encryption at all stages of processing (collection, transmission, storage);
• Strict application of the data minimisation principle: collection and storage of only the data strictly necessary for the purpose of the processing;
• Prompt erasure upon completion of the purpose for which the data were collected or communicated;
• Absolute prohibition of use for purposes other than those for which the data were originally collected or communicated;
• Recording and tracking of access to sensitive data for audit and control purposes.

9. Personal Data Retention Period (or criteria for its determination)

Personal Data are retained for the period of time strictly necessary to achieve the purposes for which they were collected, as set out in point 3 above. Without prejudice to the right of opposition referred to in point 11(e) below, NextAI retains the Personal Data of the Processing operations for the following periods:

• a) Cookies: for the purpose referred to in point 3(a), please refer to the cookie policy available on the banner on the Website;
• b) Personal Data for registration on the Website, for enabling payments and for collecting and processing data in aggregate form for the use of the Web App: for the purposes referred to in point 3(b), (d) and (i), for the duration of the applicable Contract and for an additional period of 12 months after the termination of the Contract;
• c) Personal Data for managing contact requests: for the purpose referred to in point 3(c), for a period of 6 months from receipt of the contact request sent by the Data Subject. By way of exception, in the event of a complaint, Personal Data shall be retained for the period referred to in the following paragraph (e);
• d) Personal Data for the storage of Data Subjects' payment details: for the purpose referred to in point 3(e), for the duration of the applicable Contract and for an additional period of 12 months after the termination of the Contract;
• e) Personal Data for the prevention of fraudulent and abusive behaviour: for the purposes referred to in point 3(h), for a period of 26 months after the termination of the Contract;
• f) Personal Data for direct marketing communications: for the purpose referred to in point 3(f), for a period of 24 months (in the absence of Profiling associated with Direct Marketing Communications) or 12 months (in the case of Profiling associated with Direct Marketing Communications) following the last purchase by Clients, demonstrating an interest in NextAI's Services;
• g) Personal Data for Profiling: for the purposes referred to in point 3(g), for the duration of the applicable Contract and for an additional period of 12 months after the termination of the Contract;
• h) Personal Data to comply with legal obligations and to enable NextAI to ascertain, exercise and defend its rights in court or before any other competent authority: NextAI is authorised to retain, in whole or in part, Personal Data for a maximum period of 10 years from collection (or for the longer period of any litigation, where applicable), limited to the information necessary to comply with legal obligations and to enable NextAI to ascertain, exercise and defend its rights in any appropriate forum. Upon expiry of such periods, NextAI shall automatically delete the Personal Data collected or irreversibly transform them into anonymous form.

10. Profiling

The Profiling carried out by NextAI has the following characteristics:

• a) subject matter: Personal Data collected on the Website and/or during the performance of the Services, capable of revealing essentially geographical origin, as well as behavioural trends and preferences regarding the use of NextAI's Services;
• b) purpose: to improve NextAI's promotion and advertising communication, through the sending of Direct Marketing Communications in line with the interests expressed by the Data Subjects and the recommendation of targeted Services offered by NextAI;
• c) legal basis: consent;
• d) logic of the Processing: the profiles of the Data Subjects are defined on a statistical basis through the analysis and processing of the Personal Data of all Data Subjects and the creation of homogeneous categories of Data Subjects;
• e) effects on Data Subjects: receipt of Direct Marketing Communications in line with the preferences expressed by the Data Subjects, navigation of the Website and use of the Services. In no way does NextAI's Profiling: i) constitute automated decision-making from which legal or similarly significant effects for Data Subjects arise within the meaning of Art. 22 of the GDPR; ii) prejudice the behaviour and purchasing decisions of Data Subjects; iii) have a prolonged and permanent impact on Data Subjects, given that the Personal Data collected by NextAI may be independently updated at any time by NextAI; or iv) by reason of the type of services offered by NextAI, result in any discrimination of Data Subjects.

11. Rights of Data Subjects

Pursuant to and for the purposes of the GDPR, for the period referred to in point 9 above, each Data Subject has the right to:

• a) with reference to the Processing referred to in point 3(e) and (g), withdraw consent at any time without affecting the lawfulness of the Processing, by sending an e-mail to NextAI (cf. Art. 7 of the GDPR);
• b) request access from NextAI to their Personal Data and information on the related Processing and, where applicable, a copy in electronic format, unless the Data Subject specifically requests otherwise (cf. Art. 15 of the GDPR);
• c) request the rectification and/or integration of Personal Data, without undue delay (cf. Art. 16 of the GDPR);
• d) for specific reasons (e.g. unlawful processing, absence of processing purpose), request the erasure of Personal Data, without undue delay (cf. Art. 17 of the GDPR);
• e) with reference to the Processing referred to in point 3(c), (h), (i) and (j)(i), object at any time to the Processing of Personal Data (where not used in anonymous form), by sending an e-mail to NextAI (cf. Art. 21 of the GDPR);
• f) in the event of specific circumstances (e.g. inaccuracy of Personal Data, unlawfulness of Processing, exercise of a right in judicial proceedings), request the restriction of Processing (Art. 18 of the GDPR);
• g) in the case of automated Processing, receive Personal Data in a readable format, for the purpose of communicating them to a third party, or, where technically feasible, request the transmission of Personal Data by NextAI directly to such third party (so-called right to data portability – cf. Art. 20 of the GDPR);
• h) be informed, where required by law, by NextAI without undue delay of any breaches or unauthorised access by third parties to its systems containing Personal Data (so-called data breach – cf. Art. 34 of the GDPR);
• i) lodge a complaint with the supervisory authority of the EU country in which they reside, work or in which they believe the infringement of their rights has occurred (cf. Art. 77 of the GDPR). For further information regarding the terms and conditions for the exercise of the rights granted to the Data Subject, the Data Subject may consult the text of the GDPR, or contact NextAI in the manner provided for in point 2 above.

12. Opposition to Processing relating to NextAI's direct marketing communications

NextAI highlights that each Data Subject has the right to object to the Processing of Personal Data referred to in point 3(f), at any time and without any justification, by sending an e-mail to NextAI or by exercising the opt-out in NextAI's direct marketing communications.

In the event of exercise of this right, NextAI shall cease to use the Data Subject's Personal Data for the purposes of direct marketing of Services similar to those previously used by the Data Subject.

The Data Subject may at any time exercise the rights referred to in the preceding article by sending:

• a registered letter to: NextAI Srl, Viale Francia snc – 72019 San Vito dei Normanni (BR), Italy;
• an e-mail to the certified e-mail address: nextai.srl@pec.it