Privacy Notice — MicroFit

1. Data controller

The data controller is DATAFIT ITALIA SRL, which operates the MicroFit service, with registered office at Corso Vercelli 27 - 20144 Milan (MI) - Italy, VAT number 10136720967.

Privacy contact: privacy@datafit.it. Certified email (PEC): datafititalia@legalmail.it.

2. Who MicroFit is for

MicroFit is a B2B service aimed at businesses and professionals acting within their commercial or professional activity. The service is not specifically intended for minors.

3. Data processed

We may process contact/professional details, the content of your enquiry and project description, structured summaries generated during qualification, technical and security data, and cookie/tracking preferences.

There is no need to provide passwords, credentials, API keys, tokens, or special categories of personal data. Please do not enter them in the chat. If we receive them accidentally, we will limit their use, redact them, or delete them when no longer necessary, in line with legal and security obligations.

4. Purposes and legal bases

• Managing the enquiry and proposal: Art. 6(1)(b) GDPR for pre-contractual measures requested by the data subject; and/or Art. 6(1)(f) when the contact acts on behalf of a business.
• AI-assisted qualification: the same legal basis as managing the enquiry.
• Security and abuse prevention: Art. 6(1)(f) GDPR.
• Technical logs and continuity: Art. 6(1)(f) GDPR.
• Legal/administrative obligations: Art. 6(1)(c) GDPR and, where applicable, Art. 6(1)(f) for the protection of rights.
• Further electronic marketing: only where provided for and permitted, based on separate consent and applicable ePrivacy/Italian law. Requesting a quote does not automatically enrol you in marketing.

5. AI-assisted qualification

The AI structures the request and may flag preliminary indicators of fit, complexity, and security. These outputs are for internal support only. We do not use the AI to make a final, solely automated decision with legal or similarly significant effects. A member of the MicroFit team verifies the request before communicating the package, price, scope, or any alternative Datafit path.

6. Provision of data

An email address is required to receive the project summary and commercial response. Other information is optional, but insufficient data may prevent a reliable evaluation.

7. Recipients and processors

Data may be processed by authorized MicroFit/Datafit personnel and by hosting/cloud, security, email, and analytics/advertising providers (only when activated per the Cookie Policy and consent where required), professional advisors, and authorities when required by law. OpenAI, via the OpenAI API, is used to operate the AI assistant.

8. OpenAI and international transfers

For the AI assistant we use OpenAI's commercial API offering. According to OpenAI, business/API inputs and outputs are not used to train its models by default, unless we explicitly opt in. For the standard API, OpenAI states that, except for certain endpoints or features, inputs and outputs may be securely retained for up to 30 days to provide the service and identify abuse, unless a different period is required by law.

OpenAI may process data outside the European Economic Area, including in the United States. Our agreement with OpenAI includes a Data Processing Addendum; where the GDPR requires safeguards for transfers outside the EEA, we rely on the mechanisms provided under that agreement. We do not currently claim Zero Data Retention for this service.

9. Retention

Except where required by law, litigation, or security needs:

• chat/enquiry abandoned without contact: up to 30 days;
• completed request without a resulting business relationship: up to 6 months from the last contact;
• logs and security/abuse-prevention data: up to 180 days;
• customer/contractual/tax documentation: the period required by applicable law, normally up to 10 years for documents subject to such obligations;
• marketing consents: until revoked, and then for the period necessary to demonstrate correct collection or handle disputes.

10. Cookies and tracking

Technical cookies may be used for operation and security. Non-essential analytics, advertising, remarketing, or profiling are activated only in accordance with applicable law and, where required, after consent. Preferences can be managed via Cookie Settings.

11. Requested emails and marketing

The email containing the project summary, requested proposal, or follow-up directly connected to the enquiry does not automatically enrol you in a newsletter. Further marketing is managed separately and, where required, based on specific, revocable consent.

12. Security

We adopt technical and organizational measures proportionate to the risks, including access controls, encryption in transit, logging, minimization, frontend/backend separation, rate limiting, and human review.

13. Your rights

Where provided for by the GDPR: access, rectification, erasure, restriction, portability, objection, objection to marketing, withdrawal of consent, and protection against solely automated decisions under Art. 22. Requests: privacy@datafit.it.

14. Complaints

You may lodge a complaint with the Italian Data Protection Authority (Garante) or the competent supervisory authority.

Italian Data Protection Authority (Garante)

15. Changes

This policy may be updated to reflect changes to the service, providers, AI features, or applicable law. The published version will always show the date it was last updated.