Privacy & Cookie Policy

1. Privacy & Cookie Policy of the psAico.ai website

General Data Protection Regulation (GDPR) EU 2016/679

This page describes how the website https://psaico.ai/ is run in relation to the processing of the personal data of the users who visit it. This policy is also provided under Article 13 of European Regulation 2016/679 to those who interact with the web services of psAico srls a socio unico. It covers only this website, and not any other external websites the user may reach through links.

1 – The Data Controller and the Data Processors

Data Controller: psAico srls a socio unico – P.IVA (Italian VAT no.) 02800830222 – Codice SDI: M5UXCR1 - Via Pranzelores 87 – 38121 Trento TN (ITALY) - e-mail: info@psaico.ai – PEC psaico@namirialpec.it.

Data Processor: OVH S.R.L. privacy policy: https://www.ovhcloud.com/it/personal-data-protection/. VAT no.: IT06157670966 – Via Carlo Imbonati, 18 – 20159 Milan (MI), Italy

2 – Where the data is processed

The processing connected with the web services of this site takes place at our premises and is carried out only by technical staff of the office responsible for the processing. Where necessary, the data connected with the newsletter service may be processed by the staff who look after the technical side of the site, or by the supplier of the newsletter sending service, appointed as data processor and named above. The data is processed in Italy or, in any case, within the European Union.

Data collected by third-party services that may be located outside the EU, such as Google Analytics, is completely anonymous, because this site uses the updated GA4 version, which does not record or store IP addresses, and Google Signals data collection is also switched off.

For more information: https://support.google.com/analytics/answer/12017362?hl=en .

3 – Types of data processed

3.1 – Browsing data

The computer systems and software procedures that run this website acquire, in the course of their normal operation, some personal data whose transmission is implicit in the use of internet communication protocols. This information is not collected in order to be linked to identified data subjects, but by its very nature it could, through processing and matching with data held by third parties, make it possible to identify users.

This category of data includes the IP addresses or domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code showing the status of the server’s response (success, error and so on) and other parameters relating to the user’s operating system and computing environment.

This data is used only to obtain anonymous statistical information about use of the site and to check that it is working properly. The data could be used to establish liability in the event of alleged computer offences against the site.

3.2 – Data provided voluntarily by the user

Sending email, on an optional, explicit and voluntary basis, to the addresses shown on this site means that we acquire the sender’s address, which is needed in order to reply to the request, along with any other personal data included in the message.

Signing up to the newsletter service, or filling in other forms to obtain services offered by this website, are further examples of data provided voluntarily by the user.

4 – Legal basis for the processing

The legal basis for the processing is the performance of the services requested and/or provided, including through the Site and/or requested by you (under Article 6(1)(b) of Privacy Regulation 2016/679); or compliance with a legal obligation to which the data controller is subject (under Article 6(1)(c) of Privacy Regulation 2016/679).

4.1 – Further purposes of the processing: newsletter

If you expressly sign up to the service, we may also process your data to send you our regular newsletter, in order to give you information about our activities, including awareness-raising and educational activities such as conferences and themed evenings, or about books or courses that we believe may be of interest to you.

The legal basis for sending communications by newsletter is your express consent, which the Controller asks for in accordance with Article 6(1)(a) of the General Data Protection Regulation. As regards direct marketing, it should be noted that, under Article 6(1)(f) of the Regulation, the Controller may in any case carry out this activity on the basis of its own legitimate interest, regardless of your consent and until you object to that processing, as set out more fully in Recital 47 of the Regulation, which states that “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”. This also follows the assessments made by the Controller as to whether your interests, fundamental rights and freedoms requiring the protection of personal data may override its legitimate interest in sending the newsletter.

You can in any case easily object to receiving further newsletters by email by clicking on the link to withdraw consent that appears in every promotional and newsletter email.

4.2 – Providing your data is optional

Apart from what is set out for the data needed to perform the service, you are free to provide the personal data shown in the various data request forms, or to ask us to send you the newsletter, information material or other communications. If you do not provide it, it may be impossible for you to obtain what you have asked for.

4.3 – How the data is processed and how long it is kept

Personal data is processed using automated tools for the time strictly necessary to achieve the purposes for which it was collected. Specific security measures are in place to prevent loss of data, unlawful or incorrect use and unauthorised access. The Controller will process users’ personal data using manual and electronic tools, using logic strictly related to those purposes and, in any case, in such a way as to guarantee the security and confidentiality of the data. The personal data of users of the Site will be kept for the time strictly necessary to carry out the primary purposes described above, or in any case for as long as is necessary to protect the interests of both users and the Controller under civil law. Users’ personal data will be kept for the time strictly necessary to carry out the purposes described and, in any event, within the limits set by Applicable Law.

4.4 – Minors

This Site and the Controller’s Services are not intended for people under the age of 18, and the Controller does not knowingly collect personal information about minors. If information about minors is recorded unintentionally, the Controller will delete it promptly as soon as it becomes aware of it.

4.5 – Transfer of personal data

The data provided voluntarily by the user is stored on servers located within the European Union. It remains understood that the Controller may, where this becomes necessary, also move the servers outside the EU. In that case, the Controller confirms here and now that any transfer of data outside the EU will take place in accordance with the applicable legal provisions, following the signature of the standard contractual clauses adopted by the European Commission or with the consent of the data subject. Browsing data, on the other hand, is stored on the servers of Google inc., broadly speaking in the USA, but potentially anywhere in the world, in any case fully anonymised as set out in point 2.

4.6 – Use of Artificial Intelligence in the Service

The psAico conversational service, which is based on artificial intelligence, is not provided through this institutional website but through the psAico application (web and mobile). The processing of personal data connected with the use of the virtual assistant, including the transmission of content to artificial intelligence providers, the minimisation and scrubbing measures applied, the retention periods and any transfers outside the European Economic Area, is described in the dedicated psAico app privacy notice, set out in the second part of this page.

4.7 – Rights of data subjects

Under Articles 15, 16, 17, 18, 19, 20, 21 and 77 of the EU Regulation, the data subject is informed that:

• you have the right to ask the data controller for access to your personal data, for its rectification or erasure, or for restriction of the processing that concerns you, to object to its processing, and to have your data transferred to another controller in the cases provided for;
• any rectification, erasure or restriction of processing carried out at the data subject’s request will be communicated by us to each of the processors to whom the personal data was transmitted, unless this proves impossible or involves disproportionate effort;
• you have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali), following the procedures and instructions published on the Authority’s official website at garanteprivacy.it. If you are in the United Kingdom you may also lodge a complaint with the Information Commissioner’s Office (ico.org.uk); if you are in Ireland, with the Data Protection Commission (dataprotection.ie).

Exercising these rights is free of charge and is not subject to any formal requirement. The service uses automated decision-making processes that do not produce legal effects and do not significantly affect the user within the meaning of Article 22 of Regulation (EU) 2016/679.

4.8 – Policy on the processing of data in the CVs sent to us

If you send a speculative application, or apply for an open vacancy, including on behalf of the Controller’s Clients, the processing is carried out in order to receive and assess requests for professional placement, to evaluate the professional profiles of interest that emerge from the CVs received by processing the data you provide directly, to manage every stage involved in selecting candidates (including checking the qualifications and previous work experience declared with former employers, communicating with the people concerned, holding meetings and assessment interviews with the company’s managers, and so on) and in any case to assess applications, and to comply with obligations laid down by law, by regulation or by EU legislation, as well as for civil, administrative, accounting and tax purposes. In addition to those purposes, we inform you that the processing of your personal data may also be carried out for statistical analysis, and that the data may be shared with the clients who may have commissioned the recruitment, or with agencies to which the Controller has outsourced recruitment.

The data will be processed on paper and/or on electronic or telematic media. Where your CV is in electronic format or on media other than paper, we inform you that the relevant files will be stored in a dedicated database within our company.

Ordinary personal data may be transmitted, without prejudice to communications required by legal or regulatory obligations (including as regards communications concerning special categories of personal data, formerly known as sensitive data) or strictly necessary in order to meet the candidate’s requests; it may also be communicated, for the purposes described, to third parties with whom the Controller works (for example, companies specialising in candidate selection or professional profile assessment services; people named by you in your CV or as part of your application, for the relevant checks and assessments; and the managers and staff of the Companies appointed to run the selection procedures). The data will not be disseminated, but it may be shared with any Client of the Controller for whom a selection process is being run.

We inform you that providing the data is optional and that, where the CV is sent by you on your own initiative and has not been requested by the Companies, no consent needs to be obtained.

We would also remind you that providing the data is optional, but any refusal to provide it in whole or in part may make it impossible for us to assess and select applications.

Please include in your CV, or provide us with, only the data needed to assess your professional profile, and do not include, unless strictly necessary because of legal requirements, special categories of data (formerly sensitive data), that is, data revealing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organisations of a religious, philosophical, political or trade union nature, as well as personal data revealing health status and sex life. Where you do need to include special categories of data (formerly sensitive data), for example when applying for positions reserved by law to particular categories, please give your explicit written consent to the processing of that information by including the authorisation directly in your CV.

Any special categories of data (formerly sensitive data) will be deleted immediately in the absence of a specific written declaration of consent, and will not be taken into account when assessing the application.

4.9 – How long the data is kept and other information

The personal data acquired when we receive your CV will be entered into our “candidates” database and will be processed by our authorised staff for purposes connected with assessing and selecting applications, or possibly to offer you other job opportunities in line with your professional profile. The data will be kept for the periods set out below, in accordance with Article 13(2)(a) of the Regulation. Whether or not a contractual relationship with the Companies is entered into, we inform you that your personal data will be kept (in electronic or paper archives) for a maximum of 48 months, after which it will be deleted, unless you tell us otherwise. Candidates may in any case submit a new CV or ask for their CV to be updated. In that case, a new processing period will begin.

Personal data provided voluntarily by the user (for example, to sign up to the newsletter or to obtain other services) will be kept for the time needed to provide the service and to use it.

5 – Cookie policy

5.1 – What cookies are

Cookies are small strings of text that a website can send to the user’s device while browsing (whether a PC, a laptop, a smartphone or a tablet; they are normally stored directly in the browser used for browsing). The same website that sent them can read and record the cookies on the device in order to obtain various kinds of information.

Cookies make it possible to:

• make the site easier to use and improve the browsing experience;
• deliver advertising messages;
• obtain statistical information about how users browse.

5.2 – How they work

The website you are visiting sends this information to the browser, which creates the cookie and stores it in its own directories. While you browse, the cookies relating to the site you are on are sent back to the server, which uses the value of the cookie to recognise the user.

5.3 – Cookies used by this website

Visitors can make their choice by accepting or refusing cookies using the banner shown the first time they visit the site; in that same banner they can also see the various cookies and their categories, or change their choice.

You can also object to the use of cookies stored on your hard disk by disabling them in the relevant section of your browser. Browser manufacturers provide help pages on managing cookies in their products. See below for further information:

• Google Chrome
• Internet Explorer
• Mozilla Firefox
• Safari (Desktop)
• Safari (Mobile)
• Android browser
• Opera
• Opera Mobile

For other browsers, please see the documentation provided by the manufacturer.

5.4 – Limits on the transmission and disclosure of personal data

The data acquired through cookies is managed:

• by our employees and collaborators, as people designated and authorised to carry out the processing;
• by companies tasked with carrying out technical and organisational operations on our behalf (for example, web service providers).

The data acquired using cookies may be transferred abroad, since the companies named above have offices all over the world.

For more information on this, we suggest you check the privacy policies of the respective services. In addition to the opt-out options offered by the services listed, users can opt out of receiving cookies from a third-party service by visiting the Network Advertising Initiative opt-out page.

Privacy Notice for the psAico.ai app

Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR)

This notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) to users who use the psAico application via the web or via the Apple and Google Play stores. The use of the service is also governed by the Terms and Conditions available on the site.

psAico is a digital service designed to offer psychological help aimed at emotional well-being and personal reflection through a virtual assistant based on artificial intelligence. The service does not constitute a healthcare activity, does not perform diagnostic or therapeutic functions and does not replace the support of a qualified professional.

Data controller:

• psAico srls
• VAT number 02800830222
• Via Pranzelores 87 – 38121 Trento (TN) – Italy
• Email: info@psaico.ai
• PEC: psaico@namirialpec.it

1. Purpose and legal basis of the processing

To allow the operation of the service, the Data Controller may process, based on the functions used:

• account and profile data, such as email, username, protected password, name, surname, nickname, profile image, age, gender, reason for consultation, preferences and registration platform;
• contents inserted in the chat, answers, Technical Summaries, answers and scores of the questionnaires and related history;
• technical and usage data, such as duration and source of sessions, technical counters relating to the use of AI services, access data, IP address, security logs and information relating to cancellation requests;
• data necessary for email verification, two-factor authentication and, if activated, biometric access to the device. The backend can store the device name and its public key, but does not store the user's fingerprint or face;
• notification preferences, device tokens and technical push-notification delivery logs;
• subscription status and technical identifiers of subscriptions managed through payment providers or digital stores;
• messages and any attachments voluntarily sent to support, forwarded to the support mailbox;
• for the newsletter, email, name, surname, date and origin of consent, subscription or unsubscription status and technical data of delivery, non-delivery or complaint.

The user can insert particularly sensitive content relating, for example, to psychological well-being, emotional state or intimate aspects of their life. This information may fall into the special categories of personal data provided for by Article 9 GDPR.

The service applies technical minimisation, scrubbing and context reduction measures to limit the presence of direct identifiers and unnecessary content. However, free text may contain personal information and these measures do not guarantee complete anonymization.

The processing of data belonging to special categories is based on the explicit consent of the user under Article 9(2)(a) GDPR. Consent is requested through a specific declaration during registration; without such consent it is not possible to use the service. The Data Controller records the date and time of acceptance, the version of the notice and the channel through which it was collected.

The other purposes and legal bases are:

• registration, authentication, provision and customisation of the service, profile management, service notifications and assistance: execution of the service requested by the user under Article 6(1)(b) GDPR;
• management of payments, subscriptions and accounting and tax obligations: execution of the contract and fulfillment of legal obligations under Article 6(1)(b) and (c) GDPR;
• security, anti-spam verification, infrastructure protection, prevention of abuse and technical management: legitimate interest of the Data Controller under Article 6(1)(f) GDPR;
• analytics, measurement and unnecessary marketing tools: user consent under Article 6(1)(a) GDPR;
• newsletter and promotional communications: optional and separate consent under Article 6(1)(a) GDPR.

Consent to the processing of special-category data can be revoked at any time. Since this processing is necessary for the essential functions of psAico, revocation involves the cessation of use of the service and can be exercised by deleting the account from the Delete account item, accessible from the profile at the top right, or by contacting the Data Controller.

Marketing consent is optional, separate from the main service and revocable at any time via the unsubscribe link in the newsletters. The Data Controller records the date of consent, any revocation and the origin of the last choice.

The user is invited not to enter personal data relating to third parties or particularly sensitive information when it is not necessary.

2. Processing methods and recipients

The processing takes place using IT and telematic tools, with automated and, where necessary, manual methods, in compliance with the principles of lawfulness, correctness, transparency, minimisation and storage limitation. The Data Controller adopts adequate technical and organizational measures to protect confidentiality, integrity and availability of data and prevent unauthorized access, loss, alteration or unauthorized use.

The data may be processed by authorised personnel and selected service providers, within the limits necessary for their respective functions, belonging to the following categories: AI services, infrastructure and security, payments and digital stores, email and push communications, assistance, analytics and marketing. The updated list of data processors can be requested from the Data Controller.

Some providers may involve processing or transfers of data outside the European Economic Area. In such cases the Data Controller applies the guarantees provided for by Articles 44 et seq. GDPR, including, when applicable, adequacy decisions, Standard Contractual Clauses and additional measures.

3. Processing via third-party services (OpenAI)

To generate virtual assistant responses and Technical Summaries, psAico uses artificial intelligence services provided by OpenAI via API. Before sending, the service applies minimisation and scrubbing measures aimed at reducing direct identifiers and unnecessary information. These measures reduce the risk of identification, but cannot guarantee complete anonymization of the contents freely inserted by the user.

The data is transmitted to generate the response requested as part of the provision of the service. The processing may involve a transfer to countries outside the European Economic Area, including the United States, in compliance with the applicable guarantees pursuant to the GDPR.

For end user accounts psAico configures API calls with store=false, without requiring OpenAI to store the prompts and responses in the application. OpenAI can however generate technical and security logs for abuse prevention activities, stored according to the provider's policies and any applicable obligations.

The Data Controller does not use the contents of the conversations to independently train its artificial intelligence models.

4. Data retention

Personal data is stored for the time necessary for the purposes indicated and, in general, as long as the account remains active or until the user's rights are exercised, except for legal obligations or documented security needs.

Complete chat messages are retained by the Data Controller for a maximum period of 30 days and are subject to periodic automatic deletion. After this deadline, the system can keep a Technical Summary useful for the continuity of the service, associated with the account until the conversational memory or the account is deleted.

The memory clear function deletes user messages, summaries and questionnaires from the database. Only the technical logs necessary for operation, security or fulfillment of applicable obligations may remain.

The user can delete the account at any time. Deletion also entails the automatic termination of subscription to the newsletter and the removal of personal data which can be deleted. Only the data required by legal, fiscal and accounting obligations or necessary to document the management of the request can be stored, in a limited form or deprived of unnecessary identifiers.

Any residual data present in the backup copies, which are encrypted and subject to rotation, are overwritten within a maximum of 7 days.

At any time the user can use the functions available in the app to delete the conversational memory or exercise their rights by contacting the Data Controller at the contact details set out in this notice.

5. Nature of the provision of data

The provision of personal data is optional, but necessary to use the service. Without the data required for registration, authentication, security and provision of essential functions it is not possible to use the application correctly.

6. Rights of the data subject

The user can exercise the rights provided for by Articles 15–22 GDPR, including access, rectification, cancellation, limitation, opposition, revocation of consent and portability, when applicable. The revocation of consent does not affect the lawfulness of the processing carried out before the revocation.

The right to lodge a complaint with the Italian Data Protection Authority remains intact.

Requests can be sent to the Data Controller via PEC at the address psaico@namirialpec.it. The Data Controller responds without unjustified delay and within the terms established by Article 12 GDPR, except for the extensions permitted by law.

7. Minors

The application is reserved for people at least 18 years old. Registration requires declaration of age and it is not permitted to continue when an age under 18 is indicated. If the Data Controller becomes aware of the involuntary collection of data relating to minors, it will delete them as soon as possible.

8. Cookies and technical operating tools

The web version uses cookies or equivalent technologies necessary for session management, authentication, security and correct functioning of the service. The necessary tools also include Google reCAPTCHA, used to prevent automated access and abuse based on the technical data necessary for verification. The web app can also recall Google Fonts and Material Symbols graphic resources necessary for displaying the interface.

Only with the user's consent can statistical or marketing tools be activated via Google Tag Manager and Google Analytics 4, used to understand the use of the service and measure campaigns and conversions. Based on the expressed choice, data such as pages visited, URLs, referrers and campaign parameters may be processed.

The choice is stored in the technical cookie cc_cookie, shared on the .psaico.ai domain for a maximum of 182 days. The user can accept or reject the Statistics and Marketing categories separately and modify or revoke the choice at any time via the Cookie Preferences item of the web app.

The public site may provide further details in its cookie policy. This information does not replace this section: the preference is shared between psAico domains and the web app can also directly carry out the statistical and marketing treatments described above.

International addendum to the psAico Privacy Policy

1. Purpose, scope and precedence

This Addendum supplements the psAico Privacy Policy and applies to the processing of personal data of users located outside the European Union and the European Economic Area, when the law of the place where the user is located is applicable to the Service.

The general Privacy Policy and this Addendum must be read together. This Addendum does not limit the rights recognized by the general Privacy Policy.

In case of conflict, the mandatory provisions of the law applicable to the user prevail. To the extent compatible with this law, the provision that ensures the highest protection for the data subject applies.

The availability of the application in a digital store does not exclude the application of local legislation and does not replace any registrations, authorizations, impact assessments, local representatives or other preliminary obligations required in the country concerned.

2. Data Controller and contact details

The Data Controller is:

• psAico S.r.l.s. single shareholder
• Via Pranzelores 87 – 38121 Trento (TN) – Italy
• VAT number 02800830222
• Email: info@psaico.ai
• PEC: psaico@namirialpec.it

Requests relating to privacy can be sent to the contact details indicated above or via the assistance tools available in the application.

When local law requires the designation of a representative, privacy officer or contact person located in your country, their contact details must be made available before the Service is offered in that country and published in the Policy or through an easily accessible local notice.

3. Data processed and purposes

The categories of personal data processed, the purposes, methods of processing, recipients and storage times are described in the general Privacy Policy.

Depending on the features used, the processing may include account and profile data, Chat contents, Technical Summaries, questionnaires, technical and security data, data relating to authentication, notifications, subscriptions, assistance and newsletters.

Content freely inserted by the user may reveal information about psychological well-being, emotional state, health or intimate life. This information is treated as sensitive data or data belonging to special categories when applicable law requires it.

psAico invites the user not to enter personal data of third parties, direct identifiers or information that is not necessary for the provision of the Service.

4. Legal bases and consent

When the GDPR is applicable, the legal bases remain those indicated in the general Privacy Policy.

In other countries, psAico processes data on the basis of consent, the execution of the contract requested by the user, the fulfillment of legal obligations, the protection of security and other prerequisites recognized by local legislation.

The processing of content that reveals sensitive data is based on explicit consent when this is required by applicable law. The revocation of consent does not affect the lawfulness of the processing carried out before the revocation. If the processing of sensitive data is necessary for the essential functions of psAico, the revocation makes it impossible to continue using these functions and can be exercised by deleting the account or contacting the Data Controller.

Consent to the newsletter and promotional communications is optional, separate from the main Service and revocable at any time.

5. Processing using artificial intelligence

To generate virtual assistant responses and Technical Summaries, psAico uses artificial intelligence services provided by OpenAI via API.

Before sending, the Service applies minimisation, scrubbing and context reduction measures aimed at limiting the presence of direct identifiers and unnecessary information. Since free text may contain specific or identifying information, these measures reduce the risk of identification but do not guarantee complete or irreversible anonymization of the contents.

For end-user accounts, API calls are configured with store=false, without requiring OpenAI to store the prompts and responses. OpenAI can however generate technical and security logs for the prevention of abuse, stored according to the provider's policies and applicable obligations.

The Data Controller does not use conversations to independently train its artificial intelligence models.

6. No sale of data or behavioural advertising

psAico:

• does not sell users' personal data;
• does not license personal data to data brokers;
• does not use the content of conversations for behavioural advertising;
• does not share the content of conversations with advertisers;
• does not use sensitive data to create advertising segments;
• does not authorize OpenAI to use inputs or outputs sent via API to train its models.

The data may be communicated to technical service providers who operate on behalf of psAico, within the limits necessary for the provision, security and management of the Service, or when communication is required by law.

Any use of unnecessary analytics or marketing tools occurs within the limits and on the basis of consent described in the general Privacy Policy.

7. International transfers

Some providers may process data outside the country in which the user is located. These service providers may include, depending on the features used, artificial intelligence, infrastructure and security services, digital stores, email and push communications, assistance, analytics and marketing.

When an international transfer of personal data occurs, psAico adopts the guarantees required by applicable law, which may include:

• adequacy decisions or equivalent mechanisms;
• Standard Contractual Clauses or model clauses recognized by local law;
• data processing agreements;
• impact or transfer risk assessments;
• explicit consent, only when it constitutes a valid mechanism for the transfer concerned;
• additional technical and organizational measures;
• authorizations from the competent authority, when mandatory.

A description of the applicable guarantees may be requested from the Data Controller, to the extent permitted by law and without prejudice to confidential or security-related elements.

8. Retention and deletion

The data is stored for the periods indicated in the general Privacy Policy. In particular:

• the complete Chat messages are kept by the Data Controller for a maximum period of 30 days and are subject to periodic automatic deletion;
• after this deadline, the system may retain a Technical Summary associated with the account until the conversational memory or the account is deleted;
• clearing the memory eliminates messages, Technical Summaries and user questionnaires from the database;
• administrative, accounting and fiscal data may be retained for the periods required by law;
• technical and security logs are retained to the extent necessary for operation, security and management of applicable obligations;
• any residual data present in the backup copies, encrypted and subject to rotation, are overwritten within a maximum of 7 days.

Deletion of the account also involves the automatic termination of the newsletter subscription and the removal of personal data which can be deleted. Only data that must be retained for legal, fiscal and accounting obligations, to document the management of the request or for security and legal protection requirements permitted by law are excluded.

9. User rights

Regardless of the country of residence and within the technically and legally applicable limits, the user can request:

• confirmation of the existence of personal data concerning them;
• access to your data and information on processing;
• correcting or updating inaccurate or incomplete data;
• data deletion;
• limitation or suspension of treatment;
• opposition to certain treatments;
• portability of the data provided by the user;
• revocation of consent previously given;
• information on recipients and international transfers;
• human intervention or review when the law recognizes rights relating to automated processes;
• review of a previously rejected privacy request;
• complaint to the competent authority.

psAico may request information reasonably necessary to verify the applicant's identity and prevent unauthorized access. Requests are handled free of charge and within the terms established by applicable law, except in cases of manifestly unfounded, excessive or repetitive requests in which the law allows a refusal or the charging of a reasonable cost.

10. Regional protections

Switzerland

The Federal Data Protection Act applies to users in Switzerland. The user can contact the Federal Data Protection and Information Commissioner.

When the processing connected to the offering of the Service is regular, on a large scale and presents a high risk, psAico must designate and publish the contact details of a representative in Switzerland.

Australia and New Zealand

Users in Australia can exercise their rights under the Privacy Act 1988 and complain to the Office of the Australian Information Commissioner.

Users in New Zealand can exercise their rights under the Privacy Act 2020 and complain to the Office of the Privacy Commissioner.

Latin America

Users in Latin American countries in which the Service is available are entitled to the rights provided for by the respective national legislation, including, when applicable, access, information, rectification, updating, cancellation, opposition, portability and revocation of consent.

Requests can be addressed to psAico and, in case of failure to resolve, to the competent national authority. Local obligations regarding the registration of databases, designation of representatives or delegates, impact assessment and regulation of international transfers remain unchanged. In Chile, law no. 21.719 and the related new regime apply from the date of entry into force established by law.

Asia and the Pacific

Users in the countries of Asia and the Pacific area in which the Service is available are entitled to the rights recognized by the respective national legislation.

Where applicable, psAico must designate a data protection officer or local representative, register processing systems, document impact assessments, adopt safeguards for cross-border transfers and comply with local requirements relating to consent for sensitive data.

Middle East

Users in the Middle Eastern countries where the Service is available are entitled to the rights provided by local law.

In some of these countries, the processing of information freely entered by the user that reveals data relating to health or psychological condition and the transfer of data abroad require registrations, permits or prior authorizations. This Addendum does not replace these obligations.

Other countries

If the legislation of the user's country recognizes additional rights, guarantees, limitations or mandatory complaint tools, these provisions apply and integrate this Addendum.

11. Minors

The Service is intended exclusively for persons who are 18 years of age or older.

psAico does not knowingly collect personal data from minors. If it is ascertained that a minor has created an account or provided personal data, psAico will suspend the account and delete the data as soon as possible, without prejudice to legal obligations and the protection needs of the person concerned.

12. Territorial availability

The Service is offered exclusively in countries and territories selected by psAico in digital stores, supported by essential technology providers and in which applicable obligations can be respected.

For users residing outside Italy, any subscription to the Service is offered exclusively through the Apple App Store or Google Play. The website does not constitute a channel for selling subscriptions to such users.

The Service is not offered:

• in the United States of America;
• in Brazil;
• in countries or territories not supported by essential technology providers;
• in territories subject to sanctions, embargoes or legal restrictions incompatible with the provision of the Service;
• in countries in which a mandatory mandatory preliminary requirement has not been completed.

The mere technical possibility of downloading the application does not guarantee that registration, purchase or use of the Service is permitted in all places. psAico may prevent registration, purchase, or access from an unsupported or suspended territory, even if the application was previously downloaded in another country.

13. Complaints

The user is invited to initially contact psAico using the contact details indicated in this Addendum.

This remains without prejudice to the right to lodge a complaint with the competent authority in the country of residence, in the place where the user is located or in the place where the alleged infringement occurred, in accordance with the applicable law.

14. Changes and languages

Substantial changes to this Addendum are communicated in an appropriate manner, for example by email, notice in the application or request for new acceptance, when required by law.

The translations of this Addendum are prepared to facilitate understanding. In case of interpretative differences, the Italian version prevails exclusively within the limits permitted by applicable law. The mandatory rights recognized to the user in their own country remain at all times unaffected.