Privacy Policy

Giotto.ai SA (CHE 300.132.471), with registered office at Place de la Gare 4, c/o Fiduconsult Lausanne SA, 1003, Lausanne, Switzerland (“Giotto.ai” or “Controller”) herein provides its website privacy policy (“Privacy Policy”) for the processing of personal data (“Data”) collected and processed on its website giotto.ai (“Website”) and/or on Giotto.ai’s proprietary AI model and software, consisting of a containerised intelligence designed to integrate advanced reasoning capabilities into artificial intelligence systems (“Model”), in relation to individuals (“Data Subjects” or “you”) who:

• purchase or inquire about Giotto.ai’s products and/or services as end customers (“Customers”);
• register an account or fill in any contact or purchase form available on the Website (“Forms”);
• use the Model, and/or browse the Website via cookies and other similar tracking technologies (“Cookies”).

This Privacy Policy is addressed to individual users of the Website and the Model and is intended to provide clear, transparent and accessible information about how we collect and use your personal data, in compliance with Regulation (EU) 2016/679 (“GDPR”).

The Model is not addressed to minors under age 13. Any processing of data of children under 13 is not intentional.

1. Processing through Contact Form and the use of the Model

1.1. Categories of Data. Through the Forms and the use of the Model, Giotto.ai collects the following categories of Data, depending on the specific interaction:

(a) Identification data such as, name, email address, and phone number when the Customer creates an account, sends an inquiry or a support request, fills in a Form or otherwise requests information.

(b) Log data concerning the Customer’s use of the Model.

Data marked with an asterisk (*) in the relevant Forms are mandatory for the purpose indicated. Failure to provide mandatory data will prevent Giotto.ai from fulfilling the relevant request, registering an account or completing the purchase. All other fields are optional.

For Services which are not provided on a free basis, Giotto.ai may collect payment data and, where required, shipping information.

Giotto.ai may also collect and process personal data provided by the Customer during the use of the Model, including personal data provided in the context of support requests, feedbacks or other communications with Giotto.ai.

However, where the Customer processes personal data relating to third parties in its capacity as controller, by determining the purposes and means of such processing, we process such personal data on behalf of the Customer, the Data Processing Addendum shall apply

1.2.1. Performance of a Contract. Where you purchase a product or service, or take steps preparatory to such purchase (e.g. creating an account, placing an order), Giotto.ai processes your Data – both manually and through electronic (also automated) means – to the extent necessary for the following purposes:

• processing and fulfilling your registration;
• managing returns, refunds, and statutory or contractual warranty claims;
• providing customer support related to your purchase and/or the use of the Model;
• respond to your requests;
• managing your customer account.
• send communication strictly related to the functioning of the Model.

1.2.2. Marketing and Promotional Communications. Giotto.ai may process your Data to send you marketing communications (by email or other electronic means) regarding its products, services, promotions and commercial initiatives. Your freely given, specific, informed and unambiguous consent (GDPR, Art. 6(1)(a); Art. 7). Consent is obtained via an unticked opt-in checkbox at the point of data collection and is entirely separate from any consent required for the performance of a contract or other purposes.

Nature of provision: Voluntary and optional. You may refuse to provide consent without any consequence on your ability to purchase from or otherwise use the Website and/or the Model.

Right to withdraw: You may withdraw your consent at any time and with the same ease with which it was given (e.g., by clicking the “unsubscribe” link in any marketing email, or by contacting us at support@giotto.ai). Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

1.2.3. Legal obligation. Giotto.ai may process your Data where required to comply with a legal obligation applicable to it, including (without limitation): responding to requests from competent public authorities; complying with tax, accounting and anti-money laundering obligations; fulfilling mandatory data disclosure requirements under applicable law (GDPR, Art. 6(1)(c)).

1.2.4. Legitimate interest. Giotto.ai may process your Data, to the extent strictly necessary, for the following purposes based on its legitimate interest:

a. preserving, exercising and defending rights, managing actual or potential disputes, preventing or responding to unlawful conduct or contractual breaches, and retaining the evidence necessary to protect our legal and economic position based on the legitimate interest to protect and/or assert its legal rights and interests before courts or in out-of-court dispute resolution proceeding;

b. processing feedbacks, identifying technical, functional or usability issues, assessing performance and reliability, developing and testing improvements, and enhancing the quality, security and efficiency of Model for Customers, on the basis of Giotto.ai’s legitimate interest to improve its services and products;

c. To prevent and investigate fraud, abuse, and violations as well as security issues on the basis of the legitimate interest of Giotto.ai and its Customers to grant security as well as to Giotto.ai’s legitimate interest to cooperate with authorites and protect its business;

d. assessing, negotiating, planning and implementing such transactions, carrying out the related legal, financial, technical and commercial due diligence, ensuring business continuity, and protecting the value and integrity of our business, assets and contractual relationship on the basis of Giotto.ai’s legitimate interest to manage extraordinary corporate transactions (e.g. mergers, acquisitions, transfers of business), provided that appropriate confidentiality safeguards are in place for the Data Subjects' information;

e. producing statistics and forecasts on Customer’s requests and demands on the basis of Giotto.ai’s legitimate interest to improve its services and products.

Legitimate interest of the Controller (GDPR, Art. 6(1)(f)), will be duly balanced against the fundamental rights and freedoms of Data Subjects. Legitimate interest is not used by Giotto.ai as a legal basis for any marketing or promotional activity. You have the right to object to processing based on legitimate interest at any time (see Section 5 below).

1.3. Mandatory/Voluntary nature of Data provision. Provision of Data for the purposes under par. 1.2.1 is voluntary and, therefore, freely revokable anytime. Provision of Data for the purposes under par. 1.2.1,1.2.3, 1.2.4 a) and c) is mandatory, as lacking such provision Giotto.ai could not fulfil its legal obligations.

2. Processing via Cookies or tracking tools

2.1. Tracking tools used by Giotto.ai

The Website and the Model use Cookies and/or other tracking tools. A Cookie is a small text file containing tiny amounts of information which are downloaded to your device when you visit a website. Cookies are then sent back to the same website each time you visit it, or to another website that recognizes such Cookies. Cookies are not computer programs and cannot read information saved on your hard drive. Cookies cannot carry viruses, install malware, or record your email address. They only contain and transfer to the Website as much information as the Data Subjects themselves have disclosed to the Website.

This is a list of the Cookies set and used by Giotto.ai, including details of the relevant purposes. We will update this list as we make changes to Website’s or Model’s functionalities. We reserve the right to add, remove or change the Cookies hosted on our Website or the Model from time to time.

Necessary Cookies

Necessary Cookies aim at providing basic-functions necessary to enable your user experience through the Website and the Model, e.g. activating the webpage and – where applicable – secure access to certain areas of the Website or the Model. The Website and the Model cannot work properly without the usage of Necessary Cookies.

3. Sharing of Data

Data may be shared with the following categories of recipients:

3.1. Giotto.ai’s personnel, to whom Controller has provided suitable instructions concerning the fulfilments and measures to be adopted while processing Data;

3.2. Public bodies in charge with audits, controls or law-enforcement related to the proper fulfilment of the above-mentioned purposes;

3.3. Third parties to whom the transfer is necessary to the performance of Giotto.ai’s business activities, with specific reference to entities, individuals, associations having administrative, accountant, information technology, tax and legal purposes, in their capacity as controllers or processors;

3.4. Other third parties, who are entitled to receive Data in accordance with legal provisions and regulations.

Personal data are not subject to dissemination.

3.5. Where your Data are transferred outside the EEA or Switzerland to countries not recognised as providing an adequate level of data protection by the European Commission, Giotto.ai ensures that such transfers are subject to appropriate safeguards, specifically the Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to GDPR Art. 46(2)(c), as supplemented where required by applicable transfer impact assessments.

A list of the third countries to which Data may be transferred, together with copies of or links to the applicable safeguards, is available upon request by contacting support@giotto.ai. You are entitled to obtain a copy of such safeguards pursuant to GDPR Art. 15(2) and Section 5 of this Privacy Policy.

4. Data retention

Without prejudice to specific legal obligations, Data are stored for different time periods, depending also on the relevant purpose of the processing. Specifically, and unless a further retention period is required by potential judicial claims, requests from public bodies or law provisions and regulations, Data are retained for the following periods, after which they are permanently erased or irreversibly anonymised:

(a) Data processed for performance of a contract (par. 1.2.1): for the duration of the contractual relationship and, thereafter, for up to 10 years to comply with applicable civil law and tax/accounting obligations. Data processed in connection with statutory or contractual warranties are retained for the duration of the applicable warranty period.

(b) Data processed for marketing (par. 1.2.2): until withdrawal of consent, or for a maximum period of 24 months from the date of collection, whichever is earlier. Upon expiry or withdrawal, Data will no longer be used for marketing purposes.

(d) Data processed for legal obligations (par. 1.2.3): for the period required by the applicable legal or regulatory obligation (e.g. 10 years for tax records under Italian/Swiss law).

(e) Data processed for legitimate interest (par. 1.2.4): for the period necessary to conclude the relevant corporate transaction or to finally resolve the relevant legal dispute, including any applicable appeal periods.

(f) Cookie data: as indicated in the cookie table in Section 2.

5. Rights of Data Subjects

Data Subjects, in accordance with GDPR, are granted with the following Data-related rights:

5.1. right to be informed about purposes and modalities of the processing;

5.2. right to access;

5.3. right to obtain a copy of Data

5.4. where such Data are stored extra-EEA, right to obtain information on the relevant third country of storage;

5.5. right to rectification, update or integration;

5.6. right to request erasure, anonymization or block of the processing;

5.7. right to object, in whole or in part, to any processing through automated means, including profiling;

5.8. right to revoke their consent, freely and anytime;

5.9. right to Data portability, i.e. the right to receive their Data in a structured, machine-readable format, commonly used and readable through automated devices, as well as the possibility to transfer such data to another controller;

5.10. right to request the limitation of the processing;

5.11. right to contact Controller’s data protection officer (where appointed)

5.12. right to lodge a complaint with the relevant supervisory authority.

How to exercise your rights: You may exercise any of the rights listed above at any time by:

• sending an email to support@giotto.ai with the subject line "Privacy Rights Request";
• for the right to withdraw marketing consent specifically: clicking the "Unsubscribe" link at the bottom of any marketing email sent by Giotto.ai.

Giotto.ai will respond to your request without undue delay and in any event within one (1) month of receipt, as required by GDPR Art. 12. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests, provided that you are informed of such extension within the first month.

You also have the right to lodge a complaint with the competent supervisory authority. If you are located in the EU, the relevant authority is the Data Protection Authority of your country of residence. If you are located in Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC).

6. Controller’s contact details

Controller’s registered office is at Place de la Gare 4, c/o Fiduconsult Lausanne SA, 1003, Lausanne, Switzerland. If you believe your personal data has been used in a way that is not consistent with this Privacy Policy, or if you have any questions or a request in relation to the processing of your Data, please contact us at support@giotto.ai.

7. Final provisions

Controller may amend / modify, in whole or in part, this Privacy Policy, in case of amendments to the processing activities herein detailed or existing law provisions and regulations. Please refer to the last version of this Privacy Policy available on the Website from time to time.

Last update: July 2026