This notice describes how personal data is processed in connection with GRADO HR, the multi-tenant cloud platform for human resources management (employee records, time clock, shifts and absences, digital payslips) operated by GRADO TECH Srls. It is issued pursuant to Arts. 13 and 14 of EU Regulation 2016/679 (GDPR) and supplements the general privacy notice published on the GRADO Tech website.

How the service works

GRADO HR is SaaS software: the client company manages data in its own workspace. The role of GRADO TECH Srls varies depending on context:

• Worker and organisation data (Part A): the client company is the data controller; GRADO TECH Srls acts as data processor under Art. 28 GDPR, solely for technical service delivery and hosting.
• Access to data by GRADO Tech (Part B): GRADO TECH Srls does not freely access workspace content; access is permitted only in the cases and manner described therein.
• Contractual and administrative data (Part C): for registration, subscription, billing and management of platform operator accounts, GRADO TECH Srls is the data controller.
• Integrations (Part E): GRADO HR may connect to GRADO Security (records sync) and to Google sign-in if the user links it from their profile.
• Artificial intelligence (Part E): GRADO HR may include features assisted by generative and vision artificial intelligence systems, which the client company acting as controller may activate. Activation requires an API key in the workspace, the controller's own or one supplied by GRADO TECH Srls (see API keys). Such features are used exclusively for the purposes described in this notice and do not autonomously make decisions relating to hiring, termination of employment, pay, promotion, discipline, professional assessment or classification of workers. AI outputs, where provided, constitute technical or support information subject to human supervision. Use of AI features complies with Regulation (EU) 2016/679 (GDPR), Regulation (EU) 2024/1689 (AI Act), Italian Law No. 132 of 23 September 2025 and applicable national employment law.

Part A — Data entered by client companies

This section applies to personal data that the client company (or a party authorised by it) enters, uploads or generates on GRADO HR in connection with its workers and organisation. Such data remains under the control and responsibility of the controller; GRADO TECH Srls only hosts, stores and makes it available according to the contract and received instructions.

Roles in processing

For the data described in this Part A:

• the data controller is the client company that manages the workspace and determines purposes and means of processing in relation to its workers;
• GRADO TECH Srls (registered office Corso Umberto I, 7 — 66050 San Salvo (CH), Italy. VAT IT02868240694) acts as data processor, on the basis of the service contract and Art. 28 GDPR agreement, to host, store, technically organise and make data available on the platform;
• consultants, payroll firms or other parties authorised by the company may act as independent controllers, processors or controller's appointees: GRADO TECH Srls does not determine their purposes.

The controller must provide workers and data subjects with a GDPR-compliant privacy notice (Arts. 13–14) and have a valid legal basis for each processing activity, including those relating to the employment relationship, time clock/geolocation and payroll documents.

Platform modules

GRADO HR is organised into modules activated by the controller. Depending on workspace configuration, data may be processed in relation to:

• Records and organisation: employees, sites, job roles, contracts, clients, areas, projects/jobs and assignments.
• Time clock: attendance via QR/NFC/manual entry. If enabled by the controller, geolocation is collected only at the moment of stamping (clock-in/out or service start/end) to verify consistency with the expected location: GRADO HR does not continuously track the worker's position outside those operations.
• Shifts and absences: shift planning, absence requests, balances, shift swaps and related attachments. For authorised staff, discrepancies between planned shifts and actual stampings may be highlighted (e.g. missing clock-in, lateness, early leave or missing clock-out).
• Payslips: upload, publishing and consultation of digital payslips encrypted at rest, with encrypted net amounts, amounts hidden in lists, read/acknowledgement tracking and notifications. Access is limited to the employee who owns the payslip and to staff expressly authorised in the workspace.
• Accounts, authentication and permissions: local accounts (login identifier/email and password stored exclusively as an irreversible hash), granular roles and permissions, multi-factor authentication (MFA/TOTP) that the user can enable, optional linking of an existing Google account (no account created automatically) and technical session, CSRF and MFA cookies.
• GRADO Security bridge: sync of employee records, sites and job roles between HR and Security, if linked.
• RENTRI (optional module): operator credentials and documents/registers needed to interact with the public waste-traceability system, where activated.
• Photo check and artificial intelligence (optional modules, activated by the controller): technical check of service-evidence photos; optional analysis, in admin, of payslip samples to configure import rules; assistance with wording photo criteria.

GRADO HR does not include individual performance evaluation, OKR or employee ranking modules.

Categories of data processed on the platform

Depending on activated modules, the platform may process, among others, the following data entered or generated by the controller:

• Worker identification data: name, surname, tax code, sex, date and place of birth, nationality, profile photo.
• Identity documents: type, number, expiry date and digital copies (front/back) uploaded by the controller.
• Contacts: personal and/or work email, mobile, phone, emergency contact.
• Addresses: residence and domicile.
• Employment and payroll-related data: employee number, hiring/termination dates, contract type, level, job role, site/placement, hours, IBAN, schedules and notes/custom fields.
• Attendance, stampings and geolocation: date and time of stampings, type (presence clock-in/out or service start/end), source (QR/NFC/manual), tag/area/job, IP address and user-agent. If enabled by the controller, latitude, longitude and accuracy are recorded only at the moment of stamping, not on a continuous basis.
• Shifts, absences, balances and discrepancies: schedules, requests, statuses, notes, absence attachments, shift swaps, calendar exports and, for authorised staff, discrepancy flags between planned shifts and stampings (e.g. missing clock-in/out, lateness or early leave).
• Payslip documents: PDF payslip files/versions encrypted at rest, net amounts encrypted in the database, publication dates, view/acknowledgement outcomes and related metadata (e.g. acknowledgement IP). Files and amounts are decrypted only when an authenticated, authorised user requests them.
• Organisation and clients: sites, clients (including tax code/VAT and contacts), jobs/projects, areas and employee assignments.
• Users and authentication: login identifier, email, irreversibly hashed password, roles and permissions, MFA status, TOTP secrets and recovery codes stored in encrypted form (recovery codes as hashes), optional Google identifier and Google email if the user has linked the account, login logs and failed-attempt records, technical session/CSRF/MFA cookies.
• Audit and technical logs: operation records, stamping errors, sent notifications and security traces.
• Data synced with GRADO Security: employee records, sites and job roles exchanged via bridge, where the link is active.
• RENTRI (if activated): data and documents needed to operate with the public system (operator credentials, registers, FIR forms and attachments), within the module scope.
• Service photos and AI outcomes (if the controller enables photo check): work images, pass/retake outcomes, in-app acknowledgement of the AI notice (documentation of information provided, not consent), photo-criteria configuration and, if template analysis is used, sampled text — after minimisation — from example payslip PDFs.
• AI service credentials (if configured): API keys or tokens for providers chosen by the controller or supplied by GRADO TECH Srls, stored encrypted at rest; the interface shows only a mask (last digits), not the full value. Usage metadata may be recorded (provider, model, feature, token counts, estimated cost), without request content or the key in the clear.

Purposes of processing (on behalf of the controller)

GRADO TECH Srls processes Part A data exclusively on behalf of the controller and limited to the following technical purposes:

• delivery, hosting and maintenance of the GRADO HR platform and activated modules (records, time clock, shifts, payslips, integrations, AI photo check, notifications, exports, etc.);
• execution of the controller's documented instructions, including storage, backup, recovery and deletion of data as agreed;
• IT security, abuse prevention, operational continuity and compliance with legal obligations applicable to the processor;
• technical support within the limits of Part B. GRADO TECH Srls does not use client company data for its own marketing, commercial profiling, resale or independent analysis not strictly necessary for service delivery.

Legal basis

For worker and organisation data processed via GRADO HR, determining the purposes and the relevant legal basis is the responsibility of the client company as data controller.

Depending on the features used and the specific context, the controller may rely, among others, on performance of the employment relationship, compliance with legal obligations, exercise of rights and obligations in employment law or, where the requirements are actually met, legitimate interest.

Worker consent is not the ordinary legal basis for processing necessary to manage the employment relationship and is used only where it can genuinely be free, specific, informed and revocable without negative consequences for the data subject.

For processing carried out on behalf of the client company, GRADO TECH Srls acts as processor under Art. 28 GDPR and processes data exclusively on the basis of the controller's documented instructions, the service contract and the data processing agreement. Any processing by GRADO TECH Srls for its own independent purposes, such as security of its infrastructure, contract management, billing or protection of its own rights, is governed separately in Part C of this notice and is based on the legal basis applicable in each case.

Retention

Retention periods for Part A data are determined by the controller, in compliance with employment, social security, tax and safety law. GRADO TECH Srls retains data for the duration of the contract and thereafter for the period strictly necessary for orderly service termination, recovery at the controller's request or legal obligations. Upon termination, data is returned or deleted as provided in the contract and Art. 28 agreement, unless otherwise documented or required by law.

• Stampings and attendance: according to the controller's choices and applicable legal obligations relating to the employment relationship.
• Shifts, absences and related documents: for as long as necessary to manage the employment relationship and meet applicable requirements.
• Payslips and payroll documents: according to tax, social security and legal obligations determined by the controller.
• Service photos, AI outcomes and related logs (if enabled): for a period defined by the controller, consistent with the purpose and any workspace configuration.
• Technical assistance logs: generally no longer than 12 months, unless disputes or legal obligations require otherwise (see Part B).
• AI service API keys and usage metadata: until removed by the controller or the workspace ends; usage metadata is kept for as long as needed to monitor consumption and billing, according to the controller's choices and the contract.

Part B — Access to data by GRADO TECH Srls

GRADO TECH Srls does not freely access, consult or use content in the HR workspace without a lawful and documented basis. Access by authorised personnel is permitted only in the following cases:

• Explicit delegation or authorisation by the controller: upon written request, email, ticket or official documentable communication;
• Strictly necessary technical assistance: interventions limited in time and scope to what is indispensable to diagnose malfunctions, configure modules, restore service or respond to reports;
• Legal obligations: court orders or mandatory legal obligations, with notification to the controller where permitted;
• Platform security: aggregated monitoring or technical metadata without the purpose of consulting substantive content, except as strictly necessary to manage security incidents.

Any access is limited to authorised staff, subject to confidentiality, logged where technically possible and limited to the duration of the intervention. GRADO TECH Srls does not sell data and does not disclose it to third parties for its own marketing or profiling purposes.

Access logging

The platform records relevant operations (audit logs, user access, changes, stamping errors) to enable the controller to monitor activities. Technical assistance logs are retained for the time necessary for the contractual relationship, security and traceability, generally no longer than 12 months unless disputes or legal obligations require otherwise.

Part C — Data for which GRADO TECH Srls is controller

This section applies to personal data collected directly by GRADO TECH Srls in connection with registration, subscription, billing, commercial and contractual communications and management of platform administrative accounts.

Data controller

The data controller for Part C data is GRADO TECH Srls, registered office Corso Umberto I, 7 — 66050 San Salvo (CH), Italy. VAT IT02868240694. Email: info@gradotech.it — Phone: +39 378 421 3717.

Categories of data

• Identification and contact data: name, surname, email, phone, company name, VAT number of the requesting company.
• Contractual and billing data: subscribed plan, payments, invoices, order history.
• Credentials and access: username/identifier, password (irreversible hash), optional MFA (status and encrypted TOTP secrets), optional Google link (Google identifier and email), platform roles, access logs, technical cookies.
• Communications: information requests, commercial support, assistance and newsletters where subscribed.

Purposes

• Management of registration and contractual relationship.
• Billing, payment collection and tax and administrative compliance.
• Service communications, platform updates and, where consent is required, commercial communications.
• Security, fraud prevention and management of complaints or disputes.

Legal basis

Performance of contract or pre-contractual measures (Art. 6(1)(b) GDPR); compliance with legal obligations (Art. 6(1)(c) GDPR); legitimate interest in security and relationship management (Art. 6(1)(f) GDPR); consent for optional marketing activities (Art. 6(1)(a) GDPR), revocable at any time.

Part D — Rights of workers and data subjects

Data relating to workers and other parties entered by the company on GRADO HR is processed by the data controller (the client company). Therefore:

• data subjects must exercise rights under Arts. 15–22 GDPR primarily with their employer / controller as indicated in the company privacy notice;
• they may write to info@gradotech.it for requests relating to data hosted on the platform: GRADO TECH Srls, as processor, will forward the request to the controller or respond within the limits of its role;
• the right to lodge a complaint with the Italian Data Protection Authority always remains (www.garanteprivacy.it).

The controller is responsible for providing workers with a complete and up-to-date privacy notice on processing carried out via GRADO HR, including any geolocation of stampings and, if enabled, AI photo check.

Rights connected with automated processing and artificial intelligence

Workers may contact their employer, as data controller, to obtain information on personal data processing carried out through artificial intelligence features and to exercise the rights under Arts. 15–22 GDPR.

Where a result produced by an artificial intelligence feature has been used as part of a human assessment, the worker may ask the controller for information on the processing of their data and, within the limits of applicable law, rectification of inaccurate data and verification of the outcome.

GRADO HR does not provide, for the features described in this notice, exclusively automated decisions producing legal effects or similarly significant effects on the worker.

Part E — Integrations, artificial intelligence, sub-processors and transfers

Integrations with other GRADO services and third-party systems

GRADO HR may interact with the following services only if activated or used by the controller:

• Local authentication and MFA: login with workspace credentials (password stored as an irreversible hash, never available in plain text). The user may enable multi-factor authentication (MFA) via a TOTP authenticator app (e.g. Google Authenticator, Authy). The TOTP secret is stored encrypted; recovery codes are stored as hashes. The code can be required at every sign-in, or the device can be remembered for 1, 7, 30 or 90 days via the technical cookie mfa_remember.
• Google sign-in (optional, user-activated): an already authenticated user can link a Google account from their profile (scopes openid, email, profile). After that, “Sign in with Google” opens that same account. An unlinked Google account cannot sign in and does not create a new user. The Google identifier and associated email are stored; the user can unlink Google at any time. Google LLC processes sign-in data under its own privacy notice, on Google’s domain.
• GRADO Security (bridge): sync of employee records, sites and job roles between linked workspaces, within the limits of the controller's configuration.
• Email and password security checks: sending of service notifications and, where enabled, compromised-password checks via k-anonymity services (without transmitting the password in clear text).
• Artificial intelligence models (optional, activated by the controller): require an API key in the workspace, which may be the controller's own or supplied by GRADO TECH Srls (see API keys). Supported providers include OpenAI, Anthropic (Claude), Google Gemini / Vertex AI and Amazon Bedrock, for service photo check and, in admin, optional payslip-sample analysis and prompt-writing assistance. Data sent to the models is limited to what is strictly necessary, with minimisation before sending. Evidence photos, in production and staging under a strict EU policy, are stored on AWS object storage in an EU region with KMS encryption. Location, retention and training at the AI provider depend on who supplies the key.

Access, Google and multi-factor authentication (MFA)

Access to GRADO HR is named and is limited to accounts already created by the controller in the workspace. In short:

• Local credentials: identifier (typically the tax code for employees) and password, stored exclusively as an irreversible hash. Password reset by email is available, without account enumeration.
• Google: an authenticated user can link a Google account from the profile. “Sign in with Google” opens that same user. An unlinked Google account cannot sign in and does not create an account. The user can unlink Google at any time.
• MFA (TOTP): the user scans a QR with an authenticator app (Google Authenticator, Authy or similar), confirms a 6-digit code and receives 8 recovery codes to keep. The secret is encrypted. If MFA is on, it is also required after Google sign-in.
• Permissions: granular roles and permissions per module (e.g. own payslips vs staff payslips). Unauthorised people do not see the data, even if they are signed in to the same workspace.

Cookies on the GRADO HR platform

The hr.gradotech.it platform uses first-party technical cookies only, needed for sign-in and security. It does not use profiling or marketing cookies. Google (third-party) cookies appear only if the user chooses “Sign in with Google”, and are set on Google’s domain, not on the HR domain.

Disabling technical cookies prevents sign-in and use of the platform. Google cookies can be avoided by not using “Sign in with Google”. For browser instructions, see the GRADO Tech website Cookie Policy.

Artificial intelligence features

GRADO HR may make features assisted by generative and vision artificial intelligence systems available to the client company. Such features remain off until at least one API key is configured in the workspace (the controller's own or one supplied by GRADO TECH Srls) and are enabled according to the configuration chosen by the client company.

Artificial intelligence is used as a support tool and does not replace the responsibilities and assessments of people authorised by the company.

Principles of use

GRADO HR artificial intelligence features are designed so that:

• the user is informed when a given operation uses an artificial intelligence system;
• only the data necessary to perform the requested function is processed;
• AI outputs can be verified, ignored or corrected by an authorised person where relevant;
• AI does not autonomously make decisions relating to hiring, dismissal, promotion, pay, discipline or other decisions likely to produce legal or similarly significant effects on the worker;
• rankings, productivity scores or behavioural profiles of workers are not created through the features described in this notice;
• emotion recognition systems are not used in the workplace;
• biometric identification or facial recognition of workers is not carried out through the features described in this notice;
• special categories of personal data, sensitive characteristics, opinions, health conditions, orientations or other personal characteristics not necessary to the requested function are not inferred through AI.

Service photo check

Where activated by the company, the photo check feature allows a service evidence photograph to be submitted to an artificial intelligence model in order to carry out technical or procedural checks defined in advance.

By way of example, the system may verify:

• that the photograph is sufficiently sharp and well lit;
• that the required object, area or activity is visible;
• that elements expressly required by the company are present, such as specific personal protective equipment;
• that the image can be used as evidence of the required activity.

Before processing, the image may be resized and subject to data minimisation measures.

Photo check does not perform facial recognition, biometric identification, emotion recognition, worker rankings, individual productivity scoring or automatic disciplinary decisions. It checks only technical aspects of the image and required elements (for example subject visibility, sharpness, presence of configured PPE where applicable).

The AI outcome relates exclusively to the check requested on the photograph and may indicate, for example, that the image is usable or must be retaken.

Where the outcome may have further consequences for the worker, it must be reviewed by a person authorised by the company and cannot be used as the sole automated basis for a decision with legal or similarly significant effects.

The client company determines, under its own responsibility, whether and how outcomes may subsequently be used in the employment relationship, in compliance with the GDPR, employment law and, where applicable, Art. 4 of Italian Law No. 300 of 20 May 1970.

In short, AI photo check verifies the technical usability of the photographic evidence and does not assess the person, their productivity or the employment relationship.

Personal data in images

Images may contain personal data relating to the worker or other people accidentally captured.

GRADO HR applies minimisation measures to reduce data sent to the AI system to what is strictly necessary for the requested check. Where technically possible and compatible with the purpose of the feature, unnecessary information may be excluded, obscured or reduced before processing.

Photographs are not used by GRADO TECH Srls to create biometric databases, recognise people's identity or autonomously train facial recognition models.

The presence of special categories of personal data in the image does not lead to their use to deduce or classify sensitive characteristics of the person.

Optional analysis of payslip samples

Authorised administrators may use an optional feature to analyse a limited number of sample documents in order to configure the technical rules needed to import payslips. Only sampled text extracted from the PDFs is sent to the AI, not the full files.

Before sending to the artificial intelligence system, the controller or authorised administrator must apply minimisation and redaction of unnecessary data. In particular, unless strictly necessary for the technical purpose, names, tax codes, bank details, health information, trade union membership information and other data not essential to determine the document structure must not be transmitted. The platform may automatically replace monetary amounts with generic placeholders; redaction of other personal data remains the controller's responsibility.

The feature does not calculate pay, does not determine payslip content and does not make decisions concerning the worker.

Use of AI is optional for the administrator: configuration can also be done through manual rules and presets.

AI analysis of payslip samples is an administrative configuration tool and does not involve pay assessments or employment decisions.

Configuration assistance

Administrators may use artificial intelligence tools to improve or structure the text of criteria used in photo checks.

Unless the administrator independently enters unnecessary personal information, this feature does not require identity, payroll or other personal information relating to workers.

Automated decisions

The artificial intelligence features described in this notice are not intended to make decisions based solely on automated processing that produce legal effects on the worker or similarly significantly affect them under Art. 22 GDPR.

If features with such characteristics are introduced in future, they will be subject to prior regulatory and impact assessment and will not be activated without the information, safeguards and legal bases required by applicable law, including, where provided, the right to human intervention, to contest and to express one's point of view.

Information for workers

When an artificial intelligence feature directly concerns a worker, the platform interface may show specific information before the feature is used.

Any acknowledgement or confirmation of reading recorded by the platform serves exclusively to document that information was provided and does not constitute worker consent nor replace the legal basis the controller must identify for the processing.

Further information obligations under employment and data protection law remain the responsibility of the client company.

Human supervision

The client company must identify authorised persons able to understand the nature and limits of outputs produced by AI features.

Authorised users must be able to critically assess outcomes and, when necessary, ignore, correct or submit them for further review.

AI outputs must not be considered automatically correct and must be interpreted in relation to the context in which they were produced.

Impact assessment and use in the employment relationship

Before activating artificial intelligence features that process worker data, and in particular where such features may involve monitoring of work activity, assessment of behaviour, systematic processing of images or other operations likely to present a high risk to people's rights and freedoms, the client company must verify necessity and, where required by applicable law, carry out a data protection impact assessment under Art. 35 GDPR in advance.

The company must also verify in advance the applicability of rules on remote monitoring of workers, including Art. 4 of Italian Law No. 300 of 20 May 1970, as well as further information obligations under employment law.

Technical activation of the feature by GRADO HR does not constitute an assessment of the lawfulness of its use in the client's specific organisational context.

API keys and AI service configuration

Artificial intelligence features remain off until at least one API key (or equivalent gateway) toward a supported provider is configured in the workspace: OpenAI, Anthropic (Claude), Google Gemini / Vertex AI or Amazon Bedrock.

The client company may enter its own API keys for its accounts with those providers, or use keys supplied by GRADO TECH Srls when the service is activated or configured by authorised GRADO staff. In the latter case the key may be “locked” by the administrator and then changed or replaced only by that administrator.

Keys are stored encrypted at rest. After saving, the interface shows only a mask (last digits) and not the full value. GRADO TECH Srls does not consult, copy or use the customer's keys for its own purposes, nor to access workspace content outside the cases in Part B. The platform decrypts the key in memory only, at the moment of the call to the provider, on the controller's instructions.

GRADO TECH Srls does not consult content sent to the model (photographs, text, prompts) for its own purposes, nor to train models. Usage metadata is recorded (provider, model, feature, token counts, estimated cost) so the controller can monitor consumption; such metadata does not include request content or the key in the clear. Any access by GRADO staff to workspace content remains limited to the cases in Part B.

If the controller uses its own keys, data for the requested function (for example the service photo or sampled text) is sent to the controller's account with that provider. In that case the AI provider is chosen and contracted by the controller: retention, training, location and any transfers outside the EU under that account remain the controller's responsibility. GRADO TECH Srls only forwards the technical request.

If the key is supplied and managed by GRADO TECH Srls, the AI provider acts as a sub-processor of GRADO TECH Srls within the limits of the contract and DPA. In that case GRADO TECH Srls favours, where available, processing in the European Economic Area, limited retention at the provider and no use of data for general model training.

Artificial intelligence system providers

Model providers (OpenAI, Google, Anthropic, Amazon Web Services / Bedrock) receive the data of each request according to the key and model configured in the workspace, as described in the “API keys” section.

Such parties process data to the extent necessary to deliver the requested function and under the applicable agreements: with the controller, if the key belongs to the customer; with GRADO TECH Srls, if the key is supplied by GRADO TECH Srls.

When the key is managed by GRADO TECH Srls and it is technically and contractually available, configurations providing processing in European Economic Area regions, limited retention at the provider and no use of client data for general model training are favoured.

GRADO TECH Srls does not use client data to train its own artificial intelligence models for independent purposes. An updated list of sub-processors and relevant processing locations is available as indicated in the “Sub-processors and recipients” section.

Sub-processors and recipients

Data may be processed by appointed processors or sub-processors bound by Art. 28 GDPR agreements or equivalent contractual safeguards where applicable, including: Aruba S.p.A. (Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy — VAT 01573850516), as provider of infrastructure services connected to the platform — Aruba GDPR, Aruba privacy notice; email services; any technical compromised-password checking services; Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), limited to Google sign-in if the user enables it (OAuth: identifier and email) and, if the controller enables AI with a key managed by GRADO TECH Srls, to Gemini / Vertex AI — Google privacy notice; any AI and photo-evidence storage providers, strictly as needed: OpenAI OpCo, LLC / OpenAI Ireland Ltd (privacy), Anthropic, PBC (privacy), Amazon Web Services EMEA SARL for Bedrock and object storage in an EU region (privacy); authorities where required by law or by the controller's instructions; professional advisors where required by law. When the controller configures its own API keys, AI providers receive data on the controller's instructions and in relation to the controller's account: in that configuration they are not appointed by GRADO TECH Srls as its own sub-processors. When the key is supplied by GRADO TECH Srls, those providers act as sub-processors of GRADO TECH Srls within the limits of the contract and DPA. An updated list of relevant sub-processors is available on request at info@gradotech.it or attached to the contract.

Transfers outside the EU

Data is processed primarily within the European Economic Area, including through Aruba S.p.A. (Italy) and, for photo evidence and AI models under a strict EU configuration, through endpoints and storage in EU regions. More information: aruba.it/gdpr. If the user enables “Sign in with Google”, authentication data (identifier and email) is processed by Google LLC, which may transfer it to countries outside the EU on the basis of GDPR safeguards (adequacy decisions, EU-US Data Privacy Framework where applicable, Standard Contractual Clauses). Where AI features involve processing by OpenAI, Anthropic, Google or AWS and, as a result, transfers to third countries (for example the United States), such transfers occur only with appropriate GDPR safeguards, such as adequacy decisions (including, where applicable, the EU-US Data Privacy Framework), the European Commission’s Standard Contractual Clauses or other lawful instruments. If the controller uses its own keys, any transfers outside the EU depend on the account and settings the controller has with the AI provider, not on GRADO TECH Srls’ default configuration. Specific information on transfers connected to AI services is provided in the contract, the DPA or on request.

Security measures

GRADO TECH Srls implements appropriate technical and organisational measures to protect data processed on GRADO HR: multi-tenant segregation, TLS encryption, irreversible password hashing, optional MFA with encrypted TOTP secrets, granular role-based access control, encryption at rest of payslip PDFs and net amounts (decryption only on request by an authenticated, authorised user), encryption at rest of AI service API keys (the full value is not shown in the interface after saving), resizing of service photos before they are sent to AI models and, in production/staging under a strict EU policy, object storage in an EU region with KMS encryption, technical cookies HttpOnly where applicable, backups, monitoring, audit logs (including net-amount reveals, AI service configuration and AI-notice acceptance) and compliance with ISO/IEC 27001:2024 standards. In the event of a personal data breach affecting data processed on behalf of the controller, GRADO TECH Srls will inform the controller without undue delay, as required by Art. 33 GDPR and the contract.

Encryption and access to payslips

Payroll data is processed with additional measures compared with the rest of the workspace. In particular:

• Encryption at rest: payslip PDF files are encrypted in storage; net amounts are encrypted in the database. A disk copy or database dump does not expose the content in the clear.
• Decryption only on an authorised request: the application decrypts PDFs and amounts only when an authenticated user with the relevant permission requests them. Traffic is protected with TLS; PDF responses are not placed in a public cache.
• Who can see what: the employee sees only their own published payslips. HR/admin staff see other people’s payslips only with explicit permissions (view, upload, publish, delete). Net amounts stay hidden in lists until an authorised user unlocks them; every reveal is recorded in the audit log.
• GRADO TECH Srls does not consult payslip content without a lawful basis described in Part B (controller authorisation, strictly necessary support, legal obligations). Encryption at rest reduces the risk of unauthorised reading of storage.

Liability and controller obligations

The controller warrants that data entered on GRADO HR is lawful, relevant, accurate and not excessive; that it has the rights and authorisations required (including for worker data, documents, IBAN, stamping geolocation, payslips and, if enabled, service photos and AI processing); that it correctly configures roles, modules, permissions and any AI deployments; and that it provides workers with the required privacy notice.

Before activating artificial intelligence features concerning workers, the controller is responsible for:

• identifying the purpose and legal basis of the processing;
• verifying necessity, proportionality and data minimisation;
• providing workers with the information required by the GDPR and applicable employment law;
• carrying out, where required, a data protection impact assessment;
• verifying the applicability of Art. 4 of Italian Law No. 300 of 20 May 1970 and any trade union or authorisation requirements;
• defining appropriate retention periods for photographs, outcomes and logs;
• identifying staff authorised to supervise AI outputs;
• preventing AI outputs from being used for incompatible purposes or for exclusively automated decisions not expressly provided for and legitimised;
• informing GRADO TECH Srls if it intends to use a feature for purposes substantially different from those provided for by the service, so that the technical and regulatory compatibility of the configuration can be verified.
• if it uses its own API keys, verifying the chosen AI provider's contract, location, retention and training policies and transfers outside the EU, remaining responsible for those conditions vis-à-vis data subjects.

GRADO TECH Srls makes features available in accordance with the intended purpose of the product and implements the technical and organisational measures within its remit; the client company remains responsible for the lawfulness of the concrete use of the system within its organisation and in its relationship with its workers.

GRADO TECH Srls is not responsible for the controller's organisational or payroll decisions, the substantive or legal accuracy of entered content, or the privacy notice the controller must provide to data subjects. This notice does not constitute legal advice.

Changes to this notice

This notice may be updated to reflect regulatory, contractual or service changes. Any amendments will be published on this page with the date of the last update.