This notice describes how personal data is processed in connection with GRADO Security, the cloud platform for occupational health and safety (HSE) management operated by GRADO TECH Srls. It is issued pursuant to Arts. 13 and 14 of EU Regulation 2016/679 (GDPR), supplements the general privacy notice published on the GRADO Tech website, and clarifies the applicable privacy roles when client company data is hosted on the platform under a service contract, consulting engagement, commercial agreement or activation carried out also through authorised partners.

How the service works

GRADO Security is SaaS software: client companies independently enter and manage their own data on the platform. The role of GRADO TECH Srls varies depending on context:

• Company and employee data (Part A): the client company (or consultant/partner appointed by it) is the data controller; GRADO TECH Srls acts as data processor under Art. 28 GDPR, solely for technical service delivery, hosting and activities strictly necessary to perform the contractual relationship.
• Access to data by GRADO Tech (Part B): GRADO TECH Srls does not freely access content uploaded by companies; access is permitted only in the cases and manner described therein.
• Contractual and administrative data (Part C): for demo registration, subscription, billing and management of platform operator accounts, GRADO TECH Srls is the data controller.

Part A — Data entered by client companies

This section applies to personal data that the client company (or a safety consultant, RSPP, occupational physician, partner or other party authorised by it) enters, uploads or generates on GRADO Security in connection with its business and workers. Such data remains under the exclusive control and availability of the client company as data controller, is not transferred to GRADO TECH Srls as its own data, and remains under the controller's responsibility; GRADO TECH Srls only hosts, stores and makes it available according to the contract and received instructions.

Roles in processing

For the data described in this Part A:

• the data controller is the client company (or, where applicable, the party that activated the workspace and determines purposes and means of processing in relation to its workers and organisation);
• GRADO TECH Srls (registered office Corso Umberto I, 7 — 66050 San Salvo (CH), Italy. VAT IT02868240694) acts exclusively as data processor, on the basis of the service contract, consulting engagement or workspace activation and the Art. 28 GDPR agreement, to host, store, technically organise and make data available on the platform according to the controller's documented instructions;
• external consultants, occupational physicians or other parties authorised by the company may act as independent controllers, processors or controller's appointees: GRADO TECH Srls does not determine their purposes.

The controller must provide its workers and data subjects with a GDPR-compliant privacy notice (Arts. 13–14) and have a valid legal basis for each processing activity, including those relating to occupational safety (Italian Legislative Decree 81/2008) and, where applicable, special categories of data (e.g. medical visits).

Categories of data processed on the platform

Depending on features activated by the company, the platform may process, among others, the following data entered or generated by the controller:

• Company identification data: company name, VAT number, ATECO code, sites, addresses, contacts, representatives, logo and corporate documentation.
• Worker/employee data: name, surname, tax code, date and place of birth, residence, role/job title, email, phone, hiring and termination dates, profile photo, attachments.
• Identity documents: type, number, expiry date and digital copies uploaded by the controller.
• Training and certificates: courses, deadlines, training credits, certificates, certifications, compliance history and attachments; for certificates, the platform may store the PDF, issue date, expiry date and the association with the relevant worker.
• Health surveillance and fitness-for-work assessments: only to the extent uploaded by the controller, the platform may store a copy of the fitness-for-work assessment delivered to the worker, the issue date, expiry date, associated worker, outcome of the assessment (for example fit/unfit) and any limitations or prescriptions explicitly stated in the document, without being intended for the collection or management of medical records or excessive health data.
• Occupational safety and risk assessment (DVR): job descriptions, risk assessment, PPE, operating prescriptions, substances, machinery, procedures, work areas, safety organisation chart (workers' safety reps, RSPP, fire wardens, first aiders, etc.), incidents, emergency plan, floor plans, as well as information on PPE that may be associated with a job role, a worker in relation to the role performed, machinery or a specific work area.
• Vehicles and equipment: company vehicle records, inspections, insurance and related deadlines.
• Platform users (operators, consultants, company administrators): access credentials, roles, permissions, authentication logs.
• Communications and documents: support messages, tickets, certified email (PEC) sends relating to the DVR, files and attachments uploaded by the company.
• Technical and audit logs: records of platform operations, change tracking, system logs required for security and service operation.

Purposes of processing (on behalf of the controller)

GRADO TECH Srls processes Part A data exclusively on behalf of the controller and limited to the following technical purposes:

• delivery, hosting and maintenance of the GRADO Security platform and its features (deadline tracker, training, DVR, notifications, reports, APIs, etc.);
• execution of the controller's documented instructions, including storage, backup, recovery and deletion of data as agreed;
• IT security, abuse prevention, operational continuity and compliance with legal obligations applicable to the processor;
• technical support within the limits of Part B, including consistency checks, document management, deadline tracking and optional automation or AI features activated by the controller. GRADO TECH Srls does not use client company data for its own marketing, commercial profiling, resale or independent analysis not strictly necessary for service delivery.

Legal basis

The legal basis for processing by the controller (purposes, lawfulness, information to data subjects) is determined by the controller. Processing by GRADO TECH Srls as processor is based on performance of the service contract and the Art. 28 GDPR agreement (Art. 6(1)(b) GDPR), and where necessary on legitimate interest in platform security (Art. 6(1)(f) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

Retention

Retention periods for Part A data are determined by the data controller, in compliance with applicable law (including occupational safety and training documentation obligations). GRADO TECH Srls retains data for the duration of the contract and thereafter for the period strictly necessary for orderly service termination, recovery at the controller's request or legal obligations. Upon termination of the contractual relationship, data is returned or deleted as provided in the contract and Art. 28 agreement, unless otherwise documented by the controller or required by law.

Part B — Access to data by GRADO TECH Srls

GRADO TECH Srls does not freely access, consult or use content entered by client companies on GRADO Security without a lawful and documented basis. Access to client data by authorised GRADO TECH Srls personnel is permitted only in the cases below, in compliance with the principles of necessity, data minimisation and confidentiality:

• Explicit delegation or authorisation by the controller: upon written request, email, support ticket, official communication or another documentable channel provided under the contract; in exceptional cases authorisation may also be verbal, provided it is attributable to the controller or one of its authorised contacts, it being understood that written or otherwise formalised instructions are always preferable;
• Strictly necessary technical assistance: interventions limited in time and scope to what is indispensable to diagnose malfunctions, restore service, apply security updates or respond to client reports, in compliance with data minimisation;
• Legal obligations: court orders or mandatory legal obligations, with notification to the controller where permitted;
• Platform security: aggregated monitoring or technical metadata (system logs, infrastructure metrics) without the purpose of consulting substantive client data content, except where strictly necessary to prevent, detect, contain or document security incidents.

Any access to client data content by GRADO personnel is limited to authorised staff, subject to confidentiality obligations, logged where technically possible and limited to the duration of the intervention. In the absence of controller instructions or a legal obligation, GRADO TECH Srls does not review content for its own purposes, does not sell client company data and does not disclose it to third parties for marketing, profiling or independent commercial exploitation.

Access logging

The platform records relevant operations (audit logs, user access, data changes) to enable the controller to monitor activities carried out by users authorised by it. Logs and evidence relating to GRADO TECH Srls technical assistance interventions are retained for the time necessary to manage the contractual relationship, security, intervention traceability and defence against disputes, generally no longer than 12 months unless legal obligations or defence needs require otherwise.

Part C — Data for which GRADO TECH Srls is controller

This section applies to personal data collected directly by GRADO TECH Srls in connection with registration, free trial, subscription, billing, commercial and contractual communications and management of platform administrative accounts, independently of data entered by the company about its workers.

Data controller

The data controller for Part C data is GRADO TECH Srls, registered office Corso Umberto I, 7 — 66050 San Salvo (CH), Italy. VAT IT02868240694. Email: info@gradotech.it — Phone: +39 378 421 3717.

Categories of data

• Identification and contact data: name, surname, email, phone, company name, VAT number of the requesting company.
• Contractual and billing data: subscribed plan, payments, invoices, fees, order history.
• Credentials and access: username, password (irreversible hash), optional two-factor authentication, access logs for demo registration or commercial area.
• Communications: information requests, demos, commercial support, newsletters where subscribed.

Purposes

• Management of registration, free trial and contractual relationship.
• Billing, payment collection and tax and administrative compliance.
• Service communications, platform updates and, where consent is required, commercial communications.
• Security, fraud prevention and management of complaints or disputes.

Legal basis

Performance of contract or pre-contractual measures (Art. 6(1)(b) GDPR); compliance with legal obligations (Art. 6(1)(c) GDPR); legitimate interest in security and relationship management (Art. 6(1)(f) GDPR); consent for optional marketing activities (Art. 6(1)(a) GDPR), revocable at any time.

Part D — Rights of workers and data subjects

Data relating to workers and other parties entered by the company on GRADO Security is processed by the data controller (the client company or workspace manager). Therefore:

• data subjects (workers, collaborators, consultants) must exercise rights under Arts. 15–22 GDPR (access, rectification, erasure, restriction, objection, portability) primarily with their employer or the controller as indicated in the company privacy notice;
• they may write to info@gradotech.it for requests relating to data hosted on the platform: GRADO TECH Srls, as processor, will forward the request to the controller or respond within the limits of its role;
• the right to lodge a complaint with the Italian Data Protection Authority always remains (www.garanteprivacy.it).

The controller is responsible for providing its workers with a complete and up-to-date privacy notice on processing carried out via GRADO Security.

Part E — Special categories, artificial intelligence and sub-processors

Special categories of data

Ordinary use of GRADO Security mainly concerns identification, organisational and document data relating to occupational safety. In some cases, however, the platform may host data falling within the special categories under Art. 9 GDPR, in particular where the controller uploads copies of fitness-for-work assessments or health surveillance documents already delivered to the worker. The platform is not intended for the systematic collection of medical records or excessive health data: the controller must limit storage to data that is relevant and necessary. The controller remains solely responsible for the lawfulness of such processing, adoption of any additional security measures and the information provided to data subjects; GRADO TECH Srls processes such data solely on behalf of the controller and according to its documented instructions.

Artificial intelligence features

GRADO Security may offer generative AI and automation features, for example to verify certificates and related deadlines, suggest risks and PPE consistent with work cycles, job roles, assignments, machinery or work areas, and identify documentary or operational inconsistencies. Use of such features is activated by the controller and content sent to AI engines is processed solely to provide the requested function. For these services, GRADO TECH Srls may rely, to the extent strictly necessary, on the following third-party providers, acting as sub-processors or technical service providers depending on the applicable contractual setup: OpenAI OpCo, LLC / OpenAI Ireland Ltd (privacy: openai.com/privacy; enterprise: openai.com/enterprise-privacy); Anthropic, PBC (privacy: anthropic.com/privacy); Google LLC (privacy: policies.google.com/privacy). Client data is not resold and is not used by GRADO TECH Srls to train its own models or for independent purposes; any processing by AI providers takes place under their applicable business/enterprise terms and DPAs and, where provided, with exclusion of content use for training their models.

Sub-processors and recipients

Data may be processed by appointed processors or sub-processors bound by Art. 28 GDPR agreements or equivalent contractual safeguards where applicable, including: Aruba S.p.A. (Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy — VAT 01573850516), as provider of infrastructure services connected to the platform — Aruba GDPR, Aruba privacy notice; email and certified email (PEC) services; any AI service providers activated by the controller for specific features, to the extent strictly necessary to deliver the requested function: OpenAI OpCo, LLC / OpenAI Ireland Ltd (privacy), Anthropic, PBC (privacy), Google LLC (privacy); professional advisors or authorities where required by law. An updated list of sub-processors relevant to the service is available on request at info@gradotech.it or attached to the contract.

Transfers outside the EU

Data is processed primarily within the European Economic Area, including through Aruba S.p.A. (Italy). More information: aruba.it/gdpr. If specific optional AI features activated by the controller involve processing by OpenAI, Anthropic or Google and, as a result, transfers to third countries (for example the United States), such transfers take place only where adequate safeguards under the GDPR are in place, such as adequacy decisions (including, where applicable, the EU-US Data Privacy Framework), European Commission Standard Contractual Clauses or other lawful instruments. Specific information on transfers connected to AI services is provided in the contract, the DPA or on request.

Security measures

GRADO TECH Srls implements appropriate technical and organisational measures to protect data processed on GRADO Security: multitenant segregation between client companies, TLS encryption, irreversible password hashing, role-based access control and least privilege, backups, monitoring and compliance with ISO/IEC 27001:2024 standards. In the event of a personal data breach affecting data processed on behalf of the controller, GRADO TECH Srls will inform the controller without undue delay, as required by Art. 33 GDPR and the contract.

Liability and controller obligations

The controller warrants that data entered on GRADO Security is lawful, relevant, accurate and not excessive for the pursued purposes; that it has the rights, lawful bases and authorisations required (including for worker data, uploaded documents and any fitness-for-work assessments); that it correctly configures user roles and permissions; that it adopts organisational measures required by occupational safety law; and that it uploads only information that is strictly necessary to the platform's purposes. GRADO TECH Srls is not responsible for the controller's organisational decisions, risk assessments, the substantive or legal accuracy of content entered by the controller, instructions given to GRADO TECH Srls, or the privacy notice the controller must provide to its data subjects. This notice does not constitute legal advice.

Changes to this notice

This notice may be updated to reflect regulatory, contractual or service changes. Any amendments will be published on this page with the date of the last update.