Last updated: 14/10/2026
This notice describes how personal data is processed in connection with GRADO Security, the cloud platform for occupational health and safety (HSE) management operated by GRADO TECH Srls. It is issued pursuant to Arts. 13 and 14 of EU Regulation 2016/679 (GDPR), supplements the general privacy notice published on the GRADO Tech website, and clarifies the applicable privacy roles when client company data is hosted on the platform under a service contract, consulting engagement, commercial agreement or activation carried out also through authorised partners.
GRADO Security is SaaS software: client companies independently enter and manage their own data on the platform. The role of GRADO TECH Srls varies depending on context:
This section applies to personal data that the client company (or a safety consultant, RSPP, occupational physician, partner or other party authorised by it) enters, uploads or generates on GRADO Security in connection with its business and workers. Such data remains under the exclusive control and availability of the client company as data controller, is not transferred to GRADO TECH Srls as its own data, and remains under the controller's responsibility; GRADO TECH Srls only hosts, stores and makes it available according to the contract and received instructions.
For the data described in this Part A:
The controller must provide its workers, signers and other data subjects with a GDPR-compliant privacy notice (Arts. 13–14) and have a valid legal basis for each processing activity relating to occupational safety (Italian Legislative Decree 81/2008). The platform stores fitness-for-work judgments (the outcome document), not clinical records. Biometric comparison of a selfie with an identity document, described in Part F, is processing of biometric data and requires the data subject's explicit consent. External signers must receive this notice at the time of identity verification.
Depending on features activated by the company, the platform may process, among others, the following data entered or generated by the controller:
GRADO TECH Srls processes Part A data exclusively on behalf of the controller and limited to the following technical purposes:
The legal basis for processing by the controller (purposes, lawfulness, information to data subjects) is determined by the controller. Processing by GRADO TECH Srls as processor is based on performance of the service contract and the Art. 28 GDPR agreement (Art. 6(1)(b) GDPR), and where necessary on legitimate interest in platform security (Art. 6(1)(f) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).
Retention periods for Part A data are determined by the data controller, in compliance with applicable law (including occupational safety and training documentation obligations). GRADO TECH Srls retains data for the duration of the contract and thereafter for the period strictly necessary for orderly service termination, recovery at the controller's request or legal obligations. Upon termination of the contractual relationship, data is returned or deleted as provided in the contract and Art. 28 agreement, unless otherwise documented by the controller or required by law. Identity-verification data and images, the history of verifications and signatures, and signed documents also follow the periods set out in Part F.
GRADO TECH Srls does not freely access, consult or use content entered by client companies on GRADO Security without a lawful and documented basis. Access to client data by authorised GRADO TECH Srls personnel is permitted only in the cases below, in compliance with the principles of necessity, data minimisation and confidentiality:
Any access to client data content by GRADO personnel is limited to authorised staff, subject to confidentiality obligations, logged where technically possible and limited to the duration of the intervention. In the absence of controller instructions or a legal obligation, GRADO TECH Srls does not review content for its own purposes, does not sell client company data and does not disclose it to third parties for marketing, profiling or independent commercial exploitation.
The platform records relevant operations (audit logs, user access, data changes) to enable the controller to monitor activities carried out by users authorised by it. Logs and evidence relating to GRADO TECH Srls technical assistance interventions are retained for the time necessary to manage the contractual relationship, security, intervention traceability and defence against disputes, generally no longer than 12 months unless legal obligations or defence needs require otherwise.
This section applies to personal data collected directly by GRADO TECH Srls in connection with registration, free trial, subscription, billing, commercial and contractual communications and management of platform administrative accounts, independently of data entered by the company about its workers.
The data controller for Part C data is GRADO TECH Srls, registered office Corso Umberto I, 7 — 66050 San Salvo (CH), Italy. VAT IT02868240694. Email: info@gradotech.it — Phone: +39 378 421 3717.
Performance of contract or pre-contractual measures (Art. 6(1)(b) GDPR); compliance with legal obligations (Art. 6(1)(c) GDPR); legitimate interest in security and relationship management (Art. 6(1)(f) GDPR); consent for optional marketing activities (Art. 6(1)(a) GDPR), revocable at any time.
Data relating to workers and other parties entered by the company on GRADO Security is processed by the data controller (the client company or workspace manager). Therefore:
The controller is responsible for providing its workers with a complete and up-to-date privacy notice on processing carried out via GRADO Security.
For data collected in identity verification and signing (facial image, document, OTP, signature evidence), the rights and limits described in Part F also apply, including the right to withdraw biometric consent and the right to obtain human intervention on the automated outcome.
GRADO Security is not intended to collect or store special categories of health data, such as clinical records, diagnoses, medical reports or other health documentation. For fitness-for-work compliance the platform stores only the fitness judgment: a copy of the document, the issue date, the expiry date, the associated worker, the outcome of the judgment (for example fit or unfit) and any limitations or prescriptions explicitly stated in the judgment. The controller must not upload clinical documentation beyond that. The only special-category processing described in this notice is the biometric comparison of the facial image (selfie) with the photograph on the identity document, governed by Part F: this is biometric data under Art. 9 GDPR and requires the data subject's explicit consent, collected by a dedicated checkbox in the verification step and withdrawable at any time.
GRADO Security may offer generative AI and automation features, for example to verify certificates and related deadlines, suggest risks and PPE consistent with work cycles, job roles, assignments, machinery or work areas, and identify documentary or operational inconsistencies. Use of such features is activated by the controller and content sent to AI engines is processed solely to provide the requested function. For these services, GRADO TECH Srls may rely, to the extent strictly necessary, on the following third-party providers, acting as sub-processors or technical service providers depending on the applicable contractual setup: OpenAI OpCo, LLC / OpenAI Ireland Ltd (privacy: openai.com/privacy; enterprise: openai.com/enterprise-privacy); Anthropic, PBC (privacy: anthropic.com/privacy); Google LLC (privacy: policies.google.com/privacy). Client data is not resold and is not used by GRADO TECH Srls to train its own models or for independent purposes; any processing by AI providers takes place under their applicable business/enterprise terms and DPAs and, where provided, with exclusion of content use for training their models.
The platform also uses artificial intelligence to file uploaded documents into the relevant sections: risk assessment (DVR), identity documents, training certificates, fitness-for-work judgments, appointments to safety roles (emergency warden, supervisor, workers' safety representative, RSPP, occupational physician and similar roles), PPE delivery minutes and first-aid kit inspection minutes. Classification is an aid: the controller remains responsible for the content and for the document's final placement. Extraction of data from the identity document and comparison of the selfie with the photograph on the document, used for identity verification, are described in Part F and are carried out by OpenAI.
Data may be processed by appointed processors or sub-processors bound by Art. 28 GDPR agreements or equivalent contractual safeguards where applicable, including: Aruba S.p.A. (Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy — VAT 01573850516), as provider of infrastructure services connected to the platform — Aruba GDPR, Aruba privacy notice; email services and, for sending OTP codes and acceptance and delivery receipts, Aruba's certified email (PEC) service (PEC messages contain the OTP code and the document reference); any AI service providers activated by the controller for specific features, to the extent strictly necessary to deliver the requested function, and in particular OpenAI for processing document images and the selfie during identity verification: OpenAI OpCo, LLC / OpenAI Ireland Ltd (privacy), Anthropic, PBC (privacy), Google LLC (privacy); professional advisors or authorities where required by law. An updated list of sub-processors relevant to the service is available on request at info@gradotech.it or attached to the contract.
Data is processed primarily within the European Economic Area, including through Aruba S.p.A. (Italy). More information: aruba.it/gdpr. Extraction of data from the identity document and facial comparison are carried out by OpenAI on servers located outside the European Union: the transfer is covered by the European Commission Standard Contractual Clauses. If other AI features activated by the controller involve processing by OpenAI, Anthropic or Google and, as a result, transfers to third countries (for example the United States), such transfers take place only where adequate safeguards under the GDPR are in place, such as adequacy decisions (including, where applicable, the EU-US Data Privacy Framework), Standard Contractual Clauses or other lawful instruments. Specific information on transfers connected to AI services is provided in the contract, the DPA or on request.
This section describes processing when a user, a worker or an external signer (for example an external RSPP or occupational physician) verifies their identity on GRADO Security in order to sign documents. The controller of data relating to its workers and signers remains the client company; GRADO TECH Srls processes this data on behalf of the controller, as processor, according to the instructions and the contract. The notice is also provided to signers who are not employees of the controller (Arts. 13 and 14 GDPR) and is presented to them at the time of identity verification.
For identity verification and signing, the following are processed:
Identity verification and application of the signature are necessary to perform the service requested by the data subject and by the controller: the legal basis is performance of the contract or of the requested service (Art. 6(1)(b) GDPR). Fraud prevention and protection of document integrity are based on the legitimate interest of the controller and of GRADO TECH Srls (Art. 6(1)(f) GDPR), limited to what is necessary and proportionate. Retention of signed documents is based on a legal obligation (Art. 6(1)(c) GDPR), in particular the duties under Legislative Decree 81/2008 and evidentiary needs. Biometric comparison of the selfie with the photograph on the document is processing of biometric data under Art. 9 GDPR: it is carried out only with the data subject's explicit consent, collected in the verification step by a dedicated checkbox, specific and separate from the other statements. Consent may be withdrawn at any time, with the effects described under rights.
Extraction of data from the document and comparison of the selfie face with the photograph on the document are carried out automatically by an artificial intelligence provider, OpenAI, on servers located outside the European Union, with transfer safeguards consisting of the Standard Contractual Clauses (SCCs). The automatic outcome is not final: the workspace Owner may review it and decide to revoke or restore the verification status. The data subject has the right to obtain human intervention, to express their point of view and to contest the decision, under Art. 22 GDPR, by contacting the Owner or info@gradotech.it.
For these operations, data may be disclosed to: OpenAI OpCo, LLC / OpenAI Ireland Ltd, for processing of document images and the selfie (data extraction and facial comparison) — privacy; Aruba S.p.A. (Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy — VAT 01573850516), as certified-email (PEC) provider for sending the OTP code and for acceptance and delivery receipts, and as provider of server hosting — Aruba GDPR, Aruba privacy notice. PEC messages sent contain the OTP code and the reference to the document to be signed. Providers process data as processors or sub-processors, to the extent necessary and under Art. 28 GDPR agreements or equivalent safeguards.
Verification data and images (identification data, document details and images, selfie) are stored encrypted (AES-256-GCM, with keys kept outside the database) for as long as the account exists, or until revocation or deletion ordered by the Owner at the data subject's request. The history of verifications, revocations and signatures is retained for evidentiary and audit needs. Signatures applied to documents are retained together with the document, for the periods required by Legislative Decree 81/2008 and, in any event, for the civil limitation period of 10 years.
Identification data and images are encrypted at rest. Access to verification details is restricted to Owners and each consultation is recorded in an audit log. The OTP code is single-use and expires. A SHA-256 hash is calculated for each signed document. The public verification page discloses only the minimal data listed below, with the PEC address masked.
The data subject may request access, rectification, erasure, restriction, objection and portability, and may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it). Erasure is limited for documents that have already been signed: the signature data needed to demonstrate the signing and the integrity of the document is retained for the periods indicated above. Withdrawal of biometric consent is always possible and results in loss of «verified» status; it does not affect the lawfulness of processing carried out before withdrawal, nor, by itself, retention of signatures already applied. Requests relating to data of the client company's workers and signers should be addressed first to the controller; GRADO TECH Srls forwards them or responds within the limits of its role as processor.
The signature applied through GRADO Security is a Simple Electronic Signature under Art. 3(10) of Regulation (EU) No 910/2014 (eIDAS). It is not a qualified electronic signature and it is not a digital signature. Its probative value is freely assessed by the court. The procedure is as follows: the signer's identity is verified (document and, with consent, facial comparison); a single-use OTP code is sent to the PEC address provided; after confirmation, a stamp with the signature identifier and a QR code is applied to the document; the integrity of the signed file is protected by a SHA-256 hash.
Anyone in possession of the code or the QR code can consult a public verification page. The page discloses only: the signer's name, role, date and time of the signature, masked PEC address, document type, company and file integrity status. The identity document, the selfie, the tax code, the OTP and other excessive data are not shown.
Signers who are not internal users of the client company — for example an external RSPP or the occupational physician — are third-party data subjects. They must receive this notice at the time of identity verification, before the document, the selfie or biometric consent is collected. Continuing verification after reading the notice and, for facial comparison, selecting the dedicated checkbox are the means by which the data subject is informed and, for biometric data, gives explicit consent.
GRADO TECH Srls implements appropriate technical and organisational measures to protect data processed on GRADO Security: multitenant segregation between client companies, TLS encryption, irreversible password hashing, role-based access control and least privilege, encryption at rest of identification data and verification images (AES-256-GCM, with keys kept outside the database), access to verification details restricted to Owners with an audit log, one-time expiring OTP codes, SHA-256 hashes of signed documents, a public verification page that discloses only minimal data (masked PEC), backups, monitoring and compliance with ISO/IEC 27001:2024 standards. In the event of a personal data breach affecting data processed on behalf of the controller, GRADO TECH Srls will inform the controller without undue delay, as required by Art. 33 GDPR and the contract.
The controller warrants that data entered on GRADO Security is lawful, relevant, accurate and not excessive for the pursued purposes; that it has the rights, lawful bases and authorisations required (including for worker data, uploaded documents and any fitness-for-work assessments); that it correctly configures user roles and permissions; that it adopts organisational measures required by occupational safety law; and that it uploads only information that is strictly necessary to the platform's purposes. GRADO TECH Srls is not responsible for the controller's organisational decisions, risk assessments, the substantive or legal accuracy of content entered by the controller, instructions given to GRADO TECH Srls, or the privacy notice the controller must provide to its data subjects. This notice does not constitute legal advice.
This notice may be updated to reflect regulatory, contractual or service changes. Any amendments will be published on this page with the date of the last update.
