Privacy Notice.

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Version 1.2 — 16 October 2026

This is a courtesy English translation. In case of discrepancy, the Italian version prevails.

This Notice describes how NoK Group S.r.l. processes the personal data of users of the Atropox service (the "Service") for which it acts as controller. For data relating to third parties that the user enters or generates in the Service (contacts, clients, Intelligence Report subjects), the Data Processing Agreement (DPA) under art. 28 GDPR applies instead, where the customer is controller and NoK Group is processor.

1. Data controller

The controller is NoK Group S.r.l., registered office at Via Cassia 1280, 00189 Rome (RM), Tax Code and VAT no. 17725341006, share capital euro 10,000.00 fully paid, certified e-mail nokgroup@legalmail.it, e-mail info@nok.business (the "Controller").

2. Data Protection Officer (DPO)

Following a documented assessment, the Controller has determined that it is not required to designate a Data Protection Officer (DPO) under art. 37 GDPR, as its core activities do not consist of large-scale regular and systematic monitoring or large-scale processing of special categories of data. The Controller has nonetheless appointed a data protection contact point, reachable at the addresses in art. 1. The assessment is reviewed periodically and a DPO will be designated should the conditions arise.

3. Categories of personal data processed

The Controller processes the following categories of personal data relating to Service users:

a) Registration and profile data: e-mail address, first and last name, any company name, role or position, photo or avatar, area of expertise and experience, if provided by the user.

b) Authentication data: access credentials (the password is stored in encrypted form by the authentication provider and is not accessible to the Controller); where sign-in is via Google, the authentication data provided by Google (e-mail, name, identifier); where two-factor authentication is used, the technical data of the authentication factor.

c) Billing and payment data: name or company name, address, VAT number, SDI recipient code or certified e-mail, e-mail of the person making the payment, subscription status and paid seats. Card or account data is handled directly by the payment provider (Stripe) and is not stored by the Controller.

d) Usage and technical data: data on use of the Service, system logs, IP address, device and browser data, assistant action logs, needed for operation, security and diagnostics.

e) Support data: the information provided by the user in support communications.

The Service is not intended to collect, in relation to the user, special categories of data (art. 9 GDPR) or judicial data (art. 10 GDPR).

4. Purposes and legal bases

The Controller does not send promotional communications and does not carry out profiling for marketing purposes. The service communications described above have no promotional content. Should the Controller in future intend to send promotional communications, it will first ask for the data subject's consent and update this Notice.

5. Nature of provision

Provision of registration, authentication and, for paid Plans, billing data is necessary to conclude and perform the contract: failure to provide it prevents use of the Service or the relevant features.

6. Recipients and processors

Data is processed by the Controller's authorised personnel and may be communicated, to the extent necessary, to the following entities, acting as processors or, where indicated, as independent controllers:

Anthropic, PBC in turn uses its own sub-processors, including, for the web search feature, Brave Software, Inc. (United States), according to the list published by Anthropic. The updated list of processors is made available by the Controller on request. Data may also be communicated to public authorities where required by law. If the user dictates without the ElevenLabs voice, speech recognition is performed by the user's browser and its maker (for example Google or Apple), under the browser's terms: NoK Group receives only the transcribed text.

7. Transfers to third countries

Some providers in art. 6 are established or process data in the United States. In such cases the transfer takes place on the basis of adequate safeguards under art. 46 GDPR, in particular the Standard Contractual Clauses adopted by the European Commission with Implementing Decision (EU) 2021/914, supplemented by the additional measures deemed necessary following the Transfer Impact Assessment post-Schrems II (CJEU, C-311/18), or, where applicable, on the basis of the adequacy decision relating to the EU-US Data Privacy Framework for certified entities. A copy of the safeguards may be requested at the addresses in art. 1.

8. Retention period

Account and profile data is retained for the duration of the relationship and deleted, on the user's request or on termination, as provided by the Terms, save the exceptions below. Billing data and accounting documents are retained for the statutory period (ten years under art. 2220 of the Civil Code and tax rules). Consent data and records needed to meet the accountability obligation (art. 5(2) GDPR) may be kept in anonymised form or for the time needed to establish or defend a right. Technical and security logs are deleted automatically at the following intervals: security and access (audit) logs 24 months; log of the assistant's and AI features' actions 12 months; application error reports 90 days; outgoing message queue 12 months; notifications already read 6 months. Correspondence on support requests and on the exercise of rights is kept for the duration of the matter and for the following 24 months, as proof of its handling.

9. Data subject rights

The data subject may at any time exercise the rights under arts. 15-22 GDPR: access, rectification, erasure, restriction, portability, objection and, where applicable, the rights connected to automated decisions (art. 22 GDPR). Within the Service, on the "Privacy and data" page, the user may independently export its data in a structured format (art. 20 GDPR) and delete its account (art. 17 GDPR). Requests may also be sent to the addresses in art. 1 and receive a reply within one month, extendable by two months in complex cases (art. 12 GDPR).

10. Complaint to the supervisory authority

The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Piazza Venezia 11, 00187 Rome; www.garanteprivacy.it) or with the supervisory authority of the Member State of residence or of the alleged infringement, without prejudice to any other administrative or judicial remedy.

11. Automated decision-making and AI features

The Service includes AI features: the conversational assistant (also by voice), Intelligence Reports, filling in a contact card with public data, finding a contact's photo or logo, tag suggestions, reading documents uploaded by the user and summarising information pasted by the user. Each feature runs only at the user's request and proposes results that the user can verify, accept or discard. Their content is support for human decision-making and not an automated decision producing legal or similarly significant effects under art. 22 GDPR. The characteristics, purposes and transparency safeguards of such features are described in the AI transparency notice, also issued under art. 50 of Regulation (EU) 2024/1689.

12. Cookies and storage technologies

The Service uses exclusively storage technologies strictly necessary for its operation (e.g. keeping the sign-in session and the language and theme preferences on the user's device). These are exempt from consent under art. 122 of Legislative Decree 196/2003. The Service uses no profiling cookies nor third-party analytics or tracking tools.

13. Changes

The Controller may update this Notice. The updated version is published in the Service with the date indicated; material changes are communicated to the user.