Privacy Policy

Information regarding the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and subsequent amendments.

Last updated: October 2026

1. Data controller

REPERTOR.IO, Tax Code and VAT No. 13291660010, in the person of its legal representative pro tempore, with registered office in Torino, via Quarello, no. 15/a, is the Data Controller of personal data (hereinafter also “Company”).

The Company is the owner of the platform called Repertorio, available at repertorio.ai (hereinafter also the “Platform”), and of the related public website (hereinafter also the “Site”).

You can contact the Data Controller at info@repertorio.ai.

2. Data subject to processing

Personal data being processed means any information that concerns you and that can be traced back to you.

The data that the Company processes are:

• Personal data: name, surname, email address, occupation, accounting and banking data and, if you use the Platform, the searches you run on it. If you sign in with Google, name, surname and email address are received from Google.
• Data you send us through the Site: the details entered in the contact form or the email address left in the waitlist.
• Navigation data: IP address and technical data automatically recorded in the server logs.

3. Purpose, legal basis of the processing and retention period

Your personal data will be processed for the following purposes:

• a) Exchange information aimed at the execution of the contractual relationship, including pre- and post-contractual activities, including assistance activities.
  Legal basis: execution of the contract pursuant to Art. 6(1)(b) GDPR.
  Retention: for the duration of the contractual relationship.
• b) Enter into and execute the contractual relationship, including the creation and management of your account and the provision of the Platform's features (such as the search history).
  Legal basis: execution of the contract pursuant to Art. 6(1)(b) GDPR.
  Retention: until your account is deleted.
• c) Carry out obligations required by law, Community legislation, as well as to comply with provisions issued by public authorities authorised to do so or by supervisory and control bodies to which the Company is subject (for example, tax audits, etc.).
  Legal basis: legal obligation pursuant to Art. 6(1)(c) GDPR.
  Retention: for the period required by the applicable law (e.g. 10 years for accounting records).
• d) Exercise and defend the Data Controller's rights in any court, including judicial, administrative, arbitration, and/or mediation and conciliation proceedings.
  Legal basis: legitimate interest of the Data Controller pursuant to Art. 6(1)(f) GDPR.
  Retention: for the duration of the dispute and until the time limits for appeal have expired.
• e) Reply to the requests you send us through the contact form.
  Legal basis: measures taken at your request prior to entering into a contract, pursuant to Art. 6(1)(b) GDPR.
  Retention: for the time needed to handle your request.
• f) Notify you when the Platform becomes available, if you join the waitlist.
  Legal basis: measures taken at your request, pursuant to Art. 6(1)(b) GDPR.
  Retention: until the Platform becomes available or until you ask to be removed from the waitlist.
• g) Ensure the security and the correct functioning of the Site and the Platform (navigation data).
  Legal basis: legitimate interest of the Data Controller pursuant to Art. 6(1)(f) GDPR.
  Retention: for a limited period, strictly necessary for security purposes.
• h) Produce aggregated statistics on the use of the public pages of the Site, to improve their content. Statistics are collected with a tool installed on our own servers, without cookies; IP addresses are truncated and not stored.
  Legal basis: legitimate interest of the Data Controller pursuant to Art. 6(1)(f) GDPR.
  Retention: 25 months; afterwards only aggregated statistics are kept.

4. Nature of the provision of personal data

The provision of data, with regard to the aforementioned purposes, is necessary for the data for which there is a legal obligation and for the data necessary for the execution of the contract in question, and any refusal to process your data will make it impossible to execute the contract itself and/or to execute the legal obligations to which the Data Controller is subject.

Providing your data through the contact form and the waitlist is optional, but without it we cannot reply to your request or notify you. Navigation data are collected automatically when you use the Site and the Platform.

5. Methods of processing

Within the scope of the purposes indicated above, your data will be processed using paper media as well as IT/electronic tools, in compliance with the regulatory provisions regarding the processing of personal data, adopting appropriate security measures.

Your data will be processed by authorised, specially trained and instructed personnel to ensure adequate security and confidentiality, as well as to avoid risks of loss and/or destruction and access by unauthorised parties. The Company has implemented adequate security measures to protect your personal and business and/or commercial data.

Your data are not subject to automated decision-making, including profiling, within the meaning of Article 22 GDPR.

6. Communication and transfer of data

Your personal data, taking into account the type of contract in place, may be communicated to the subjects authorised to access them by virtue of provisions of law, regulations, community legislation, as well as to credit institutions and law firms for the purpose of providing legal advice.

Your data may also be communicated to subjects specifically appointed as data processors, such as accountants and companies providing IT and management services, including hosting, cloud and email service providers.

Where the provision of these services involves the processing of data outside the European Union, the transfer takes place only on the basis of an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or of the Standard Contractual Clauses adopted by the European Commission (Art. 46 GDPR).

We recommend not entering personal data in the free-text search bar of the Platform.

7. Diffusion

The personal data you provide will not be disclosed without prior authorisation.

8. Cookies

The Site and the Platform only use technical cookies, which are necessary to keep you signed in. Details are available in the Cookie Policy.

9. Rights of the data subject

As the data subject, you may exercise at any time the rights expressly granted to you by the GDPR, in particular:

• The right of access to personal data (Art. 15 GDPR), in order to obtain confirmation from the Data Controller as to whether or not personal data concerning you are being processed and, where that is the case, to obtain access to the personal data and the following information:
  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from the Data Controller rectification or erasure of personal data or restriction of processing of personal data concerning you, or to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the personal data are not collected from you, any available information as to their source;
  • the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in such cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you;
  • the existence of appropriate safeguards pursuant to Article 46 relating to the transfer of data abroad.
• The right to rectification (Art. 16 GDPR) and to integrate inaccurate or incomplete personal data concerning you.
• The right to erasure (Art. 17 GDPR) of your personal data if:
  • they are no longer necessary in relation to the purposes for which they were collected or otherwise processed, or are processed unlawfully, or must be deleted in order to fulfil a legal obligation under Union or Member State law to which the Data Controller is subject;
  • they have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR;
  • you withdraw consent and there is no other legal basis for the processing, or you object to the processing pursuant to Article 21(1) and there is no overriding legitimate reason to proceed with the processing, or you object to the processing pursuant to Article 21(2).
• The right to restriction of processing (Art. 18 GDPR) when one of the following applies:
  • you contest the accuracy of the personal data, for a period enabling the Data Controller to verify the accuracy of the personal data;
  • the processing is unlawful and you oppose the erasure of the personal data and request instead that their use be restricted;
  • the Data Controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
  • you have objected to the processing pursuant to Article 21(1), pending the verification whether the legitimate grounds of the Data Controller override yours.
• The right to data portability (Art. 20 GDPR), i.e. to receive your data or have them transmitted to another data controller, if the processing is based on consent or on a contract.
• The right to object (Art. 21 GDPR) at any time, on grounds relating to your particular situation, to the processing of data concerning you based on legitimate interest.
• The right to withdraw consent at any time, where the processing is based on consent, without affecting the lawfulness of the processing carried out before the withdrawal.
• The right to lodge a complaint with a supervisory authority; in Italy, the Garante per la protezione dei dati personali.

To exercise the rights listed above, you can write to info@repertorio.ai or to the registered office of the Company.