Privacy Policy

This Policy describes how IVEMIND Società Cooperativa Sociale(“Ivemind” or the “Controller”) processes the personal data of users of the rivedi.ai website and of the rivedi service, pursuant to Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (the “Privacy Code”). By using the site or the service, the user acknowledges the practices described here.

This English text is provided for convenience only. In case of any discrepancy, the Italian version of this Policy prevails.

1. Data Controller

The Data Controller is IVEMIND Società Cooperativa Sociale, with registered office at Via Werner von Siemens 23, 39100 Bolzano (BZ), Italy. Tax code and VAT number: IT03138990217. Registered with the Bolzano Company Register no. 03138990217, REA BZ-235349. Certified email (PEC): ivemindscs@pec.it. For requests regarding the processing of personal data you can contact the Controller at: privacy@ivemind.com (privacy), info@ivemind.com (support and information), sales@ivemind.com (commercial requests). The Controller has not appointed a Data Protection Officer (DPO), as the mandatory conditions under Art. 37 GDPR do not apply; a privacy contact remains available at the address indicated above.

2. Description of the service

rivedi is a B2B management software (SaaS) for optical stores and practices in Italy. It allows the optical store (“Customer” or “Tenant”) to run its business — customer records, appointments, optometric record, sales, inventory, invoicing — and to communicate with its own end customers, including notifications via WhatsApp Business.

3. Categories of data processed

The Controller processes the following categories of personal data: (a) navigation data of the rivedi.ai website, collected through cookies and similar technologies (see the Cookie Policy), including IP address, pages visited, device and browser, as well as data on interactions with the pages (scrolling, time on page, sections viewed, clicks on buttons and links); part of those data — including, where the contact form is submitted, a random identifier referring to the individual request — is transmitted to measurement providers also before consent is collected, without cookies and without persistent identifiers, as described in § 5.1 of the Cookie Policy; (a-bis) advertising measurement data, subject to consent: campaign click identifiers (gclid, wbraid, gbraid, fbclid), browser identifiers generated by third-party tools and conversion data (page visit, contact form submission), used to measure campaign effectiveness and for retargeting, with consequent profiling for advertising purposes carried out by the third parties listed in § 7; (b) contact data provided voluntarily via form or email (name, email, any message); (c) service account data (name, email, role, Cognito identifier); (d) operational data entered by the Tenant for its business: end-customer records, appointments, work orders, sales and documents, and — for notifications — phone number, content of template messages sent via WhatsApp, timestamps, delivery receipts and consents; (e) special categories of data under Art. 9 GDPR (health data: refraction, prescriptions, optometric history), processed exclusively on behalf of the Tenant and protected with field-level encryption; (f) data of people trying the demo (trial access to the demonstration environment), described in § 8-bis.

4. Roles: Controller and Processor

For account and website navigation data, Ivemind acts as Data Controller. For end-customer data and health data entered by the Tenant into the platform, Ivemind acts as a Data Processor under Art. 28 GDPR, while the Controller remains the optical store (Tenant), which has the duty to inform its own customers and to collect the necessary legal bases, including consent under Art. 9 for health data.

5. Purposes and legal basis

Data are processed for: (i) provision of the service and management of the contractual relationship with the Customer (Art. 6.1.b GDPR); (ii) compliance with legal, accounting and tax obligations (Art. 6.1.c GDPR); (iii) IT security, fraud prevention, audit and legal defence (Art. 6.1.f GDPR — legitimate interest); (iv) sending commercial communications, only with explicit and revocable consent (Art. 6.1.a GDPR); (v) website usage statistics, subject to consent (Art. 6.1.a GDPR); limited to the transmission of cookieless events that precedes the user’s choice — described in detail in § 5.1 of the Cookie Policy, to which reference is made for the list of data transmitted — the Controller’s legitimate interest in measuring the site’s audience (Art. 6.1.f GDPR), with a right to object under Art. 21 GDPR; (vi) marketing, advertising conversion measurement and retargeting through the Google and Meta tools described in the Cookie Policy, including the server-side transmission of conversion events linked to a contact request, solely with specific and revocable consent (Art. 6.1.a GDPR). For health data, processing is carried out on behalf of the Tenant on the basis of Art. 9.2 GDPR and the Tenant’s obligations as an optical professional; Ivemind does not determine its purposes. For people trying the demo, purposes and legal bases are described in § 8-bis.

6. Data retention

Data are kept for the time strictly necessary for the purposes: (a) account and configuration data: duration of the contractual relationship; (b) operational, clinical and WhatsApp data: duration of the contract plus 24 months after termination, unless the Customer requests otherwise or a longer retention obligation applies; (c) technical and audit logs: 12 months; (d) website analytics data: retained by Google at event level for a maximum of 14 months; the related _ga and _ga_*cookies last 2 years; (d-bis) marketing cookies: Meta’s _fbp and _fbc 90 days, Google’s _gcl_au and _gcl_aw 90 days; click identifiers kept by the site for the duration of the browser session only; (d-ter) record of the cookie choice: 365 days; (e) tax and accounting data: 10 years as required by Italian law; (f) data of people trying the demo: as stated in § 8-bis. At the end, data are deleted or irreversibly anonymised. Cookie durations are summarised by category in the Cookie Policy.

7. Processors, joint controllers and non-EU transfers

To provide the service the Controller relies on processors under Art. 28 GDPR, bound by specific agreements (DPA): (i) Amazon Web Services EMEA SARL, cloud infrastructure provider, with data hosted in the eu-central-1 region (Frankfurt, Germany); (ii) Meta Platforms Ireland Ltd, for integration with the WhatsApp Business platform, limited to the delivery of template notifications to the Tenant’s end customers; (iii) Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland), for statistical measurement of the website through Google Analytics 4 and for advertising campaign measurement through Google Ads; (iv) Slack Technologies Limited(Dublin, Ireland), to receive the reports that users of the application send with the “Serve aiuto?” (Need help?) button (text, any screenshot and technical context). The up-to-date list of processors is available on request by writing to privacy@ivemind.com.

Joint controllership. With respect to the event data collected on the rivedi.ai website through the Meta Pixel — a tool that is prepared but not yet active, see the Cookie Policy — the relationship with Meta Platforms Ireland Ltd is not one of processorship under Art. 28 but of joint controllership under Art. 26 GDPR, limited to the collection of such data and their transmission to Meta; the processing Meta subsequently carries out for its own purposes falls under Meta’s sole controllership. The essence of the arrangement is made available in the Cookie Policy, which also gives the references published by Meta. This is a different qualification from point (ii) above, which concerns only the WhatsApp notifications sent by the Tenant to its own end customers.

Non-EU transfers. Google Ireland Ltd, Meta Platforms Ireland Ltd and Slack Technologies Limited may transfer data to their respective US companies. Such transfers are based on the EU-US Data Privacy Framework adequacy decisionadopted by the European Commission on 10 July 2023 — to which Google LLC, Meta Platforms, Inc. and Slack Technologies, LLC (through Salesforce) adhere — and, in the alternative, on the Standard Contractual Clauses under Decision (EU) 2021/914, with supplementary measures. The management software data (including clinical data) remain hosted exclusively within the European Union.

8. WhatsApp notifications to end customers

rivedi allows the Tenant to send, through Meta’s WhatsApp Business Platform, template-based notifications to its own end customers who have given the relevant consent (appointment reminders, “glasses ready” notices, recalls for eye checks). With respect to those end contacts, Ivemind acts as a Data Processor under Art. 28 GDPR, while the Controller remains the Tenant, which has the duty to inform its contacts and collect the necessary legal bases. The data processed (contact’s phone number, template message content, timestamp, delivery receipts) are hosted exclusively within the European Union (AWS Frankfurt) and shared with Meta solely to deliver the message. Any requests from end data subjects (access, deletion, rectification) must be addressed first to the Tenant Controller; Ivemind provides technical support to the Tenant to fulfil them. See also the Data deletion page.

8-bis. People trying the demo (trial access to the demonstration environment)

This section concerns people who receive from Ivemind a time-limited access to the rivedi demonstration environment (the “demo”), governed by the Terms of Use of the Demo accepted at first access. For these data Ivemind is the Data Controller.

Data processed.(a) The data you give us to activate the trial: first and last name, email address and, if you provide them, the name and city of your shop, phone number and VAT number, plus the internal notes of the person who activates your access. (b) Access data: the authentication account with your email, the pseudonym under which you appear in the demo (for example “Prova 07”), the activation, extension and expiry dates, your first and last access. (c) The record of your acceptance of the Terms: version and fingerprint of the text, specific approval of the clauses, date and time, IP address and browser. (d) Use of the demo: for each day, how many operations you perform in the different areas of the application (for example sales, appointments, customers), counted before the nightly reset. (e) The reports you send with the “Serve aiuto?” button: the text, any screenshot and the technical context (page, screen size, access identifier). (f) If you use the dictation assistant, the dictated text, which is used to compose the draft record and is neither retained by the provider nor used to train models. (g) Your optional consent to receive commercial proposals, if you give it, and its possible withdrawal (version and fingerprint of the text, date and time, and where from: the app, the console or the link at the bottom of the emails). (h) The automatic emails we send you: which one, when, and whether it was sent.

You must not enter personal data in the demo (art. 4 of the Terms): inside the environment you appear only under your pseudonym, and the other participants do not see your name or your email. Whatever you enter in the demo is deleted by the nightly reset.

Purposes and legal bases.(i) Activating, managing, extending and closing your access and sending you communications about the trial (credentials, extensions, automatic notices such as the one about its expiry): performance of the request you made to us (Art. 6.1.b GDPR). (ii) Keeping evidence of your acceptance of the Terms and ensuring the security of the shared environment, including the prevention of abuse: legitimate interest of the Controller (Art. 6.1.f GDPR). (iii) Following you during the trial and improving the product: every morning Ivemind’s founders receive by email an internal summary with, for each access, name, shop and city, pseudonym, last access, acceptance of the Terms and the number of operations performed the day before in each area of the application. Legal basis: legitimate interest of the Controller (Art. 6.1.f GDPR); you may object at any time by writing to privacy@ivemind.com. (iv) Answering your reports: legitimate interest (Art. 6.1.f GDPR). (v) The dictation assistant, if you choose to use it: performance of the requested function (Art. 6.1.b GDPR). (vi) If you accept it with the optional checkbox (at your first access or from your profile), contacting you by email or telephone with information and commercial proposals about rivedi.ai, also after the end of the trial: consent (Art. 6.1.a GDPR). We do not use trial data to send you commercial communications without your consent; you may withdraw it at any time from your profile during the trial, with the link at the bottom of every commercial email or by writing to privacy@ivemind.com, with no consequence for the trial.

Providing your name and email is necessary to activate the access; the other activation data are optional.

Retention.Activation, access and usage data: for the duration of the trial and the 12 months following its closure, then anonymised. The authentication account is deleted when the access expires or is revoked. Record of the acceptance of the Terms, with the email used to accept: 10 years, with IP address and browser deleted after 12 months. Morning summaries: in the founders’ mailboxes, for as long as needed to follow the trial and in any case no longer than 12 months after its closure. Reports: for as long as needed to handle them. Consent to commercial proposals: valid until withdrawn and in any case no longer than 24 months from when you gave it; the record of the grant and of the withdrawal is kept as evidence for the same period as the record of the acceptance of the Terms. Technical logs: 12 months, as in § 6.

Providers and transfers.Amazon Web Services EMEA SARL, with data in the eu-central-1 region (Frankfurt), for the infrastructure, authentication (Amazon Cognito), service emails (Amazon SES) and the dictation assistant (Amazon Bedrock, in European Union regions); Slack Technologies Limited, to receive the reports sent with “Serve aiuto?”, with a possible transfer to the United States on the basis of the EU-US Data Privacy Framework (§ 7). When you use dictation, your voice is transcribed by your browser: if it cannot do so on the device, the audio is processed by the browser provider (Google for Chrome, Apple for Safari) under its own terms, outside our control.

Rights.You have the rights described in § 9 (access, rectification, erasure, restriction, portability, objection) and you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali). To exercise them, or to object to the morning summary, write to privacy@ivemind.com. For anything concerning the trial (extensions, questions) write to sales@ivemind.com.

9. Rights of the data subject

The data subject may exercise at any time the rights under Articles 15-22 GDPR: access, rectification, erasure (“right to be forgotten”), restriction, portability, objection to processing based on legitimate interest, and the right not to be subject to automated decisions. Requests should be sent to privacy@ivemind.com and receive a reply within 30 days. The right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the competent supervisory authority remains unaffected.

Where processing is based on consent, that consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal (Art. 7.3 GDPR). For cookies and tracking tools, withdrawal is exercised directly through the “Cookie preferences” link in the site footer, with immediate effect: the procedure and its consequences are described in the Cookie Policy.

10. Minors

The rivedi service is not intended for children under 16. The Controller does not knowingly collect personal data of minors through the site. The Tenant’s end-customer data, including any minors assisted, are processed under the Tenant Controller’s responsibility. Anyone who believes a minor has provided personal data through the site is invited to contact privacy@ivemind.com.

11. Changes to this Policy

The Controller reserves the right to update this Policy to reflect regulatory, organisational or technical changes. The most recent version is always published on rivedi.ai with the date of the last update and the version number. In the event of material changes, registered users will be informed with reasonable notice.

12. Contact

For privacy requests, exercise of rights or clarifications: privacy@ivemind.com. For commercial requests: sales@ivemind.com. For support and information: info@ivemind.com. Official communications via PEC: ivemindscs@pec.it. Registered office: IVEMIND Società Cooperativa Sociale, Via Werner von Siemens 23, 39100 Bolzano (BZ), Italy.