Privacy Policy

This Policy describes how IVEMIND Società Cooperativa Sociale(“Ivemind” or the “Controller”) processes the personal data of users of the rivedi.ai website and of the rivedi service, pursuant to Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (the “Privacy Code”). By using the site or the service, the user acknowledges the practices described here.

This English text is provided for convenience only. In case of any discrepancy, the Italian version of this Policy prevails.

1. Data Controller

The Data Controller is IVEMIND Società Cooperativa Sociale, with registered office at Via Werner von Siemens 23, 39100 Bolzano (BZ), Italy. Tax code and VAT number: IT03138990217. Registered with the Bolzano Company Register no. 03138990217, REA BZ-235349. Certified email (PEC): ivemindscs@pec.it. For requests regarding the processing of personal data you can contact the Controller at: privacy@ivemind.com (privacy), info@ivemind.com (support and information), sales@ivemind.com (commercial requests). The Controller has not appointed a Data Protection Officer (DPO), as the mandatory conditions under Art. 37 GDPR do not apply; a privacy contact remains available at the address indicated above.

2. Description of the service

rivedi is a B2B management software (SaaS) for optical stores and practices in Italy. It allows the optical store (“Customer” or “Tenant”) to run its business — customer records, appointments, optometric record, sales, inventory, invoicing — and to communicate with its own end customers, including notifications via WhatsApp Business.

3. Categories of data processed

The Controller processes the following categories of personal data: (a) navigation data of the rivedi.ai website, collected through cookies and similar technologies (see the Cookie Policy), including IP address, pages visited, device and browser, as well as data on interactions with the pages (scrolling, time on page, sections viewed, clicks on buttons and links); part of those data — including, where the contact form is submitted, a random identifier referring to the individual request — is transmitted to measurement providers also before consent is collected, without cookies and without persistent identifiers, as described in § 5.1 of the Cookie Policy; (a-bis) advertising measurement data, subject to consent: campaign click identifiers (gclid, wbraid, gbraid, fbclid), browser identifiers generated by third-party tools and conversion data (page visit, contact form submission), used to measure campaign effectiveness and for retargeting, with consequent profiling for advertising purposes carried out by the third parties listed in § 7; (b) contact data provided voluntarily via form or email (name, email, any message); (c) service account data (name, email, role, Cognito identifier); (d) operational data entered by the Tenant for its business: end-customer records, appointments, work orders, sales and documents, and — for notifications — phone number, content of template messages sent via WhatsApp, timestamps, delivery receipts and consents; (e) special categories of data under Art. 9 GDPR (health data: refraction, prescriptions, optometric history), processed exclusively on behalf of the Tenant and protected with field-level encryption.

4. Roles: Controller and Processor

For account and website navigation data, Ivemind acts as Data Controller. For end-customer data and health data entered by the Tenant into the platform, Ivemind acts as a Data Processor under Art. 28 GDPR, while the Controller remains the optical store (Tenant), which has the duty to inform its own customers and to collect the necessary legal bases, including consent under Art. 9 for health data.

5. Purposes and legal basis

Data are processed for: (i) provision of the service and management of the contractual relationship with the Customer (Art. 6.1.b GDPR); (ii) compliance with legal, accounting and tax obligations (Art. 6.1.c GDPR); (iii) IT security, fraud prevention, audit and legal defence (Art. 6.1.f GDPR — legitimate interest); (iv) sending commercial communications, only with explicit and revocable consent (Art. 6.1.a GDPR); (v) website usage statistics, subject to consent (Art. 6.1.a GDPR); limited to the transmission of cookieless events that precedes the user’s choice — described in detail in § 5.1 of the Cookie Policy, to which reference is made for the list of data transmitted — the Controller’s legitimate interest in measuring the site’s audience (Art. 6.1.f GDPR), with a right to object under Art. 21 GDPR; (vi) marketing, advertising conversion measurement and retargeting through the Google and Meta tools described in the Cookie Policy, including the server-side transmission of conversion events linked to a contact request, solely with specific and revocable consent (Art. 6.1.a GDPR). For health data, processing is carried out on behalf of the Tenant on the basis of Art. 9.2 GDPR and the Tenant’s obligations as an optical professional; Ivemind does not determine its purposes.

6. Data retention

Data are kept for the time strictly necessary for the purposes: (a) account and configuration data: duration of the contractual relationship; (b) operational, clinical and WhatsApp data: duration of the contract plus 24 months after termination, unless the Customer requests otherwise or a longer retention obligation applies; (c) technical and audit logs: 12 months; (d) website analytics data: retained by Google at event level for a maximum of 14 months; the related _ga and _ga_*cookies last 2 years; (d-bis) marketing cookies: Meta’s _fbp and _fbc 90 days, Google’s _gcl_au and _gcl_aw 90 days; click identifiers kept by the site for the duration of the browser session only; (d-ter) record of the cookie choice: 365 days; (e) tax and accounting data: 10 years as required by Italian law. At the end, data are deleted or irreversibly anonymised. Cookie durations are summarised by category in the Cookie Policy.

7. Processors, joint controllers and non-EU transfers

To provide the service the Controller relies on processors under Art. 28 GDPR, bound by specific agreements (DPA): (i) Amazon Web Services EMEA SARL, cloud infrastructure provider, with data hosted in the eu-central-1 region (Frankfurt, Germany); (ii) Meta Platforms Ireland Ltd, for integration with the WhatsApp Business platform, limited to the delivery of template notifications to the Tenant’s end customers; (iii) Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland), for statistical measurement of the website through Google Analytics 4 and for advertising campaign measurement through Google Ads. The up-to-date list of processors is available on request by writing to privacy@ivemind.com.

Joint controllership. With respect to the event data collected on the rivedi.ai website through the Meta Pixel — a tool that is prepared but not yet active, see the Cookie Policy — the relationship with Meta Platforms Ireland Ltd is not one of processorship under Art. 28 but of joint controllership under Art. 26 GDPR, limited to the collection of such data and their transmission to Meta; the processing Meta subsequently carries out for its own purposes falls under Meta’s sole controllership. The essence of the arrangement is made available in the Cookie Policy, which also gives the references published by Meta. This is a different qualification from point (ii) above, which concerns only the WhatsApp notifications sent by the Tenant to its own end customers.

Non-EU transfers. Google Ireland Ltd and Meta Platforms Ireland Ltd may transfer data to their respective US companies. Such transfers are based on the EU-US Data Privacy Framework adequacy decisionadopted by the European Commission on 10 July 2023 — to which Google LLC and Meta Platforms, Inc. adhere — and, in the alternative, on the Standard Contractual Clauses under Decision (EU) 2021/914, with supplementary measures. The management software data (including clinical data) remain hosted exclusively within the European Union.

8. WhatsApp notifications to end customers

rivedi allows the Tenant to send, through Meta’s WhatsApp Business Platform, template-based notifications to its own end customers who have given the relevant consent (appointment reminders, “glasses ready” notices, recalls for eye checks). With respect to those end contacts, Ivemind acts as a Data Processor under Art. 28 GDPR, while the Controller remains the Tenant, which has the duty to inform its contacts and collect the necessary legal bases. The data processed (contact’s phone number, template message content, timestamp, delivery receipts) are hosted exclusively within the European Union (AWS Frankfurt) and shared with Meta solely to deliver the message. Any requests from end data subjects (access, deletion, rectification) must be addressed first to the Tenant Controller; Ivemind provides technical support to the Tenant to fulfil them. See also the Data deletion page.

9. Rights of the data subject

The data subject may exercise at any time the rights under Articles 15-22 GDPR: access, rectification, erasure (“right to be forgotten”), restriction, portability, objection to processing based on legitimate interest, and the right not to be subject to automated decisions. Requests should be sent to privacy@ivemind.com and receive a reply within 30 days. The right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the competent supervisory authority remains unaffected.

Where processing is based on consent, that consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal (Art. 7.3 GDPR). For cookies and tracking tools, withdrawal is exercised directly through the “Cookie preferences” link in the site footer, with immediate effect: the procedure and its consequences are described in the Cookie Policy.

10. Minors

The rivedi service is not intended for children under 16. The Controller does not knowingly collect personal data of minors through the site. The Tenant’s end-customer data, including any minors assisted, are processed under the Tenant Controller’s responsibility. Anyone who believes a minor has provided personal data through the site is invited to contact privacy@ivemind.com.

11. Changes to this Policy

The Controller reserves the right to update this Policy to reflect regulatory, organisational or technical changes. The most recent version is always published on rivedi.ai with the date of the last update and the version number. In the event of material changes, registered users will be informed with reasonable notice.

12. Contact

For privacy requests, exercise of rights or clarifications: privacy@ivemind.com. For commercial requests: sales@ivemind.com. For support and information: info@ivemind.com. Official communications via PEC: ivemindscs@pec.it. Registered office: IVEMIND Società Cooperativa Sociale, Via Werner von Siemens 23, 39100 Bolzano (BZ), Italy.