Privacy notice — Nives virtual assistant

On www.helmur.it you will find Nives, a virtual assistant based on artificial intelligence that answers visitors’ questions about products, sizes, delivery and returns. This page explains what data Nives processes, why, with which providers and for how long. It supplements our general Privacy Policy and our Cookie Policy, which remain valid for the rest of the Site.

1. Data controller

The data controller is ALTITUDE S.r.l.s., with registered office at Via Roma 386, 35010 San Giorgio delle Pertiche (PD), Italy, VAT number and tax code 05786140284, REA PD-492448.

For any question about this notice or your data you can write to [email protected] or, by certified email, to [email protected].

2. You are talking to an artificial intelligence

Nives is not a person. Its answers are generated automatically by an artificial intelligence model, which consults the catalogue and the information pages of the Site before replying. We say so in the chat window, in the header and above the first message, as required by art. 50 of the AI Act.

Nives can help you find a garment, guide you on size, check availability, explain delivery and returns, check the status of an order and take a request to be contacted by our staff.

There are things Nives does not do: it does not conclude contracts, does not change orders, does not take decisions that produce legal effects concerning you and does not carry out any automated processing within the meaning of art. 22 of the GDPR. Its answers may contain mistakes: in case of doubt, the product pages, the Terms and Conditions and the information pages of the Site, or a reply from our staff, prevail.

3. What data we process

The content of the messages. Everything you write in the chat and Nives’s replies, together with the date and time of the messages, the language and the page of the Site from which you opened the conversation.

Technical data for security. Your IP address is not stored in clear text: we keep only an irreversibly transformed version of it (hash), which we use to limit the number of messages and to block abuse without knowing who you are.

Your preferences, if you have an account. If you are logged into your customer account, Nives can remember some preferences you have given it — the department, your size, colours, budget, materials to avoid — so as not to ask you again. If you tell us you avoid a material because of an allergy or a health reason, we record only the material to avoid, never the reason.

The data of a callback request. If you ask to be contacted, we ask you for your first name, surname, email address, telephone number, your preferred channel (telephone, WhatsApp or email) and, if you wish, a message, together with confirmation that you have read this notice.

The data to check an order. To show you the status of a delivery, Nives asks you for the order number together with the email or telephone number given at the time of purchase. It uses them only to check that the order is yours.

Your ratings. If you indicate that an answer was helpful or not, we record the rating.

Nives does not ask for and does not process payment data: cards, IBANs and codes never pass through the chat.

4. Why we process it and on what legal basis

Answering your questions and assisting you before and after your purchase. The processing is necessary to follow up your request and to carry out pre-contractual measures or the sales contract (art. 6(1)(b) GDPR).

Contacting you back. This happens only if you ask for it by filling in the form, to follow up your request (art. 6(1)(b) GDPR).

Remembering your preferences if you have an account. This is based on our legitimate interest in offering you a more practical service (art. 6(1)(f) GDPR). You can object at any time, and the preferences are deleted.

Protecting the service from abuse. Limiting messages and blocking automated use serves our legitimate interest in the security of the Site (art. 6(1)(f) GDPR).

Improving the answers. Our staff periodically re-read the questions Nives was unable to answer and those rated negatively, in order to complete the information on the Site. This is based on our legitimate interest in improving the service (art. 6(1)(f) GDPR); the data is not used for any other purpose.

Complying with legal obligations and, where necessary, asserting or defending a right of ours (art. 6(1)(c) and (f) GDPR).

5. How the artificial intelligence processes messages

To generate each answer, the message you write is sent — together with the previous messages of the same conversation and the relevant catalogue information — to the artificial intelligence model Claude, provided by Anthropic, which processes it and returns the answer. The provider acts on our behalf as a data processor.

The information on products, sizes, delivery and returns that Nives gives you comes from our Site: the model rephrases it, but does not invent it. When a piece of information is not available, Nives is instructed to say so and to offer you contact with our staff.

6. Who it may be disclosed to

The data is accessible to ALTITUDE staff authorised to process it and may be disclosed, to the extent strictly necessary, to:

• the provider of the artificial intelligence model indicated in point 5;
• the provider of the hosting service on which the Site is hosted;
• the providers responsible for the technical maintenance of the Site;
• the email service through which we receive callback requests.

These parties act as data processors on the basis of an agreement with us. The updated list is available on request at the contacts given in point 1. Your data is not sold or transferred to third parties for marketing purposes.

7. Transfer of data outside the European Union

The model provider indicated in point 5 processes the data in the United States. The transfer is made to an organisation that participates in the EU-US Data Privacy Framework, recognised as adequate by the European Commission by decision of 10 July 2023 (art. 45 GDPR), and is also covered by the standard contractual clauses approved by the Commission, included in the provider’s data processing agreement (art. 46 GDPR).

You can ask us for a copy of the safeguards adopted by writing to the contacts in point 1.

8. How long we keep it

• Conversations: are deleted automatically 90 days after the last message.
• Callback requests: for the time needed to handle your request and in any case no longer than 90 days from the request, after which they are deleted automatically.
• Account preferences: for as long as your account remains active, or until you ask us to delete them.

Longer periods required by law remain unaffected, for example for data linked to an order.

9. Cookies and browser storage

To work, the chat keeps the current conversation in your browser’s temporary storage (sessionStorage), which is emptied when you close the tab.

When you open a product suggested by Nives, the Site saves a first-party cookie, ns_ai_attr, which contains only a conversation code and lasts 7 days: it lets us know whether a purchase was helped by the chat. It does not contain the text of the messages and is not shared with third parties. For all the other cookies on the Site see the Cookie Policy.

10. What not to write in the chat

To help you, Nives does not need sensitive data. We ask you not to write payment card numbers, passwords or access codes, identity documents, or information about your health or other special categories of data in the chat. If you need to tell us something confidential, write directly to [email protected].

11. Your rights

At any time you can ask us to access your data, to rectify it, to delete it or to restrict its processing, to receive it in a readable format (portability) and to object to processing based on our legitimate interest (arts. 15–22 GDPR).

To exercise them, write to [email protected] or by certified email to [email protected], stating the email or telephone number you used in the chat: we will reply within one month.

If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

12. Changes to this notice