Privacy Policy — exonis.ai

Introduction

The processing of personal data relating to the website www.exonis.ai is carried out in compliance with EU Regulation 679/2016 (GDPR) and the principles of correctness, lawfulness, transparency, purpose and storage limitation, minimisation and accuracy, and protection of integrity and confidentiality.

This Privacy Policy is provided for the website www.exonis.ai (hereinafter the “Site”), the institutional website presenting the Exonis platform.

The Data Controller is Ehilab S.r.l. (hereinafter “Ehilab” or the “Controller”), owner of the Exonis platform and part of the group operating under the tk.digital brand.

• Tax code / VAT: 08236740729
• Share capital: € 10,000.00
• Registered office: Corso Vittorio Emanuele II 30, Bari, Italy

To request further information on the processing of personal data or to exercise their rights, the User may contact us:

• in writing, at the registered office above;
• by email at: privacy@exonis.ai.

1. What is personal data and what is processing

Personal data is information that identifies or can identify, directly or indirectly, a natural person. By way of example: name, surname, email address or other contact details, an online identifier.

Processing is any operation performed with or without the aid of automated processes and applied to personal data (collection, recording, organisation, storage, modification, consultation, deletion or destruction).

2. What personal data are processed

Navigation data. The computer systems responsible for the operation of the Site acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (e.g. IP addresses, URIs of requested resources, the time of the request, parameters relating to the User’s operating system and computer environment). This data is used solely to obtain anonymous statistical information on the use of the Site, to check its correct functioning and identify anomalies and/or abuses. It may be used to ascertain liability in the event of hypothetical computer crimes against the Controller or third parties.

Data provided by the User. The User’s data are collected by the Controller when the “Request a demo” form on the Site is completed. The form requires: full name, business email, company, role (optional) and an optional message describing the User’s needs. This is professional contact and identification data. The User is invited not to enter unnecessary personal data in the free-text field, and in particular not to enter special categories of data (Art. 9 GDPR).

3. Purposes of processing

The User’s personal data will be processed for the following purposes:

• to respond to the User’s requests and provide information on the services and the Exonis platform offered by Ehilab and the other companies of the group;
• to arrange and define a demo of the platform with the User;
• to send the User communications/notifications regarding the request;
• to fulfil obligations required by law or regulation and to meet requests from the competent Authorities;
• to allow the Controller to exercise its right of defence (extrajudicial, judicial).

4. Legal basis for processing

Each processing operation is justified by one of the following legal bases:

• Pre-contractual/Contractual: processing is necessary to respond to a User’s request and, where applicable, to carry out pre-contractual measures.
• Legal obligation: processing is necessary to fulfil a legal obligation.
• Legitimate interest: processing is necessary for the pursuit of the Controller’s legitimate interest, provided that the User’s interests or fundamental rights and freedoms do not prevail.
• Consent: for purposes requiring it, processing is only possible with the User’s consent, which may be withdrawn at any time.

5. To whom the data may be disclosed

For the purposes specified above, the User’s personal data may be shared with:

• duly appointed Data Processors providing services on behalf of and under the instructions of the Controller (for example, the hosting/cloud service provider, with servers located in the European Union); the User may request an updated list of Processors at any time;
• other companies of the group operating under the tk.digital brand, including as resellers of the Exonis platform;
• autonomous Data Controllers to whom the data may be communicated pursuant to provisions of law or orders by the Authorities, or to allow the Controller to exercise its rights (e.g. a law firm);
• persons authorised by the Controller (employees and/or collaborators) bound by an appropriate obligation of confidentiality.

The Controller does not sell or otherwise disclose the User’s personal data to third parties.

6. Where the data are stored

All personal data are stored in electronic form on servers located in the European Union. Where necessary, the Controller may transfer the data outside the EU, ensuring that such transfer takes place in accordance with applicable legal provisions (e.g. standard contractual clauses).

7. How long the data are stored

Personal data are processed with appropriate technical and organisational security measures aimed at preventing accidental loss, unauthorised use or access, alteration or disclosure. Personal data are retained only for as long as necessary to fulfil the purposes for which they were collected, and to meet any legal, accounting or reporting requirements.

8. Minors

Minors under 16 years of age must not provide information or personal data to the Controller without the consent of those exercising parental responsibility. Without such consent, it will not be possible to send requests through the Site.

9. The User’s rights

The User may at any time request confirmation as to whether their personal data are being processed and, in relation to such data, has the right to: access the data; withdraw consent; request rectification; request erasure; request restriction of processing; request data portability; object to processing; lodge a complaint with the competent Authority (the Italian Data Protection Authority, www.garanteprivacy.it).

To exercise these rights, the User may use the contact details provided in the Introduction.

10. Automated decision-making

The User is not subject to decisions based solely on automated processing of data collected through the Site.

11. Amendments

The Controller reserves the right to amend or update this Privacy Policy, in part or in full, including due to changes in applicable law. Such changes will be binding as soon as published on the Site. The User is invited to visit this section regularly.

Last updated: 27 June 2026