Privacy notice on the processing of personal data.

For any request for clarification, for information on the data architecture, or to exercise the rights granted by applicable personal data protection law, data subjects may contact the Controller directly using the contact details above or by email at privacy@cosen-lab.com.

1. 2.1 · Automatic

   Browsing data and technical metadata

   The IT systems and software procedures used to operate this website automatically acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category includes: IP addresses, HTTP status codes, server request times (UTC timestamps), URI/URL notation of the requested resources, operating system parameters, and the resolution and specifications of the browser used by the user.

2. 2.2 · Provided by you

   Data voluntarily provided by the data subject

   Personal and contact data provided by the user when sending messages through the contact forms, requesting private demos, or subscribing to newsletters or lab communications, namely: first name, last name, business or personal email address, telephone number, company name of the entity or business represented, and the text content of the messages exchanged.

3. 2.3 · AI features

   Data handled through artificial intelligence features

   Any prompts, advanced search queries and datasets voluntarily provided by the user to interact with the analytical, predictive or simulation components on the website are processed in full and strict compliance with Regulation (EU) 2024/1689 (Artificial Intelligence Act).

• No improper training

  Personal data entered in prompts are not used for the unauthorized retraining of foundation models or third-party algorithms.

• No biometric profiling or scoring

  Esse 2 S.r.l.s. categorically rules out any form of biometric profiling, social scoring or unauthorized remote identification.

• Transparency and human oversight

  Algorithmic results are generated in real time with appropriate technical safeguards to ensure the reliability and traceability of the output.

Providing data for purposes A, B, C and D is essential for browsing the website and for the proper handling of requests. Providing data for purpose E is entirely optional; failure to give consent, or its withdrawal, does not in any way affect access to the website or to the other services.

• Advanced encryption

  All online sessions and API calls use TLS 1.3 protocols with secure cipher suites and Perfect Forward Secrecy. Data stored on servers is protected with AES-256 encryption.

• IAM and MFA management

  Access to production systems strictly follows the Principle of Least Privilege (PoLP) and requires multi-factor authentication (MFA) for all administrative identities.

• Redundant backups and BCDR

  Periodic, encrypted backup procedures, geographically distributed within the EU, with semi-annual restore tests and strictly controlled RTO/RPO parameters.

• Continuous monitoring

  Logging and auditing of critical events through a Web Application Firewall (WAF), proactive detection of network anomalies, and structured management of any security incidents.

1. Data processors (Art. 28 GDPR)

   Cloud hosting providers located in the European Union, email and telecommunications providers, IT consultants responsible for infrastructure maintenance, and tax and legal advisory firms engaged for legal obligations.

2. Authorized personnel

   Internal employees and collaborators of Esse 2 S.r.l.s., specifically instructed, authorized and bound by strict contractual confidentiality obligations.

3. Public and judicial authorities

   Supervisory bodies and law enforcement agencies, solely in the cases provided for by mandatory rules or by lawful orders of the competent national or European authorities.

The up-to-date list of external Data Processors is kept at the Controller’s registered office and is promptly made available upon written request sent to privacy@cosen-lab.com.

Upon expiry of the respective retention period, data are securely and irreversibly deleted or permanently anonymized through certified IT procedures.

• Art. 15

  Right of access

  To obtain confirmation as to whether or not personal data concerning you are being processed, and to receive a clear copy of them.

• Art. 16

  Right to rectification

  To obtain the prompt correction of inaccurate data or the completion of incomplete data.

• Art. 17

  Right to erasure (right to be forgotten)

  To request the permanent deletion of data when no longer necessary for the original purposes, or upon withdrawal of consent.

• Art. 18

  Right to restriction

  To request the temporary suspension of processing where data are contested or a complaint has been lodged.

• Art. 20

  Right to data portability

  To receive your data in a structured, commonly used and machine-readable format (e.g. JSON or CSV).

• Art. 21

  Right to object

  To object at any time to processing based on the Controller’s legitimate interest.

Data subjects may exercise their rights at any time, entirely free of charge and without formal requirements, by sending a written communication to the dedicated addresses: privacy@cosen-lab.com or PEC (certified email) esse2-srls@pec.it.

Data subjects residing or established in another Member State of the European Union may also lodge a complaint with the supervisory authority of the country in which they habitually reside, work, or in which the alleged infringement took place.