Privacy Notice of the PaneaMCP connector

English translation provided for convenience. In case of discrepancy, the Italian version prevails.

Panea S.r.l. protects the confidentiality of the personal data of the users authorised to use its services and guarantees them the necessary protection against any event that may expose them to the risk of a breach.

As provided for by Regulation (EU) 2016/679 ("GDPR"), and in particular by Articles 13 and 14, the following information is provided to the user authorised to use the PaneaMCP connector (a natural person, employee or collaborator of a Panea Customer, or of the professional firm acting on behalf of the employers it assists, to whom named access credentials have been assigned; hereinafter the "User" or "Data Subject") regarding the processing of their personal data in connection with the use of the PaneaMCP connector (hereinafter the "Connector"), which allows an artificial intelligence application (hereinafter the "AI Agent"), supplied by a party chosen and contracted by the Customer (hereinafter the "AI Provider"), to be connected to the eLaborHub payroll and human resources software. This notice concerns the User's personal data; the processing of the data of the workers managed in eLaborHub is covered by the notice given to the workers by their respective employer.

1. Identity of the Controller and of the parties involved in the management of personal data

The Controller of the personal data is Panea S.r.l. (hereinafter "Panea" or the "Controller"), with registered office at Via G. Conforti 2/M, 87100 Cosenza (CS), Italy, tax code and VAT number 18160651008, represented by its legal representative pro tempore, whose contact details are:
- telephone: +39 342 606 0761;
- e-mail: rtrubiani@paneagroup.it;
- certified e-mail (PEC): panea@paneagrouppec.it.
Panea processes the User's data in two distinct capacities:
- as an independent controller, for the management of user accounts, the recording of the acceptance of the Terms of Service, the security of the service itself (authentication, usage limits, abuse prevention) and technical support;
- as a processor pursuant to Article 28 GDPR on behalf of the Customer, under the data processing agreement relating to eLaborHub, for keeping the log of operations performed through the Connector on the Customer's data. For this processing the controller is the Customer (the User's employer, or the assisted employer on whose behalf the User acts), whom the User may also contact for the information required by employment law.
The other parties involved in the management of personal data, within the processing covered by this notice, are:
- Oracle Italia Srl, on whose infrastructure the Connector is provided, acting as processor pursuant to Article 28 GDPR;
- the AI Provider, supplier of the AI Agent chosen and contracted by the Customer, acting as the Customer's processor under the agreement between them. The AI Provider is not Panea's processor and has no contractual relationship with it; the data that the User enters into the AI Agent (requests and conversations) are processed under the responsibility of the Customer, who provides the User with information about the AI Provider used.
The up-to-date list of processors is available from the Controller at the contact details above.

2. DPO – Data Protection Officer

Panea has appointed a Data Protection Officer (DPO), who can be contacted at rpd@paneagroup.it.

3. Categories of data processed

The User's personal data are partly provided by the Customer when the account is enabled (Article 14 GDPR) and partly generated by the use of the Connector. The categories of data processed are:
- Account identification data: operator code, e-mail address, first name and surname, Customer (tenant) to which the User belongs, assigned role (administrator / user), managed companies for which the User is authorised.
- Authentication data: information contained in the access token issued by the identity management service (user identifier, Customer, date and time of issue and expiry). Access credentials are managed by the identity management service: the Connector neither receives nor stores the User's password.
- Data on acceptance of the Terms: date and time of acceptance, version of the text accepted, activation status of the service (onboarding).
- Operations log (audit): for each operation, operator code, date and time, Customer, function invoked, company involved, outcome, duration and size of the response. The log does not contain the content of successful responses; a text detail, limited to 500 characters, is recorded only in the event of an error or block.
- Security events: usage limits exceeded per Customer or per User, denied access, authorisation errors.
- Scheduled notifications: for e-mail notifications scheduled by the User, the recipient's e-mail address (which may be a person other than the User), subject and text of the message, report type and its parameters, sending schedule, author and creation date.
- Feedback reports: any text entered through the service quality feedback function. Workers' personal data must not be entered in this field.
- Technical connection data: IP address and technical connection data recorded by the network infrastructure (load balancer) and by the identity management service. The Connector does not record the User's IP address.
Through the Connector Panea does not process the content of the requests (prompts) made by the User to the AI Agent, nor the responses produced by the AI Agent, which remain within the sphere of the Customer and the AI Provider. No special categories of data relating to the User are processed.

4. Purposes of processing

Providing the data referred to in section 3 is necessary to enable and use the Connector: without them, the service cannot be accessed. The processing does not require the User's consent; the acceptance of the Terms of Service requested at first access is contractual in nature and constitutes acknowledgement, and does not constitute consent to the processing of personal data.
Specifically, the User's personal data are processed for the following purposes:
a) activation and management of the account, authentication and verification of the role and of the companies for which the User is authorised, provision of the service, including the sending of scheduled notifications requested by the User;
b) recording and proof of acceptance of the Terms of Service and of their versions;
c) keeping the log of operations performed through the Connector on the Customer's data, on behalf of the Customer and on its instructions (security, traceability of access, non-repudiation, responding to requests from the workers concerned, management of any data breaches);
d) security of the service: application of usage limits, prevention and detection of abuse and unauthorised access, protection of the integrity of the log, management of security incidents;
e) technical support, handling of reports and improvement of the service, including through feedback reports;
f) compliance with legal obligations and orders of the Authorities, and protection of the Controller's rights in court.
Panea does not use the User's data to assess their performance, productivity or work behaviour, nor for profiling or marketing purposes. Usage statistics are produced in aggregate form. Any use of the operations log by the Customer is subject to the rules that the Customer is required to observe as employer, including Article 4 of Law 300/1970 (Workers' Statute), and to the notice given by the Customer.

5. Legal basis

Processing for the purposes described in section 4, letters a and b, is necessary for the performance of the Terms of Service accepted by the User (Article 6(1)(b) GDPR) and for the pursuit of Panea's legitimate interest in performing the supply agreement entered into with the Customer (Article 6(1)(f) GDPR).
Processing for the purpose described in letter c is carried out by Panea on behalf of the Customer, as processor: the relevant legal basis is identified by the Customer, as controller, and is set out in the notice given by the Customer.
For the purposes described in letters d and e, the legal basis is Panea's legitimate interest in the security of systems and information and in the proper functioning of the service (Article 6(1)(f) GDPR), following a balancing test against the rights and freedoms of Users. For the purpose referred to in letter f, the legal basis is compliance with legal obligations (Article 6(1)(c) GDPR) and the legitimate interest in protecting its own rights (Article 6(1)(f) GDPR).
Panea has carried out a data protection impact assessment (Article 35 GDPR) on the Connector, which also covers the processing of Users' data.

6. Processing methods

For all the purposes indicated above, data will be processed in a way that guarantees security and confidentiality, and will be processed by means of IT and telematic tools in order to record, organise, store, consult, extract and communicate the data.
The technical and organisational measures adopted are suitable to guarantee a level of security appropriate to the risks, with particular reference to destruction, loss, alteration and unauthorised disclosure or access. In particular: access takes place with named credentials through an identity management service based on standard protocols (OAuth2/OpenID Connect); the Connector verifies identity, role and authorised companies at every request; communications are encrypted; the operations log is protected against alteration by a chain of signed cryptographic fingerprints; operational information is accessible only to authorised Panea staff with a dedicated role.
The temporary blocking of access when usage limits are exceeded is an automatic technical security measure, which produces no legal effects on the User: in the event of a block, the User may contact Panea or their administrator to have it reviewed.

7. Use of artificial intelligence: roles and warnings for the User

Panea's role. The Connector provides an authenticated, authorised and logged access channel to predefined eLaborHub functions. Panea does not choose the AI Provider, does not provide the AI Agent and does not receive the User's conversations with it.
Role of the Customer and of the AI Provider. The choice of the AI Provider, the conditions of use of the AI Agent, the place of processing and the retention of requests and responses are determined by the Customer in the agreement entered into with the AI Provider; the related information is provided to the User by the Customer.
Warnings. The User is required to:
- use the Connector exclusively with the AI Agent of the AI Provider authorised by the Customer and in compliance with the intended use and the prohibitions set out in the Terms of Service, including the prohibition on using it to monitor, assess or profile individual workers;
- not enter workers' personal data in the feedback function;
- keep their credentials with due care and promptly report to Panea and to the Customer any anomalous or suspicious use.
No model training. Panea does not use the User's data, nor the data passing through the Connector, to train or improve artificial intelligence models.

8. Retention periods

Account identification data and authentication data are kept for the duration of the authorisation and, thereafter, for 12 months from the deactivation of the account.
Data on acceptance of the Terms are kept for the duration of the agreement with the Customer and, thereafter, for 10 years, for the purposes of proving acceptance and protecting the Controller's rights.
The operations log and security events are kept for 24 months from the termination of the service supply agreement with the Customer, unless further retention is necessary to handle security incidents, requests from the Authorities or disputes.
Scheduled notifications are deleted when they are deactivated, which happens when the User deletes them or, for one-off notifications, after they are sent; a record of the operation remains in the operations log.
Feedback reports are kept for 12 months from receipt.
Technical connection data are kept for 30 days by the network infrastructure and for 90 days by the identity management service.
At the end of the periods indicated, the data are deleted or irreversibly anonymised.

9. Location of data, recipients and transfers

The User's data are processed on cloud infrastructure located in the European Union.
Personal data may be communicated, for the purposes indicated above, exclusively to: Panea staff authorised to process them and specifically instructed; the providers of infrastructure, identity management and e-mail sending services, as processors; the Customer, for the data in the operations log and security events relating to the Customer's own accounts; the recipients of scheduled notifications indicated by the User, limited to the content of the notifications; the Authorities, where communication is required by law. The data are not disseminated.
Panea does not transfer the User's data outside the European Economic Area. The Connector's responses are delivered to the AI Agent chosen by the Customer; the AI Provider may be established or process data outside the European Economic Area. Such transmission takes place on the instructions of the Customer, who ensures the safeguards provided for by Articles 44-46 GDPR.

10. Rights of the Data Subject

The User may at any time exercise the rights indicated below:
a) access to personal data: obtain confirmation as to whether or not data concerning them are being processed and, where that is the case, access to the data and to information on the purposes, the categories of data, the recipients and the retention period;
b) data portability: for data processed by automated means in performance of the Terms of Service, receive the data concerning them in a structured, commonly used and machine-readable format;
c) rectification, erasure or restriction of the processing concerning them: erasure of the data in the operations log may be restricted where their retention is necessary for the security of the service, for legal obligations or for the protection of rights in court (Article 17(3) GDPR);
d) objection to the processing of data for the pursuit of a legitimate interest of the Controller, on grounds relating to their particular situation;
e) lodge a complaint pursuant to Article 77 GDPR with the competent supervisory authority based on their habitual residence, place of work or place of the alleged infringement; for Italy the competent authority is the Garante per la protezione dei dati personali, which can be contacted using the details on the website https://www.garanteprivacy.it.
The above rights may be exercised by sending a request to the Controller or to the DPO through the contact channels indicated in sections 1 and 2 of this notice. For data processed by Panea on behalf of the Customer (section 4, letter c), requests should be addressed to the Customer; if received by Panea, they are forwarded without delay to the Customer, whom Panea assists in responding. Requests will be handled without undue delay and in any case within one month of receipt; only in cases of particular complexity or a high number of requests may this period be extended by a further 2 (two) months.

11. Availability of this notice

This notice is made available to the User at first access to the Connector, together with the Terms of Service, and can be consulted at any time at https://mcp.paneagroup.it/privacy?lang=en.