Privacy Policy

Last updated: June 5, 2025

Pursuant to Art. 13 of EU Regulation 2016/679 (hereinafter the “GDPR”) and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (collectively referred to as “Privacy Law”), Webidoo S.p.A. provides the user/data subject with the following information on the processing of personal data.

This privacy notice applies only to the website https://groow.ai/ and the app https://app.groow.ai and not to other websites or apps possibly accessed by the user via links. By visiting this site, data relating to identified or identifiable individuals may be processed.

• Data Controller

The Data Controller is Webidoo S.p.A., with registered office in Milan, Via Gioberti 8 (hereinafter the “Controller”), which will collect and process the users’ personal data solely to pursue its legitimate purposes, as outlined below.

The Controller has appointed a Data Protection Officer (DPO), who can be contacted at the following email address: dpo@webidoo.com.

• Purposes and legal basis of processing your personal data

We process users’ personal data for the following purposes:

• to register the user on the Groow platform, available at https://groow.ai or the app page https://app.groow.ai/, in order to provide virtual assistant services based on Artificial Intelligence to simplify business processes and respond to user requests. The legal basis for this processing is the need to fulfill a user’s request, execute a contract and/or pre-contractual measures. Providing personal data for this purpose is necessary; failure to provide such data will prevent the user from obtaining the requested services;
• to send promotional communications about the Controller’s products and services via automated (banners, emails, SMS, MMS) and non-automated means (postal mail, calls with operators). The legal basis is the data subject’s consent. The user may withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Providing data for this purpose is optional; failure to provide it will not affect the user’s access to the services requested from the Controller;
• to identify and define the user’s preferences, habits, needs (“profiling”). The legal basis is the data subject’s consent. Consent may be withdrawn at any time, without affecting the lawfulness of prior processing. Providing data for this purpose is optional and not providing it will not affect service access;
• to manage and process aggregated statistical reports on platform usage and, if necessary, to exercise our rights in legal proceedings. The legal basis is the Controller’s legitimate interest, assessed as not overriding the data subjects’ interests and rights in a document called LIA (Legitimate Interest Assessment);
• to carry out customer satisfaction activities, possibly involving the sending of questionnaires to users, analyzed in aggregated form. The legal basis is the Controller’s legitimate interest, assessed in the LIA;
• to comply with any other obligation arising from applicable law or official orders. The legal basis is the need to comply with legal obligations.

1. Personal data processed

The data processed by the Controller includes:

• Data voluntarily provided by the user

We process any personal data collected or otherwise provided by the user during registration or while using the virtual assistant service based on AI. Voluntarily provided data includes identifying data (name, surname, place and date of birth, VAT number, company), contact details (email, business phone number), access credentials (username and password), profiling data (if consented), payment data, and any documents uploaded to allow AI agents to perform tasks (e.g. document analysis, email management, report generation).

• Browsing data

IT systems and software procedures that operate the site collect certain personal data as part of Internet communication protocols (log files).

This information is not collected to identify data subjects, but could, by its nature, be used to identify users through processing and association with third-party data.

This category includes IP addresses or domain names of computers used by users accessing the site, URI (Uniform Resource Identifier) addresses of requested resources, request time, pages viewed, average time spent on the site, method used to submit the request to the server, size of the response file, response code from the server (success, error, etc.), and other parameters related to the user’s OS and environment.

The IP address and so-called timestamp (i.e., the exact time consent was given) will be stored together with the provided data to prove the moment we obtained consent.

• Categories of recipients of personal data

Personal data may be accessed and processed:

• by the Controller’s authorized personnel, in order to perform necessary platform operations;
• by the Controller’s suppliers, such as technology providers, consultants, and freelancers acting as data processors.

• International transfers

If we transfer your personal data outside the EU, we ensure an adequate level of protection. Transfers to suppliers outside the EU are made either based on adequacy decisions or Standard Contractual Clauses approved by the European Commission.

• Data retention

Personal data will be retained by Webidoo in compliance with the principles of data minimization and storage limitation under Art. 5(1)(c) and (e) of the GDPR. Data will be stored only as long as necessary to fulfill the purposes for which they were collected. Specifically, voluntarily provided data and browsing data will be retained for up to 12 and 24 months respectively after subscription ends.

• Security of processing

As the Data Controller, Webidoo ensures high security standards for the processing of personal data by using appropriate tools to safeguard confidentiality. Data is processed using IT and telematic tools, methods, and procedures strictly necessary for achieving the purposes described in point 2 of this policy.

Webidoo implements physical, technical, and organizational security measures in accordance with Art. 32 GDPR to prevent data loss, unlawful or incorrect use, and unauthorized access (Data Breach).

1. Data subject rights

In accordance with Articles 15 to 22 of the GDPR, the user may exercise their rights at any time. Specifically, users have the right to access, rectify, erase, and, where applicable, to data portability, restriction of processing, and objection. More information can be found on www.garanteprivacy.it or in the GDPR. If processing is for marketing purposes or based on legitimate interest, objection is always permitted. To learn more or exercise your rights, you may contact the Controller at hello@webidoo.com or by regular mail, indicating in the subject line “EXERCISE OF PERSONAL DATA RIGHTS” and specifying the right being exercised.

You may also contact the Data Protection Officer for details on data processing by writing to dpo@webidoo.com.

At any time, the user has the right to lodge a complaint with the Data Protection Authority if a satisfactory response has not been received from the Controller or if a violation of rights is believed to have occurred.