A note on this translation. This is a courtesy translation of the Italian original. Where the two versions differ, the Italian text prevails.
1. Who handles your data
The data controller is COMMOEDIA Srl, registered office at Via Mori 6, 40054 Budrio (BO), Italy.
- VAT and tax code: 02111231201
- Companies Register (REA): BO 413357
- D-U-N-S® Number: 435823989
- Email for the company and the website: mail@commoedia.net
- Email for the NOVOCAL app: info@novocal.ai
- Certified email (PEC): pec@commoedia-pec.it
- Telephone: +39 051 0450687
The controller has not appointed a Data Protection Officer: for anything concerning the processing of your data you can write directly to the addresses above.
2. What data we collect
Data you give us
When you fill in the contact form on the website we collect your first name, last name, address, email address and telephone number, together with the content of the message you choose to send us and any personal data you decide to include in it.
Data collected automatically
In the course of normal operation, the systems running the website acquire certain data whose transmission is implicit in the use of internet communication protocols: IP address, browser and device type, operating system, pages visited, date and time of the request, referring site. This data is used to derive anonymous statistics on how the site is used and to keep it working properly and securely.
Data processed by the NOVOCAL app
The app turns the voice messages you submit to it into text. To do so it processes:
- the audio content of the message to be transcribed, sent to the speech recognition engine without any directly identifying data and processed only for as long as is technically necessary to produce the text: once transcription is complete the audio is deleted from the controller's systems and is neither retained nor archived;
- the text produced by the transcription, which is returned to you in the app;
- technical and usage data: device model, operating system and app version, technical identifiers, any error or malfunction reports;
- in-app purchase data: transaction identifier, product purchased, date and outcome. Purchases are handled entirely by Apple and Google through their respective stores: the controller neither receives nor stores payment card details;
- the notification token assigned to your device by the operating system, needed to deliver push notifications. It is a technical identifier and contains neither your name nor any other directly identifying data.
Push notifications are sent only after you have granted the permission requested by the operating system, and you can withdraw it at any time from your device settings without affecting how transcription works.
How transcription works
Transcription is carried out using Whisper, OpenAI's speech recognition model, called through its API. The service provider is OpenAI Ireland Limited (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin, Ireland), acting as a data processor under Article 28 GDPR on the basis of the data processing agreement signed with the controller.
The audio is transmitted without your identifying details: it carries neither your name, nor your contact details, nor any other information leading directly back to you. Content sent through the API is not used to train OpenAI's models. OpenAI may retain what is transmitted for a maximum of 30 days solely for security and abuse prevention, after which it is deleted, unless the law requires longer retention.
Processing takes place on infrastructure located in the United States. The transfer is covered by the Standard Contractual Clauses adopted by the European Commission on 4 June 2021 and incorporated into the data processing agreement signed with OpenAI Ireland Limited. In delivering the service OpenAI may use its own sub-processors, bound by equivalent protection obligations and listed in the provider's contractual documentation.
Cookies and similar technologies
The website uses technical cookies and, subject to your consent, analytics and marketing cookies. The full detail, with names, purposes and durations, is set out in the Cookie Policy.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to enquiries sent through the contact form and following up on commercial contacts | Steps taken at the request of the data subject prior to entering into a contract — Art. 6(1)(b) GDPR |
| Transcribing into text the voice messages you submit to the NOVOCAL app | Performance of the service requested by the data subject — Art. 6(1)(b) GDPR |
| Managing in-app purchases and unlocking purchased features | Performance of a contract — Art. 6(1)(b) GDPR |
| Sending you push notifications about the service and app updates | Consent given through the operating system permission, revocable at any time — Art. 6(1)(a) GDPR |
| Managing the contractual relationship, issuing quotes and tax documents | Performance of a contract — Art. 6(1)(b) GDPR |
| Meeting legal accounting, tax and administrative obligations | Legal obligation — Art. 6(1)(c) GDPR |
| Keeping the site secure, preventing abuse, retaining technical logs | Legitimate interest of the controller — Art. 6(1)(f) GDPR |
| Measuring use of the site through analytics cookies that are not exempt from consent | Consent — Art. 6(1)(a) GDPR |
| Sending you marketing messages and updates about NOVOCAL | Free, specific and revocable consent — Art. 6(1)(a) GDPR |
| Establishing, exercising or defending a legal claim | Legitimate interest of the controller — Art. 6(1)(f) GDPR |
4. Do you have to give us your data?
Providing your first name, last name and email address is necessary for us to reply: without them we cannot act on your enquiry. Providing your telephone number and address is optional and only helps us get in touch or handle deliveries and contractual matters.
Consent to marketing messages is entirely optional: you can contact us without giving it, and withdraw it at any time with no effect on any existing relationship.
5. Who we share the data with
The website and the email service are hosted on servers owned by the controller, administered directly by its own staff and housed at a data centre in Arezzo. The data you send us through the contact form, and the emails we exchange, therefore stay on COMMOEDIA Srl's infrastructure and are not entrusted to third-party platforms for those purposes.
Data is processed by authorised staff of the controller, specifically instructed and bound to confidentiality. It may also be disclosed, to the extent necessary, to parties acting as data processors under Article 28 GDPR:
- Aruba S.p.A., which provides housing and connectivity at its Arezzo data centre, where the servers are physically located;
- OpenAI Ireland Limited, for the speech recognition service that produces the transcript;
- Apple Distribution International Ltd. and Google Ireland Ltd., for app distribution, in-app purchases and the push notification delivery infrastructure. For purchases these companies act as independent controllers in their capacity as sellers, under their own privacy policies;
- Google Ireland Limited, for website analytics, if you have given consent;
- advisers, professionals and firms providing accounting, tax, legal and IT support.
Data may also be disclosed to public authorities where the law requires. Data is never disseminated nor sold to third parties for their own marketing.
6. Transfers outside the European Economic Area
The servers hosting the website and the email service are located in Italy: the data you send through the contact form and the emails you write to us do not leave the European Economic Area.
One exception is the audio of the messages you submit to the app: to be transcribed it is sent to OpenAI's API and processed on infrastructure in the United States, as described in section 2. The transfer is based on the Standard Contractual Clauses incorporated into the agreement with OpenAI Ireland Limited.
Some providers of the services you can enable with your consent may likewise process data outside the European Economic Area, in particular in the United States. Such transfers take place only where adequate safeguards under Articles 44 et seq. GDPR are in place, namely:
- the provider's participation in the EU-US Data Privacy Framework, where applicable;
- Standard Contractual Clauses approved by the European Commission, supplemented where necessary by additional technical and organisational measures.
You can request a copy of the safeguards in place by writing to mail@commoedia.net.
7. How long we keep it
| Category of data | Retention period |
|---|---|
| Audio content of messages submitted for transcription | Deleted from the controller's systems once transcription is complete; retained by OpenAI for a maximum of 30 days solely for abuse prevention |
| Push notification token | Until the permission is withdrawn or the app is uninstalled |
| Enquiries sent through the contact form | 24 months from the last meaningful contact, unless a contractual relationship arises |
| Contractual, accounting and tax data | 10 years, as required by law |
| Server technical logs | 12 months |
| Data processed for marketing purposes | Until consent is withdrawn, and in any case no longer than 24 months of inactivity |
| Cookies and identifiers | As set out in the Cookie Policy |
At the end of these periods the data is deleted or irreversibly anonymised, except where further retention is needed to establish or defend a legal claim.
8. How we protect it
Data is processed using IT and electronic tools and, where necessary, on paper, applying technical and organisational measures appropriate to ensure its security, integrity and confidentiality in accordance with Articles 25 and 32 GDPR: encrypted connections (HTTPS), access control, authentication, regular backups, system updates and written instructions to the persons authorised to process it.
Because the servers hosting the website and the email service are owned by the controller, their configuration, maintenance and protection are handled directly by COMMOEDIA Srl.
9. Your rights
At any time you may exercise the rights set out in Articles 15 to 22 GDPR:
- access: to know whether we process your data and obtain a copy of it;
- rectification: to correct inaccurate data or complete incomplete data;
- erasure: to have your data removed in the cases set out in Article 17;
- restriction: to ask that processing be suspended pending verification;
- portability: to receive your data in a structured, machine-readable format;
- objection: to object to processing based on legitimate interest, including direct marketing;
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise these rights, write to info@novocal.ai if your request concerns the app, to mail@commoedia.net for anything else, or to pec@commoedia-pec.it if you prefer a channel with legal standing. We will reply within one month of the request, extendable by two months in particularly complex cases.
If you believe the processing of your data breaches the law, you have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the country where you habitually reside.
10. Automated decision-making
Through this site the controller carries out no automated decision-making, nor any profiling producing legal effects concerning the data subject or similarly significantly affecting them.
11. Children
The site is not aimed at children under 14 and we do not knowingly collect their personal data. If you believe a child has provided us with data without the consent of whoever holds parental responsibility, write to us and we will delete it.
12. Changes to this notice
The controller may update this notice to reflect changes in the law or in how data is processed. The version in force is always the one published on this page, with the date it was last updated.