Privacy notice

Privacy Notice pursuant to Art. 13 GDPR – Marketing Activities

Introductory Note: some information regarding cookies and tracking technologies is already described in our Cookie Policy. Here it is repeated solely in relation to marketing activities and the processing of data collected for newsletters, profiling, and promotional communications.

‍

1. Data Controller

The Data Controller is INDIGO AI S.r.l., with registered office at Piazza Gae Aulenti 1 – Torre B, 20154 Milan (MI), Italy.
Email: compliance@ndg.ai

‍

2. Categories of Personal Data Collected

On our website, we collect the following categories of personal data:

Cookies and Tracking Technologies

• Technical cookies: necessary for the navigation and proper functioning of the website.
• Analytical and profiling cookies: upon user consent, for statistical or marketing purposes.

Data voluntarily provided by users

• Email and other information through:
  
  • newsletter subscription;
  • contact forms;
  • requests for information or demos.

Data related to platform usage (workspace, chatbot, voicebot)

• Processed separately pursuant to contractual agreements and dedicated Data Processing Agreements (DPA).

‍

3. Purposes of Processing

The personal data collected are used to:

• Enable navigation and proper functioning of the website;
• Manage newsletter subscriptions and marketing communications;
• Respond to contact or information requests regarding services;
• Analyze and improve browsing experience and marketing content (aggregated and anonymized data);
• Personalize content and offers based on users’ preferences (only upon consent).

‍

4. Legal Basis for Processing

• Technical cookies: required by law / website functionality;
• Analytical/profiling cookies: user consent;
• Newsletter, contacts, and information requests: explicit consent or performance of a pre-contractual/contractual obligation;
• Automated profiling for marketing purposes: user consent.

‍

5. Recipients of Personal Data

Personal data may be disclosed to:

• Authorized personnel within the Company;
• External service providers responsible for processing (hosting, newsletters, analytics, and marketing services);
• Public authorities, only if required by law.

‍

6. Transfers outside the EU/EEA

Personal data are not transferred outside the European Economic Area, except in strictly necessary cases subject to adequate safeguards, such as standard contractual clauses.

‍

7. Retention Period

• Technical cookies: session duration;
• Analytical/profiling cookies: as indicated by the provider;
• Newsletter and marketing contacts: until consent is revoked or 5 years for legal compliance obligations.

‍

8. Data Subject Rights

Users may exercise the rights provided under Articles 12-22 GDPR, including access, rectification, erasure, restriction, objection, and data portability.
Requests should be sent to compliance@ndg.ai.

‍

9. Withdrawal of Consent

Consent to the use of cookies, newsletters, or profiling may be withdrawn at any time, without affecting the lawfulness of processing based on prior consent.

‍

10. Security Measures

Collected data are protected by appropriate technical and organizational measures to prevent unauthorized access, loss, or alteration.

‍

11. Minors

The website is not intended for users under 16 years of age. We do not knowingly collect data from minors.

‍

12. Updates to the Privacy Policy

This privacy policy may be updated. Any changes will be published on the website with the date of last revision.

‍

13. Additional Notes

Data relating to the use of workspace, chatbot, and voicebot are processed separately pursuant to contractual agreements and the respective DPAs.
This privacy notice relates exclusively to marketing activities.

‍

Last update: April 1, 2026