Information on the Processing of Personal Data (Art. 13 GDPR)

The company Saber S.r.l., as Data Controller, attaches great importance to the protection of your personal data. This information describes how we collect, use and protect your data in accordance with EU Regulation 2016/679 (GDPR).

1. Data Controller

The Data Controller is Saber S.r.l., VAT / Tax Code: 00289400202, Companies Register MN no. 00289400202, REA MN-127583, Share Capital € 30,000.00 fully paid-up, with registered and operational office in Via Caduti sul Lavoro, 4 - 46019 Viadana (MN) Italy.
Contacts: Tel: +39 0375 782083 | Email: info@sabercolor.com | PEC: bernini@pec.sabercolor.com.
Data Protection Officer (DPO): A dedicated DPO has not been appointed as the company does not process data on a large scale nor perform systematic monitoring. For privacy matters, contact the Controller.

2. Type of Data Processed

• Data provided voluntarily: Name, surname, email, phone number and other data entered in the contact form.
• Browsing data: IP addresses, system logs, parameters relating to the operating system and the user's computer environment (processed in aggregate or anonymous form for technical purposes).
• Cookies: For details on the use of cookies, please consult the site's specific Cookie Policy.

3. Purposes and Legal Bases of Processing

Your data will be processed for the following purposes:

4. Obligatory nature of data provision

The provision of data for the "Response to requests" purpose is necessary: otherwise, we will not be able to send you the requested information. Provision for "Marketing" purposes is instead entirely optional and does not affect the processing of your requests.

5. Processing Methods and Security

The processing is carried out using computer, electronic and manual tools, with logic strictly related to the purposes themselves and, in any case, in such a way as to guarantee the security and confidentiality of the data, preventing unauthorized access or loss of data.

6. Recipients of the Data

Your data may be communicated to:

• Internal personnel authorized and instructed by the Controller.
• IT service providers, hosting providers and external consultants, appointed where necessary as Data Processors pursuant to art. 28 GDPR.
• Public subjects or supervisory authorities in force of legal obligations.

7. Extra-EU data transfer

The Controller transfers data to Google LLC (USA) infrastructure exclusively to deliver the Artificial Intelligence features available on the website (Saber Bot virtual assistant and Sabercolor Lab colour simulator). Such transfer is governed by the Standard Contractual Clauses (SCC) approved by the European Commission and the EU-USA Data Privacy Framework mechanisms. For all other processing activities, data remains within the European Economic Area (EEA).

8. Retention Period

• Contact requests: Data will be kept for the time necessary to process the request (maximum 12 months in the absence of a contractual follow-up).
• Marketing: Until consent is revoked or an unsubscription request (opt-out), and in any case no later than 24 months from the last active contact.
• Legal obligations: For the times established by civil and fiscal regulations (e.g. 10 years for accounting data).

9. Your Rights

In accordance with arts. 15-22 of the GDPR, you can exercise the following rights at any time:

• Access: Receive confirmation if processing is underway and obtain a copy of the data.
• Rectification: Update or correct inaccurate data.
• Deletion (Erasure): Request the removal of data if no longer necessary or in the absence of a legal basis.
• Limitation and Opposition: Object to marketing or limit processing in specific cases.
• Portability: Receive data in a structured format to transfer it to another controller.
• Withdrawal of Consent: Without prejudice to the lawfulness of the processing based on the consent given before the withdrawal.

To exercise these rights, you can write to: info@sabercolor.com.

You also have the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).

10. Use of Artificial Intelligence Systems (AI Act & L. 132/2025)

• Nature of the Service: Saber S.r.l. uses Artificial Intelligence (Google Gemini) for two specific website features: virtual assistance via chatbot (Saber Bot) and chromatic simulation (Sabercolor Lab). Both features can be classified as limited-risk AI systems under EU Regulation 2024/1689 (AI Act).
• Transparency and Labelling (Art. 50 AI Act): Images produced by Sabercolor Lab are generated through algorithmic manipulation of real photographs. Google applies digital watermarking technologies (SynthID) to generative outputs, ensuring their detectability as synthetic content. Such metadata is not removed by the system.
• Data Processing and Minimisation: Images uploaded by the user are processed in real time via the Google Gemini API and are not stored on Saber S.r.l. servers. Users are expressly advised not to upload photos containing people, faces, number plates, or any other identifying elements of natural persons.
• Human Autonomy Principle (L. 132/2025): AI performs a purely instrumental and decision-support function. Any choice made on the basis of generated outputs — including colour decisions — remains the exclusive responsibility of the human user. The system does not produce binding legal effects nor does it replace professional advice.
• Extra-EU Transfer and Safeguards: The use of Google Gemini APIs involves the transfer of data to Google LLC (USA) infrastructure. Such transfer is governed by the Standard Contractual Clauses (SCC) approved by the European Commission and the EU-USA Data Privacy Framework mechanisms, which ensure an adequate level of protection pursuant to Art. 46 GDPR.