Privacy Notice

This notice describes how File system processes the personal data of users when they visit this marketing website or use the Rivadesk service, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 («GDPR»), the ePrivacy Directive 2002/58/EC and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. Data controller and contacts

The data controller is File system, with registered office at Via Cavour, 66 - 81030 Orta di Atella (CE). For any request relating to the processing of personal data, you may write to info@rivadesk.com.

2. Data Protection Officer (DPO)

Where appointed, the Data Protection Officer is Massimo Ferrara, reachable at allbrand.italia@gmail.com. If no DPO has been formally designated, requests may be sent to the controller contacts listed in section 1.

3. Categories of data processed

Depending on your interaction with our services, we may process the following categories of data:

• marketing website browsing data (e.g. IP address, device and browser identifiers, pages visited, technical log data), processed for security and correct operation of the site;

• data voluntarily provided via contact or registration forms (e.g. name, email address, organisation details);

• Rivadesk service usage data for registered users (e.g. account data, content and activity necessary to provide the service);

• statistical and aggregated data collected, with consent, through analytics tools (see sections 5 and 6).

4. Purposes of processing and legal bases

We process personal data for the following purposes, each based on a specific legal basis under Art. 6 GDPR:

• providing and managing the Rivadesk service and responding to user requests: performance of a contract or pre-contractual measures (Art. 6(1)(b));

• ensuring security, abuse prevention and correct technical operation of the site: legitimate interest of the controller (Art. 6(1)(f));

• use of non-essential analytics and marketing cookies and tools: data subject consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive);

• compliance with legal, accounting and tax obligations: legal obligation (Art. 6(1)(c)).

5. Cookies and tracking technologies

The site uses cookies and similar technologies. Essential cookies are necessary for the site to function and do not require consent; non-essential analytics and marketing cookies are activated only with prior consent. Categories are aligned with the native Rivadesk consent banner: Essential, Analytics and Marketing.

You may give, change or withdraw consent at any time via the consent banner or the «Manage cookies» link in the site footer; withdrawal is as easy as giving consent and does not affect the lawfulness of processing based on consent given before withdrawal. For the full list of cookie names, purposes and durations, see the Cookie Policy.

6. Google Analytics 4 and Consent Mode v2

Where enabled, we use Google Analytics 4 for aggregated statistics on site usage. Analytics tags are subject to Google Consent Mode v2: without consent to the «Analytics» category they operate in default-deny mode (no analytics cookie is set) and become fully active only after consent, consistently with what is stated in the Cookie Policy.

7. Recipients, sub-processors and transfers outside the EU/EEA

Data may be processed by suppliers acting as processors or sub-processors on behalf of the controller (e.g. hosting, infrastructure, analytics tools), to the extent necessary for the purposes described. The list of sub-processors is available, where published, at https://rivadesk.com/en/sub-processors; the hosting and data storage area is indicated in Unione Europea (SEE). Where data are transferred to countries outside the EU/EEA, the transfer takes place on the basis of appropriate safeguards, in particular the Standard Contractual Clauses (SCCs) approved by the European Commission.

8. Retention periods

Personal data are retained for no longer than strictly necessary for the purposes for which they are collected, in accordance with the data minimisation principle (Art. 5 GDPR), and are subsequently deleted or anonymised, unless legal obligations require longer retention (e.g. accounting and tax obligations). Data collected through analytics tools are retained according to the retention periods configured in the tool.

9. Data subject rights

As a data subject, you may exercise, where applicable under the GDPR, the rights of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest and withdrawal of consent at any time (without prejudice to the lawfulness of processing based on consent given before withdrawal). To exercise your rights, write to info@rivadesk.com.

10. Complaint to the supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent supervisory authority. In Italy the supervisory authority is Garante per la protezione dei dati personali (www.garanteprivacy.it). If you reside in another EU/EEA Member State, you may contact your local supervisory authority.

11. Rivadesk for Shopify

When you install the Rivadesk app from the Shopify App Store, we process data from your Shopify store solely to provide the customer support and AI chat service within the store. Through the Shopify APIs we may access:

• store data (name, domain, store account email) to configure the account and the widget;

• product catalog, store pages and store policies (privacy, returns, terms, shipping) to populate the knowledge base that powers chat replies;

• order status, to provide information to the customer during the conversation;

• the logged-in customer's profile data (e.g. name and email), limited to the context of the ongoing conversation.

Purpose and use limitation. Data from Shopify is processed solely to provide and improve customer support for the store that installed the app; it is not used for any other purpose.

No sale and no training of general AI models. We do not sell or share store customers' data with third parties, and we do not use protected customer personal data to train general or third-party artificial intelligence models; such data is used only to generate replies within the context of the store concerned.

Retention. The store's API access token is stored in encrypted form and is deleted upon app uninstallation; we do not store store customers' personal data locally, reading it in real time when needed. On app uninstallation (app/uninstalled webhook) and upon a store deletion request (shop/redact), residual data associated with the store is deleted, normally within 48 hours.

Sub-processors and artificial intelligence. To generate chat replies, conversation content may be processed by AI model providers acting as sub-processors, within the limits described on the sub-processors page (https://rivadesk.com/en/sub-processors) and with appropriate safeguards for any transfers outside the EU/EEA.

Store customers' requests. Requests to access or delete data from store customers can also be handled through Shopify's compliance webhooks (customers/data_request, customers/redact, shop/redact). For any request regarding data processed through the app, you may write to info@rivadesk.com.

12. Changes to this notice and version

We may update this notice to reflect regulatory, technical or organisational changes. The version in force is always the one published on this page. Last updated: 30 giugno 2026. In case of material changes, we will provide appropriate notice.