GDPR & data processing

Last updated: August 4, 2026

1. Regulatory references

The processing of personal data in CONFY3D complies with Regulation (EU) 2016/679 (GDPR), Italian Legislative Decree 196/2003 (Privacy Code) as amended by Legislative Decree 101/2018, and the guidelines of the Italian Data Protection Authority (Garante Privacy) where applicable.

2. Roles: controller, processor, sub-processor

3. Categories of data subjects and data

• Client employees / collaborators: users with Entra login.
• Share visitors: individuals who open public links (personal data limited to technical logs).
• IT contacts / tenant administrators: contacts for provisioning and security.

Data categories: identification, contact, usage, uploaded content, logs.

4. Processing activities and legal bases (detail)

4.1 Authentication and account management

Login via Microsoft Entra ID. We process Microsoft identifiers and the CONFY3D profile (name, email, company) to enable access and tenant isolation. Basis: GDPR art. 6.1.b (contract) and, where applicable, 6.1.f (service security).

4.2 3D assets, projects, and sharing

Files and metadata on Azure Blob Storage and Azure SQL database. Each record is associated with a company for segregation. Basis: 6.1.b for the client's users; the client determines the lawfulness of the uploaded content (e.g. product images, trademarks).

4.3 Share links (anonymous visitor)

Delivery of the 3D scene without an account. Server logs for availability and security. Basis: 6.1.f (legitimate interest in delivering and protecting the service). The controller client decides which product data is exposed in the link.

4.4 AI Assistant (configurator)

User messages and a snapshot of the project context (scene structure, asset names, rules) are sent to the OpenAI API (configurable model, e.g. GPT-4.1-mini) to generate responses and suggested actions. Basis: 6.1.b where it is a contractual feature; otherwise, the explicit consent of the client or the user, per tenant policy. A DPIA should be assessed if prompts may include unnecessary sensitive data.

AI Act transparency (art. 50), applicable from August 2, 2026: the interface clearly informs users that they are interacting with an AI system operated by CONFY3D and not with a natural person. Informed confirmation is required on first use; a permanent minimization notice remains in the chat (don't enter unnecessary personal data). 3D/binary files are not sent to the provider: only text and technical metadata.

• Chat is not persisted in the application database (only browser memory for the current session).
• History sent to the provider is limited (last messages / maximum length).
• Server logs: errors without prompt content (minimization).
• Sub-processor: OpenAI — DPA / SCC and no-training option per the client's API contract.

4.5 Security and compliance

Access monitoring, backups, incident response. Basis: 6.1.f and 6.1.c (legal obligations).

5. Main sub-processors

The list may be extended (CDN, transactional email, monitoring). Updates are communicated to contractual administrators.

6. Transfers outside the EU

When a sub-processor processes data outside the EEA, we adopt EU Standard Contractual Clauses (SCCs) or another instrument under GDPR art. 46, plus supplementary measures where required (encryption, minimization).

7. Retention periods

• Account data: contract lifetime + any grace period for export (typically 30 days), unless tax obligations apply.
• Client content: until deleted by an admin or end of contract; soft-delete and backups per Azure policy.
• Application logs: 30–90 days, extendable for security investigations.
• AI chat: not retained beyond what is necessary to process the request, unless an audit is agreed; verify OpenAI-side retention.

8. Security measures (GDPR art. 32)

• Encrypted transport (TLS); Bearer authentication on protected APIs.
• Logical segregation per company; uploads only by authenticated users.
• Entra tokens kept only in httpOnly cookies.
• Backups and redundancy on managed Azure services.
• Minimization principle applied to the context sent to the AI.

9. Data subject rights

Under GDPR arts. 15–22 you may request:

• Access to and a copy of your data;
• Rectification of inaccurate data (also via the Entra profile / tenant admin);
• Erasure ("right to be forgotten") in the cases provided by law;
• Restriction of processing;
• Portability (structured format, where applicable);
• Objection to processing based on legitimate interest;
• Withdrawal of consent where processing is based on consent, without affecting the lawfulness of prior processing.

For users employed by a client, many requests should also be forwarded to their employer's privacy contact (the content controller). The Provider cooperates with the controller within the terms of the law and the contract.

Send requests to: privacy@oobexr.com. We respond within one month (extendable by two months in complex cases, with a reasoned notice).

10. Data breach (GDPR art. 33–34)

In the event of a personal data breach that poses a risk to individuals' rights, we notify the supervisory authority within 72 hours where required and inform the controller client without undue delay, to allow any necessary communication to data subjects.

11. Impact assessment (DPIA) and AI inventory

For high-risk processing (e.g. large-scale AI with non-anonymized data, systematic profiling) the client and the Provider assess the need for a DPIA under GDPR art. 35 before go-live.

AI system inventory (accountability / AI Act):

• Name: CONFY3D Configuration Assistant (beta).
• CONFY3D's role: deployer of an AI system with direct interaction with individuals (AI Act art. 50); OpenAI as the provider of the underlying GPAI model.
• Purpose: assisting authenticated users in creating rules, materials, UI, and 3D scene settings.
• Data processed: chat text + technical project snapshot (no 3D binary files).
• Measures: mandatory authentication; UI disclosure; first-use confirmation; minimization notice; message/history limits; no chat persistence in the application database.
• Out of scope for art. 50 biometrics/emotion: the system does not perform emotion recognition or biometric categorization.

12. Complaint to a supervisory authority

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): www.garanteprivacy.it. You may also lodge a complaint with the authority of the EU member state where you reside or habitually work.

13. Data Protection Officer (DPO)

If appointed for CONFY3D processing, reachable at: dpo@oobexr.com.

14. Related documents

• Privacy Policy — concise version for end users