Privacy notice

1. Controller and contact

EMT Aerospace Technologies S.r.l. is controller for accounts, commercial relationships, support and service security. Contact info@emtaerospacetechnologies.com with the subject “Privacy EMT Compute”. Your customer code helps identify the account; do not send credentials or unsolicited identity documents.

2. Data and sources

We process information you provide, including name, email, billing details, preferences and support requests; customer and workspace identifiers; resources, usage, transactions and security records. Passwords and recovery codes are stored as cryptographic derivatives; TOTP secrets are encrypted.

When activated, Google or Apple provide the identifiers and information authorized during sign-in. The payment processor handles card details; EMT uses transaction references and status. Hosting and security systems may process IP addresses, timestamps, device and technical request information.

3. Purposes and legal bases

Accounts, provisioning, storage, metering, payments and operational communications support a contract or requested pre-contractual steps (GDPR Article 6(1)(b)). Fiscal obligations and binding legal requests rely on legal obligations (Article 6(1)(c)). Abuse prevention, access controls and protecting rights rely on legitimate interests, subject to necessity and proportionality (Article 6(1)(f)).

Optional catalog analytics and campaign attribution require consent (Article 6(1)(a)). Cookie marketing choices do not enable promotional email. Verification, security, balance and transaction emails are service communications. Refusing optional cookies does not prevent catalog browsing or service use.

4. Workload data

Customers determine the purposes and content of their workloads. Processing personal data on a customer’s instructions requires an Article 28 agreement and the relevant infrastructure inventory. That agreement is separate from this controller notice.

Special-category data, criminal-offence data, children’s data or location-restricted information require specific assessment and applicable safeguards. GPU availability alone does not demonstrate qualification for regulated processing.

5. Recipients and transfers

Data is accessed by authorised EMT personnel, for their duties, and by providers acting as processors: Cloudflare (hosting, database and storage, with customer data in EU-jurisdiction resources), Proton AG, Switzerland (service emails) and the Lium compute marketplace with the data-centre operators hosting the chosen instance (resource provisioning: they receive the order configuration, the public SSH key and the content the Customer uploads to the instance). Stripe Payments Europe Ltd (Ireland) processes payment data as an independent controller, including for fraud prevention and legal obligations; Google processes sign-in data as an independent controller when you choose Google sign-in.

Transfers outside the European Economic Area rely on adequacy decisions (such as the one for Switzerland or the EU-US Data Privacy Framework for certified providers) or standard contractual clauses. Workload content is processed at the location of the node chosen by the Customer, shown in the catalogue, which may be outside the EEA: to process personal data the Customer chooses EEA nodes or assesses the transfer as controller.

6. Retention

Cookie choices last 180 days; campaign cookies last up to 30 days. Consent receipts expire after 210 days and are deleted on the next cleanup pass; deduplication keys expire after 24 hours. Aggregate visit counts are retained up to 400 days.

Account data is kept for the duration of the relationship and, after closure, as long as needed to handle disputes and requests. Accounting records and tax documents are kept for 10 years (art. 2220 Italian Civil Code). Security and audit logs are kept as long as needed for service security and the defence of rights, normally no longer than 24 months. Workload content stays on the instance until it terminates and on persistent volumes until the Customer deletes them.

Children

EMT Compute is not intended for people under 18 and does not knowingly collect children’s data.

7. Rights and complaints

Where applicable, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Withdraw consent in cookie settings without affecting earlier lawful processing. You may complain to the Italian Garante or the competent supervisory authority.

EMT may request proportionate identity verification before releasing data or changing an account. Responses follow GDPR deadlines and permitted extensions. We do not perform commercial profiling decisions with legal effects; technical security and budget restrictions can be raised with support.

8. Changes

Material changes will have a new version. New advertising tools or purposes require updated information and, where necessary, a new choice before activation.