Privacy notice

(pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 – GDPR)

Data controller

The controller of personal data is Bright Band Srl (the "Controller" or the "Company"), with registered office at Via Imbriani 20, 20158 Milano (MI), ITALY, VAT no. IT05184690963.

For any information about the processing of personal data or to exercise the rights granted by the GDPR:

• Certified email (PEC): info@pec.brightband.it
• Data Protection Officer (DPO): dpo@brightband.it

Scope of this notice

This notice covers the personal data processed through:

1. the website of Carmilla and its contact form (Part A);
2. the application services of Carmilla: the web console for meter reading (app.), the administration area (admin.) and the developer portal (developer.), the support portal (support.), the built-in assistant and data access through external applications (Part B).

When the application services are provided to a customer (an energy, water, gas or heat retailer or distributor, an ESCo, a plant manager) that uses the platform for its own meters and end users, the customer is the controller of its end users' data and Bright Band Srl processes them as a processor under Article 28 GDPR, on the basis of the contract. In that case, for end-user data, data subjects should contact the customer; this notice nonetheless describes how the platform processes the data.

Part A — Website and contact form

Categories of data

Through the website contact form the Controller may collect:

• identification data (first and last name);
• contact data (email, phone number);
• address data;
• contact preferences (email or phone) and preferred time slot;
• the content of the messages sent by the user;
• technical browsing data: IP address, system logs, browser data, outcome of anti-abuse checks.

Purposes and legal bases

• Handling contact and information requests — Article 6(1)(b) GDPR (pre-contractual steps at the data subject's request) and Article 6(1)(f) (legitimate interest in handling unsolicited requests).
• Organisational and administrative management of communications — Article 6(1)(f).
• Website security and abuse prevention — Article 6(1)(f).
• Compliance with legal obligations — Article 6(1)(c).

Retention

Data collected through the contact form are kept for as long as needed to handle the request and in any case up to 24 months after it is closed, unless needed for legal protection or required by law.

Provision of data

Providing data is optional; without the data marked as mandatory the request cannot be handled.

Part B — Console and application services

Categories of data

Account data. First and last name, email address, user identifier, roles and permissions, operating unit, interface language and preferences, consents given. Authentication is handled by the identity provider Auth0 (Okta): credentials are not stored by the platform.

Access and security data. Date and time of access, IP address, browser and device type, technical device identifier, request logs and an audit trail of operations with the identifier of the user who performed them.

Device and reading data. Meter and plant records (POD/PDR code, serial number, supply address, supply holder, notes), energy, water, gas or heat measurements with their timestamps, device events and alarms, communication status. These data are personal data when the supply is registered to a natural person.

Support requests. Content of the reports, attachments, contact data, and what the platform already knows about the requesting user (role, operating unit); the messages of the support-portal chat, delivered to the operators through Microsoft Teams.

Messages to the built-in assistant (only if enabled, see the dedicated section): the text of the questions typed by the user and the aggregated data needed to answer.

Purposes and legal bases

• Provision of the service: account creation and management, viewing and analysing readings, exports, reports, alerts, support — Article 6(1)(b) GDPR (contract) for contracting parties; for users acting on behalf of a customer, Article 6(1)(f) (legitimate interest of the Controller and of the customer in performing the contract).
• Security, abuse prevention and traceability of operations — Article 6(1)(f).
• Compliance with legal obligations (tax, accounting, metrology, requests from authorities) — Article 6(1)(c).
• Built-in artificial-intelligence assistant — Article 6(1)(a) GDPR: explicit consent, optional and revocable at any time (see the dedicated section).
• Data access through external artificial-intelligence applications — Article 6(1)(a): consent, optional and revocable (see the dedicated section).

Built-in artificial-intelligence assistant

The console offers an assistant ("Ask…") that answers questions about the data visible to the user in natural language. The assistant is an artificial-intelligence system, not a human operator: answers are generated by a language model and may contain errors; they do not replace the console data nor technical, tax or legal advice.

What is processed. For each question the following are sent to the model: the text typed by the user in the conversation (up to 40 messages of up to 8,000 characters each); the results of the tools the assistant uses to answer, namely the list of plants and meters visible to the user (technical identifier, label, operating-unit code, state of the last reading) and aggregated consumption series per period (kWh per day, week or month); the platform name, the user's role, the interface language and the date. The user's name, email or identifier are not sent, nor are the meters' registry fields (supply holder, supply address, POD/PDR code). A plant label, however, is free text set by the operator: if it contains personal data, that data reaches the model. The Controller does not put personal data in labels and users are asked not to type them into messages.

Who processes the data and where. The model is provided by Anthropic PBC, San Francisco, United States of America, acting as a sub-processor under a data processing agreement. Messages are processed on servers in the United States, outside the European Union and the European Economic Area. The transfer complies with Chapter V of the GDPR on the basis of the standard contractual clauses adopted by the European Commission (Article 46(2)(c)), included in the provider's data processing agreement, with a transfer impact assessment and supplementary measures where needed; as of this version the provider is not certified under the EU-US Data Privacy Framework. For API use the provider does not use the data to train its models and keeps them only for the technical time needed, in any case no longer than 30 days, unless a zero-data-retention agreement applies.

What the platform keeps. The conversation stays in the browser memory for the duration of the session and is not saved; the platform logs keep, for each answer, technical data only (date and time, number of messages and tools used, tokens consumed, duration) with a pseudonym of the user, never the text. The platform also records that consent was given or withdrawn, with date, time and version of the text.

Consent and withdrawal. The assistant is enabled only after the user has read this information and given explicit consent in the dedicated window. Consent can be withdrawn at any time from the assistant panel ("Disable the assistant"): withdrawal takes effect immediately and does not affect the lawfulness of previous processing. Without consent the console works in full.

Data access through external artificial-intelligence applications

When the feature is enabled for the user's organisation, the platform exposes a standard interface (Model Context Protocol) that lets the user connect an artificial-intelligence application of their choice (for example Claude, ChatGPT, Copilot, Cursor) to the data within their scope, authorising it with their own credentials. The application only has read-only tools: the list of plants and meters visible to the user (technical identifier, label, operating unit, state of the last reading) and aggregated consumption series per period. As of this version the feature is not live yet.

In that case the application provider is chosen by the user: the data the application reads are processed by that provider, in the country and under the terms of its service, as an independent controller. Bright Band Srl has no control over, and no responsibility for, such processing. The user can revoke the authorisation at any time from the list of authorised applications of their account; the customer can disable the feature for its organisation.

Recipients of personal data

Data may be processed by authorised internal staff and by the following parties, acting as processors under Article 28 GDPR unless stated as independent controllers:

When the platform is operated on behalf of a customer acting as controller, the parties listed are sub-processors authorised by the customer under Article 28(2) GDPR; changes to the list are notified in advance.

Transfers of data outside the EU

Data are normally processed within the European Economic Area. Transfers to the United States concern exclusively:

• the identity provider (Okta, Inc.), limited to the account data needed for authentication;
• the built-in assistant (Anthropic PBC), only for users who enabled it with their consent, for the data described in the dedicated section.

Such transfers rely on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR), with a transfer impact assessment: as of this version neither Anthropic PBC nor Okta, Inc.'s Auth0 service is covered by the EU-US Data Privacy Framework adequacy decision (Okta, Inc.'s certification does not extend to Auth0). Should a provider become certified, the transfer relies on the adequacy decision (Article 45 GDPR). A copy of the safeguards can be requested from the Controller.

Retention period

Provision of data

Account data are required to use the services. Enabling the built-in assistant and connecting external applications are optional: refusing them does not limit any other function.

Processing methods

Processing is carried out with electronic and IT tools, in compliance with the principles of lawfulness, fairness, transparency, data minimisation and confidentiality. The Controller adopts technical and organisational measures appropriate to the risk: encryption in transit, strong authentication, separation of data per customer and per operating unit, audit trail, access control, backups.

Rights of the data subject

Data subjects may at any time exercise the rights under Articles 15–22 GDPR: access, rectification, erasure, restriction, objection, portability, withdrawal of consents given (for the built-in assistant directly from the assistant panel; for external applications from the list of authorised applications). Requests are sent to the contacts above; where processing is carried out on behalf of a customer acting as controller, the request is forwarded to the customer.

Right to lodge a complaint

Data subjects may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) under Article 77 GDPR, or bring an action before the competent courts.

Updates to this notice

This notice may change over time, including for regulatory or organisational reasons. Material changes are communicated to console users at their next login, with a request to acknowledge them.

Version: October 2026