Privacy Policy

1. Data controller and contact

The data controller under Regulation (EU) 2016/679 (GDPR) is WIDE di D. Papa, a sole-trader enterprise registered in Naples, Italy. Privacy and data-protection enquiries: dpo [at] simwide.com. General enquiries: info [at] simwide.com.

2. Contact-form data

The B2B contact and project-enquiry form may collect:

• name and protected email address;
• project category, project type and dataset status;
• target model, requested timeline, message and selected language;
• the acknowledgement that this Privacy Policy was read;
• submission time, enquiry status and limited internal administrative notes;
• a pseudonymous, non-reversible token derived from the originating IP address for security and abuse prevention.

Form submissions are stored on infrastructure controlled by WIDE di D. Papa. They are used only to review, respond to and administer the enquiry and, if the client proceeds, to prepare the project scope and quote. They are not used for marketing, behavioural profiling or advertising and are not shared with external compute providers.

Legal basis: Article 6(1)(b) GDPR, because processing is necessary to take steps at the sender's request before entering into a contract. The security token and limited security logging are processed under Article 6(1)(f) GDPR, based on the legitimate interest in protecting the form, site and infrastructure from spam, fraud and abuse.

3. No project material through the public form

The public contact form is not an upload service. Do not include source datasets, confidential project files, special-category personal data or information relating to identifiable minors in the message field. Project material is requested separately only after scope, transfer method and handling requirements have been agreed.

4. Client project material

A project may involve images, video, text, JSONL, conversational material, structured knowledge, engineering data, technical specifications or other source material supplied or approved by the client. The client is responsible for the origin and selection of that material and for ensuring that it holds every right, permission, licence and legal basis necessary for the agreed processing.

SIMWIDE Lab processes client material only to prepare the agreed dataset, train or adapt the requested model or adapter, perform quality evaluation, conduct the private pre-delivery validation session, apply agreed corrections and deliver the contracted result. Client material is never used for unrelated training, internal research, benchmarking, marketing or work for another client.

Where WIDE di D. Papa processes personal data solely on the documented instructions of a business client, the applicable controller-processor terms are established in the project agreement or a separate data processing agreement where required.

5. Sensitive, biomedical and minors' data

The standard workflow does not accept directly identifiable personal data relating to minors or identifiable health, genetic or biometric data. Anonymised scientific or biomedical material may be considered where the client confirms in writing that effective anonymisation occurred before transfer, that re-identification is not reasonably possible using the material supplied to SIMWIDE Lab, and that the client holds the rights and approvals required for the intended research or technical purpose.

SIMWIDE Lab does not determine the scientific validity or legal basis of the client's research and may refuse or suspend material that appears inconsistent with the client's declarations or the agreed scope.

6. External compute and recipients

Projects are processed locally where practical. Where the agreed model, workload or delivery schedule requires additional CPU, GPU, storage or secure-transfer capacity, an occasional infrastructure provider located in the European Economic Area may be used. External compute is limited to the specific project requirement and is subject to appropriate confidentiality, security and data-protection terms.

Where project material contains personal data, the use of external processing is disclosed in the project agreement and handled in accordance with the applicable controller-processor arrangements. Contact-form submissions are not supplied to those providers. Data may also be disclosed where required by a binding order from a court or authority with lawful jurisdiction over the data.

7. Server logs, Webalizer and cookies

The web server produces standard Apache access and error logs containing technical information such as IP address, request time, requested resource, browser information, response status and security events. These logs are used only for operation, troubleshooting and security and are retained according to the server's controlled log-rotation schedule for no longer than necessary for those purposes.

Webalizer processes server logs to produce aggregate traffic statistics, such as daily visits, referring sources and general request volumes. SIMWIDE Lab does not use those reports to create deterministic visitor profiles or to track individuals across websites.

The public site and contact form do not set tracking cookies and do not use advertising networks, behavioural analytics, pixel trackers or browser fingerprinting. A strictly necessary session cookie may be used only if a separate authenticated service requires it and will be described when that service is provided.

8. Retention and deletion

• Enquiries that do not become projects: deleted 12 months after the last contact.
• Active projects: retained for the duration of the engagement.
• Project material: source material, working copies, prepared datasets, checkpoints, validation outputs and deliverables under SIMWIDE Lab's control are scheduled for automatic deletion 30 days after delivery.
• Extended retention: available only by separate written agreement and fee. Retained material is isolated from active workflows and is not used for training, evaluation, inference, research or other clients.
• Fiscal and contractual records: retained for the periods required by Italian and applicable EU law.
• Legal preservation: deletion may be suspended only where required by a binding order from a competent authority or where necessary for an existing legal claim.

9. Automated decisions and AI systems

Contact enquiries are not subject to solely automated decision-making or profiling producing legal or similarly significant effects. SIMWIDE Lab provides project-specific technical services and does not use contact-form data to train AI systems.

Regulatory responsibilities relating to a delivered model depend on its intended purpose, deployment context and the parties' actual roles. Those matters are addressed in the project scope and Terms of Service rather than being assigned through this Privacy Policy.

10. Your GDPR rights

Subject to the conditions provided by law, you may request:

• access to personal data held about you;
• rectification of inaccurate or incomplete data;
• erasure or restriction of processing;
• data portability where applicable;
• objection to processing based on legitimate interests.

You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or another competent supervisory authority. To exercise a right, contact dpo [at] simwide.com.

11. External links

This site links to external websites, including simwide.com, aeonianengineering.com and heat.simwide.com. Each external site operates under its own privacy information. WIDE di D. Papa is not responsible for the data practices of independent third-party websites.

12. Changes to this policy

This Policy may be updated when practices, services or applicable law change. The revision date above identifies the version in force. Material changes will be presented clearly on this page; the Privacy Policy is an information notice and does not require acceptance as a contract.

13. Contact

Privacy and data-protection enquiries: dpo [at] simwide.com
Data controller: WIDE di D. Papa · Naples, Campania, Italy