Data processing summary

Supplier (processor)

4townlab S.r.l. Corso Vittorio Emanuele II, 9 31015 Conegliano (TV) VAT and tax code: 05603680264 Email info@4townlab.it

Data protection contact

DPO – dpo@4townlab.it

1. Roles in the processing

• Controller: the client municipality
• Processor: 4townlab S.r.l.
• Sub-processors: cloud providers and technical services

The processing of personal data is governed by a Data Processing Agreement (DPA) under Article 28 GDPR.

2. Purposes of processing

The service lets public bodies:

• handle requests from citizens;
• provide information on municipal services;
• route requests to the competent offices;
• analyse the requests received, for statistics.

3. Categories of data processed

The service may process:

• identification data (the name provided by the user);
• contact data (phone, email);
• the content of requests;
• technical access data and system logs.

The system is not designed for the systematic processing of special categories of personal data.

4. Categories of data subjects

• citizens
• users of municipal services
• employees of the organisation
• other people who interact with the service.

5. How data is collected

Data may be collected through:

• telephone calls
• digital messaging
• any web interfaces of the service.

6. Where the data is located

Personal data is stored on cloud infrastructure located within the European Economic Area (EEA). Any transfers to third countries take place in accordance with Articles 44 to 49 GDPR.

7. Main security measures

The service applies technical and organisational measures, including:

• encryption of communications (TLS);
• role-based access control;
• multi-factor authentication for administrative access;
• monitoring and logging of access;
• periodic backups;
• vulnerability management;
• incident management procedures.

8. Use of artificial intelligence

The service may use artificial intelligence and natural language processing (NLP) technologies to:

• analyse users' requests;
• generate informative replies;
• classify requests;
• produce aggregated statistics.

The AI systems operate as a support tool and do not make automated decisions with legal effects under Article 22 GDPR. Personal data is not used to train general-purpose artificial intelligence models.

9. Retention

Personal data is kept for as long as needed to handle requests and provide the service. When the contract ends, the data is returned or deleted, and the client can ask for it to be exported.

10. Rights of data subjects

The controller (the municipality) is responsible for handling requests from data subjects under Articles 15 to 22 GDPR. The supplier provides the controller with technical assistance in meeting those obligations.

11. Reference documentation

The processing of personal data is governed by the following documentation:

• Data Processing Agreement (DPA);
• Annex on technical and organisational measures;
• Trust & Security Overview;
• List of sub-processors (to be requested specifically, and provided only during an advanced stage of negotiation).