Information on the Processing of Personal Data (Art. 13 GDPR)

The company Saber S.r.l., as Data Controller, attaches great importance to the protection of your personal data. This information describes how we collect, use and protect your data in accordance with EU Regulation 2016/679 (GDPR).

1. Data Controller

The Data Controller is Saber S.r.l., VAT / Tax Code: 00289400202, Companies Register MN no. 00289400202, REA MN-127583, Share Capital € 30,000.00 fully paid-up, with registered and operational office in Via Caduti sul Lavoro, 4 - 46019 Viadana (MN) Italy.
Contacts: Tel: +39 0375 782083 | Email: info@sabercolor.com | PEC: bernini@pec.sabercolor.com.
Data Protection Officer (DPO): A dedicated DPO has not been appointed as the company does not process data on a large scale nor perform systematic monitoring. For privacy matters, contact the Controller.

2. Type of Data Processed

• Data provided voluntarily: Name, surname, email, phone number and other data entered in the contact form.
• Browsing data: IP addresses, system logs, parameters relating to the operating system and the user's computer environment (processed in aggregate or anonymous form for technical purposes).
• Cookies: For details on the use of cookies, please consult the site's specific Cookie Policy.

3. Purposes and Legal Bases of Processing

Your data will be processed for the following purposes:

4. Obligatory nature of data provision

The provision of data for the "Response to requests" purpose is necessary: otherwise, we will not be able to send you the requested information. Provision for "Marketing" purposes is instead entirely optional and does not affect the processing of your requests.

5. Processing Methods and Security

The processing is carried out using computer, electronic and manual tools, with logic strictly related to the purposes themselves and, in any case, in such a way as to guarantee the security and confidentiality of the data, preventing unauthorized access or loss of data.

6. Recipients of the Data

Your data may be communicated to:

• Internal personnel authorized and instructed by the Controller.
• IT service providers, hosting providers and external consultants, appointed where necessary as Data Processors pursuant to art. 28 GDPR.
• Public subjects or supervisory authorities in force of legal obligations.

7. Extra-EU data transfer

The Controller transfers data to Google LLC (USA) infrastructure exclusively to deliver the Artificial Intelligence features available on the website (Saber Bot virtual assistant and Sabercolor Lab colour simulator). Such transfer is governed by the Standard Contractual Clauses (SCC) approved by the European Commission and the EU-USA Data Privacy Framework mechanisms. For all other processing activities, data remains within the European Economic Area (EEA).

8. Retention Period

• Contact requests: Data will be kept for the time necessary to process the request (maximum 12 months in the absence of a contractual follow-up).
• Marketing: Until consent is revoked or an unsubscription request (opt-out), and in any case no later than 24 months from the last active contact.
• Legal obligations: For the times established by civil and fiscal regulations (e.g. 10 years for accounting data).

9. Your Rights

In accordance with arts. 15-22 of the GDPR, you can exercise the following rights at any time:

• Access: Receive confirmation if processing is underway and obtain a copy of the data.
• Rectification: Update or correct inaccurate data.
• Deletion (Erasure): Request the removal of data if no longer necessary or in the absence of a legal basis.
• Limitation and Opposition: Object to marketing or limit processing in specific cases.
• Portability: Receive data in a structured format to transfer it to another controller.
• Withdrawal of Consent: Without prejudice to the lawfulness of the processing based on the consent given before the withdrawal.

To exercise these rights, you can write to: info@sabercolor.com.

You also have the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).

10. Use of Artificial Intelligence Systems (AI Act & L. 132/2025)

• Nature of the Service: Saber S.r.l. uses Artificial Intelligence (Google Gemini) for virtual assistance via chatbot (Saber Bot), chromatic simulation (Sabercolor Lab) and the production of some product and setting images published on this website. These features can be classified as limited-risk AI systems under EU Regulation 2024/1689 (AI Act).
• Interaction with an AI system (Art. 50(1) AI Act): SaberBot is an automated assistant, not a natural person. The artificial nature of the counterpart is stated in the opening message of the conversation, is marked by an "AI" indicator visible throughout the chat, and is confirmed by the assistant whenever the user asks about its nature.
• Labelling of generated content (Art. 50(4) AI Act): images generated or modified using AI carry a visible label declaring their artificial origin. For Sabercolor Lab simulations the label is applied onto the image itself, so that it remains readable if the image is downloaded or shared; for product images the label is shown next to the image in the catalogue and on the product page.
• Digital watermarking (Art. 50(2) AI Act): Google applies digital watermarking technologies (SynthID) to generative outputs, ensuring their detectability as synthetic content. Such metadata is not removed by the system.
• Texts and human review: product descriptions and their translations may be drafted with the assistance of AI systems. Every text is reviewed by Saber S.r.l. technical staff, who hold editorial responsibility for it, before publication.
• Data Processing and Minimisation: Images uploaded by the user are processed in real time via the Google Gemini API and are not stored on Saber S.r.l. servers. Users are expressly advised not to upload photos containing people, faces, number plates, or any other identifying elements of natural persons.
• Human Autonomy Principle (L. 132/2025): AI performs a purely instrumental and decision-support function. Any choice made on the basis of generated outputs — including colour decisions — remains the exclusive responsibility of the human user. The system does not produce binding legal effects nor does it replace professional advice.
• Extra-EU Transfer and Safeguards: The use of Google Gemini APIs involves the transfer of data to Google LLC (USA) infrastructure. Such transfer is governed by the Standard Contractual Clauses (SCC) approved by the European Commission and the EU-USA Data Privacy Framework mechanisms, which ensure an adequate level of protection pursuant to Art. 46 GDPR.