Privacy Policy

Last updated: 06/10/2026
This is a translation. In case of discrepancy, the Italian version prevails.

This notice, given under Arts. 13 and 14 of Regulation (EU) 2016/679 ("GDPR"), explains how Plutonios S.r.l. processes the personal data of people who visit www.plutonios.com, sign up for newsletters and webinars, contact us, are our customers or use the Plutonios back office. If you are a guest of a property that uses Plutonios, read section 7.

1. Data controller

Plutonios S.r.l., Via Giuseppe Frua 15, 20146 Milan, Italy, VAT 13788200965 ("Plutonios" or "Controller"). Contacts: info@plutonios.com, PEC plutonios@pec.it. Plutonios has not designated a data protection officer.

2. Purposes, legal bases and retention

Purpose
Information, demo and support requests, received by email, phone, WhatsApp or by booking a call
Data
Name and surname, email, phone, property, content of the request
Legal basis
Pre-contractual measures and contract (Art. 6(1)(b) GDPR)
Retention
Up to 3 years from the last contact
Purpose
Newsletter
Data
Email, name, property
Legal basis
Consent (Art. 6(1)(a) GDPR)
Retention
Until you unsubscribe
Purpose
Webinars: registration, sending the access link and reminders, access to recordings
Data
Name and surname, email, phone (optional)
Legal basis
Performance of the requested service (Art. 6(1)(b) GDPR)
Retention
24 months from the event
Purpose
Communications about products and events by email or WhatsApp, if you ticked the related box
Data
Name, email, phone
Legal basis
Consent (Art. 6(1)(a) GDPR)
Retention
Until withdrawn
Purpose
Management of customer contracts and their back office accounts: activation, support, invoicing and payments
Data
Data of the contact person and users (name, email, phone, role, credentials), billing data
Legal basis
Contract (Art. 6(1)(b) GDPR); legal obligations (Art. 6(1)(c) GDPR)
Retention
Duration of the contract; accounting records for 10 years
Purpose
Back office security and improvement: access logs and usage statistics
Data
Back office access and usage data, including the IP address
Legal basis
Legitimate interest in system security and service improvement (Art. 6(1)(f) GDPR)
Retention
No more than 24 months
Purpose
Website statistics and marketing through cookies and similar tools
Data
Browsing data and online identifiers
Legal basis
Consent (Art. 6(1)(a) GDPR), collected through the banner
Retention
See the Cookie Policy
Purpose
Legal obligations and requests from authorities
Data
Data needed to comply
Legal basis
Legal obligation (Art. 6(1)(c) GDPR)
Retention
For the period required by law
Purpose
Protection of rights in and out of court
Data
Data relevant to the dispute
Legal basis
Legitimate interest (Art. 6(1)(f) GDPR)
Retention
For the duration of the dispute and until the limitation period expires

Providing data for requests, webinars and contracts is necessary to handle them. Providing data for the newsletter and for communications about products and events is optional, and consent can be withdrawn at any time, including through the link in every email. You can object at any time to processing based on legitimate interest.

If you give us data about other people (for example colleagues to involve in a demo), you guarantee that you have informed them and are entitled to do so.

3. How data are processed

Data are processed electronically, by authorised staff and with security measures designed to prevent loss, unlawful use and unauthorised access. For some activities, such as handling requests and customer support, we may use artificial intelligence tools provided by third parties, under the control of our staff and on terms that exclude the use of the data to train the providers’ models. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

4. Recipients

Data are processed by authorised Plutonios staff and may be disclosed, to the extent necessary, to the following categories of recipients:

  • IT and cloud service providers (hosting, email, contact and communication management, tools for calls, webinars and forms), acting as data processors;
  • analytics and advertising providers, only subject to consent, as set out in the Cookie Policy;
  • banks and payment and invoicing service providers;
  • consultants and professionals bound by confidentiality;
  • public authorities, where required by law.

The list of data processors is available on request at info@plutonios.com.

5. Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area, in particular in the United States. Transfers take place on the basis of an adequacy decision, including the EU-U.S. Data Privacy Framework for certified providers, or standard contractual clauses adopted by the European Commission (Arts. 45 and 46 GDPR). You can ask for information on the safeguards in place and for a copy of them by writing to info@plutonios.com.

6. Your rights

You can exercise the rights under Arts. 15-22 GDPR at any time and free of charge by writing to info@plutonios.com: access, rectification, erasure, restriction, portability, objection and withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal. We reply within 30 days. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of your country.

7. If you are a guest of a property that uses Plutonios

Our hospitality customers use Plutonios to communicate with guests, including through an artificial intelligence assistant. When you communicate with one of these properties, you are told at the start of the conversation whether you are interacting with an artificial intelligence system and, on the phone, whether the call is recorded. The assistant’s replies are generated automatically and may contain errors: for prices, availability and stay conditions the property’s confirmation prevails, and you can always ask to be put in contact with its staff. For this processing the controller is the property, and Plutonios acts as a data processor on its behalf, under an agreement pursuant to Art. 28 GDPR. For information and to exercise your rights, contact the property and read its privacy notice; if you contact us directly, we forward your request to the property without delay. Instructions for requesting the deletion of your data are on this page.

8. Changes

We may update this notice; the date of the last update is shown at the top. Significant changes will be announced on the website.