Privacy notice on the processing of personal data
Provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) to the users of the portal cias-multisphera.com
Version of
Translation provided for convenience only: in case of discrepancy, the Italian text prevails.
1. Introduction and scope
This notice describes how the personal data of the people who use the portal cias-multisphera.com (the "Portal") are processed. The Portal is the tool with which CIAS Elettronica S.r.l. manages the licences of the MultiSphera software along its commercial chain: CIAS, branches, distributors, installers/integrators and end users.
Through the Portal you can: activate and administer licences and add-ons (including the perpetual CyberShield add-on and the Sphera+ subscription) and renew subscriptions; receive software updates and security advisories; open support requests, attaching — upon explicit authorisation — a pseudonymised diagnostic package of the installation; receive notifications, security advisories and communications from the Portal operator, in the Portal and by e-mail; exchange messages, including attachments, with colleagues of your own organisation.
The notice applies to every user of the Portal, whatever their role in the chain, and supplements any notice given in the supply contracts.
2. Data controller
The data controller is CIAS Elettronica S.r.l., registered office in Via Durando 38, 20158 Milan (Italy), VAT number 05050870154, REA MI-1096215.
- E-mail for privacy matters: info@cias.it
- Telephone: +39 02 3767161
3. Data processor and data protection officer
The development and technical operation of the Portal are entrusted to iDev S.r.l. (Via Alessandro Volta 22, 20094 Corsico MI, Italy; VAT number IT02656830185; contact: info@idev-srl.com), appointed data processor under Article 28 GDPR by a specific agreement setting out its obligations, security measures and the prohibition to use the data for its own purposes.
Data protection officer (DPO): the Controller has not appointed a data protection officer under Article 37 GDPR. For any matter concerning the processing of personal data and to exercise your rights, please contact the Controller directly at the contact details given in section 2.
4. Source of the data
Personal data may be collected:
- from another member of the chain (Article 14 GDPR): the Portal offers no self-registration, and your account is created by CIAS or by the higher-level member of the chain (branch, distributor or installer/integrator) who invites you to work on the Portal and provides your name, surname, company, e-mail, telephone and role;
- directly from you, when you complete the activation of your account by setting your password, update your profile, give or withdraw consent to communications by e-mail, open a support request, write a message or use the Portal;
- from other users of the Portal, when a colleague of your organisation includes you in a conversation or the Portal operator sends you a communication;
- from the MultiSphera software installed at the customer's premises, which sends the Portal the technical data needed to activate and verify licences (installation identifier, MAC addresses of the network interfaces of the server on which MultiSphera is installed, server fingerprint, installed version; when commissioning is closed, system number, type and MAC address of each field device) and, only if authorised by the installation administrator, the diagnostic package;
- automatically, while browsing (access and security logs).
5. Categories of data processed
- Account data: name, surname, company, e-mail, telephone, role in the chain, language, authorisation level, user who created the account.
- Credentials and multi-factor authentication: password (stored exclusively as a bcrypt hash, never in clear text), multi-factor authentication secret, devices recognised as trusted.
- Access and security logs: IP address, date and time, browser user agent, outcome of login attempts, relevant operations on licences.
- Licence data: activation key, installation identifier, MAC addresses of the network interfaces of the installation server (in clear and as a hash) and server fingerprint (hash of system identifiers); for licences whose commissioning has been closed, system number, type and MAC address in clear of each registered field device, with the hash of the list; active modules and add-ons, expiry dates, customer and commercial chain. The MAC lists in clear remain associated with the licence while it is bound to the installation, are replaced when they change and are deleted when the licence is unbound; the unbinding and commissioning logs keep only the hash and the number of the MAC addresses and, for unbindings, the server fingerprint.
- Support requests: ticket content, attachments and diagnostic packages. Packages are pseudonymised by the software before sending (identifiers replaced by codes) and are transmitted only after the explicit authorisation of the installation administrator.
- Transactional communications: account activation invitation, password reset, OTP codes, expiry notices, updates and security advisories.
- Notifications, advisories and communications: type, subject and text of the notification, data of the event that generated it (for instance the licence concerned), sender, date sent, date on which you opened it in the Portal, any choice to hide it, outcome of the e-mail delivery.
- Messages between colleagues: participants in the conversation, subject, text of the messages, attachments (file name, type, size, checksum and content), dates of sending, reading and leaving the conversation.
- Preferences and proof of consent: your choice on communications by e-mail, date and version of the information text it refers to, origin of the choice (profile, request shown after login, unsubscribe link), IP address and user agent at the time of the choice; last language used in the Portal, to write e-mails to you in your language.
- Browsing data and cookies: described in the cookie policy.
The Portal does not request nor intentionally process special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR). Please do not include them in support tickets, messages or attachments.
6. Purposes and legal bases of the processing
| Purpose | Legal basis |
|---|---|
| Creation and management of the account; activation, renewal and administration of licences and subscriptions; handling of support requests; sending of transactional communications | Performance of a contract or of pre-contractual measures (Article 6(1)(b) GDPR) |
| Service notifications about events that concern you (for instance a licence assigned to you or awaiting your approval), in the Portal and by e-mail; communications from the Portal operator shown in the Portal; messaging between colleagues of the same organisation, including attachments | Performance of a contract (Article 6(1)(b) GDPR) |
| Distribution of software updates and of vulnerability and incident advisories, including the security advisories sent in the Portal and by e-mail, in compliance with the manufacturer's obligations under Regulation (EU) 2024/2847 (Cyber Resilience Act); other legal obligations and replies to authorities | Legal obligation (Article 6(1)(c) GDPR) |
| Sending by e-mail of the communications from the Portal operator and of the notices of unread messages | Consent (Article 6(1)(a) GDPR), which may be withdrawn at any time |
| Keeping proof of consent and of its withdrawal | Legal obligation to demonstrate consent (Article 6(1)(c) and Article 7(1) GDPR) |
| Security of the Portal and of the connected systems: access logs, multi-factor authentication, detection and prevention of abuse, fraud and unauthorised access; protection of the Controller's rights | Legitimate interest of the Controller and of the users in the security of the systems (Article 6(1)(f) GDPR; recital 49) |
The legitimate interest has been balanced against your rights: logs and security measures are limited to what is necessary, kept only for as long as necessary and never used to profile users. You may object to this processing as described in the Data subject rights page.
7. Notifications, communications and messages
The Portal keeps you informed through a bell and a notification inbox. What also arrives by e-mail depends on the type:
| Type | In the Portal | By e-mail |
|---|---|---|
| Service notifications: system events that concern you, from a closed list set by the operator | Always | Always, because they are needed to use the service |
| Security advisories: vulnerabilities, incidents and security updates | Always | Always, even without consent, because they are required by law |
| Communications from the operator: messages written by CIAS or iDev to the users of the Portal | Always | Only with your consent |
| Messages between colleagues | Always | Only with your consent, as a simple notice that there is an unread message, without the text of the message |
Consent to e-mails. Consent is optional and never pre-selected: the Portal asks for it only once after login and you can change your mind at any time from your profile or from the unsubscribe link at the bottom of every e-mail that requires it. Without consent, communications and messages can still be read in the Portal. Withdrawal does not affect the lawfulness of earlier sendings. Every choice is recorded so that it can be demonstrated.
No e-mail tracking. The Portal's e-mails contain no tracking pixels and no tracked links: we do not know whether or when you open an e-mail. A notification counts as "read" only when you open it in the Portal. Whoever sends a communication sees only aggregate data (how many recipients, how many readings, how many e-mails sent), not the list of who read it.
Who sees the messages. A conversation is visible only to its participants, who all belong to the same organisation. It is not visible to the other users of your organisation, not even to its administrator, nor, in the normal use of the Portal, to CIAS or iDev: the Portal offers nobody a function to read other people's conversations. Anyone who is deactivated, removed or moves to another organisation loses access to the conversations.
Technical access by the provider. iDev S.r.l., which runs the server and the software of the Portal as data processor, technically has access to the data, including messages and attachments. Authorised staff access them only when necessary for the maintenance and security of the Portal, on the instructions of the Controller or where required by law, and not for other purposes. Texts and attachments of messages are encrypted at rest with a key kept on the server: encryption protects copies and backups of the database and of the files, but does not prevent access by whoever administers the server.
Attachments. Only images, text files and PDFs are allowed, up to 5 MB each. The type is checked on the content of the file and an attachment can be downloaded only by the participants in the conversation.
8. Nature of the provision of data
Providing account data, credentials and licence data is necessary to use the Portal: without them the account cannot be created and licences cannot be managed.
9. Processing methods and security measures
Data are processed by IT means, by authorised and trained staff, with technical and organisational measures appropriate to the risk (Article 32 GDPR), including: encryption of communications (HTTPS/TLS), storage of passwords exclusively as hashes, multi-factor authentication, role-based access control mirroring the chain, logging of security events, pseudonymisation of diagnostic packages, encryption at rest of the texts and attachments of messages, checking of the type of attachments on their content, automatic deletion of notifications and messages at the end of the retention period, backups and separation of environments.
10. Retention period
| Category of data | Retention period |
|---|---|
| Account data and credentials | For the duration of the relationship; after the account is deactivated, only for as long as necessary to comply with legal obligations or to establish, exercise or defend legal claims |
| Access and security logs | For as long as necessary for the security of the Portal and to detect abuse or unauthorised access; beyond that, only where needed to establish, exercise or defend legal claims |
| Licence and activation data | For the duration of the licence and of the relationship; after they end, only for as long as necessary to establish, exercise or defend legal claims |
| Support tickets | For the duration of the relationship; after the ticket is closed, only for as long as necessary to establish, exercise or defend legal claims |
| Attachments and diagnostic packages | For as long as necessary to resolve the support request; after the ticket is closed, only for as long as necessary to establish, exercise or defend legal claims |
| Notifications, communications, security advisories, messages between colleagues with their attachments and the related log of e-mail deliveries | 24 months from the date of sending, then automatic deletion |
| Proof of consent to communications by e-mail and of its withdrawals | For as long as the account exists; deleted together with the account |
We do not keep data beyond the minimum required by law and by the purposes described: when they are no longer necessary they are deleted or anonymised. You can ask for their erasure at any time as described on the Data subject rights page.
11. Recipients of the data
Data may be accessed by:
- authorised staff of CIAS Elettronica S.r.l. and of iDev S.r.l. (data processor), within the limits of their duties; for the content of messages and attachments, only in the cases of technical access described in section 7;
- the other members of the commercial chain your account is linked to (for instance the distributor who serves the end user), limited to the data needed to manage the licences under their responsibility;
- the participants in the conversations in which you write, who see your name, your messages and your attachments; the recipients of the communications and advisories you send, if you are a CIAS or iDev user, who see your name, company and level;
- hosting and e-mail service providers, appointed data processors: Aruba S.p.A. (registered office: Via San Clemente 53, 24036 Ponte San Pietro BG, Italy), for the dedicated server, in a data centre in Italy, and for e-mail, including the SMTP service through which the Portal sends notification e-mails, in Italy;
- public and judicial authorities, when required by law.
Data are not disseminated nor transferred to third parties for marketing purposes.
12. Transfers to third countries
Data are stored in Italy, on a dedicated server of Aruba S.p.A. located in an Italian data centre; the Portal's e-mail is also handled by Aruba S.p.A. Data therefore remain within the European Union.
The Portal uses no third-party service that involves a transfer of personal data to third countries. Should a provider involve such a transfer in the future, this notice will be updated stating the safeguards adopted under Articles 44-49 GDPR.
13. Automated decision-making
The Portal takes no decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects the person (Article 22 GDPR). Automatic security checks (for instance the temporary lock-out after repeated failed logins) are technical protection measures and do not involve decisions about the person.
14. Data subject rights
You may at any time exercise the rights set out in Articles 15-22 GDPR: access, rectification, erasure, restriction, portability, objection, as well as withdraw consent without affecting the lawfulness of previous processing. Practical instructions are in the Data subject rights page.
- Access: the notifications and conversations you are part of can be consulted in the Portal; you can ask the Controller for a copy of the data concerning you.
- Withdrawal of consent: from your profile or from the unsubscribe link at the bottom of the e-mails, with immediate effect on subsequent sendings.
- Erasure: you can hide a notification from your inbox and leave a conversation; final deletion takes place automatically after 24 months or, earlier, on request to the Controller, within the limits of Article 17 GDPR.
- Deletion of the account: your preferences and the proof of consent are deleted with the account; the messages you wrote remain available to the other participants in the conversation until the 24 months expire, with the sender shown as "removed user".
You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to seek a judicial remedy.
15. Minors
The Portal is intended for professional operators and is not addressed to persons under 18 years of age.
16. Changes to this notice
This notice may be updated to reflect changes in the service or in the law. The version date is shown at the top of the page; substantial changes are communicated to the users of the Portal and, when they introduce cookies requiring consent, entail asking for your prior consent.