Public notice on suppliers, subprocessors and transfers

Preamble, nature and effect of this document

Nil Tech Europe S.r.l., with registered office at Via Calmaggiore 5, 31100 Treviso (TV), Italia, VAT No. IT 05614380268 (“Niltech”), adopts this document in order to distinguish suppliers, software components and subprocessors and describe the controlled process for approving locations, onward processing and transfers.

This document is a corporate transparency and accountability record. It is not a third-party certification, legal opinion addressed to persons other than the company, absolute security warranty or blanket compliance statement; contractual commitments arise solely from the applicable agreements.

This notice distinguishes suppliers, software components and subprocessors and describes the assessment process under Articles 28 and 44 et seq. GDPR. It does not replace the controlled register, any authorisation or notice required by the DPA, applicable Standard Contractual Clauses or the transfer assessment retained in the due-diligence file.

Personal and material scope

The objective scope includes ClaimEvidence, its public interfaces and processing strictly connected with the described functions. The corporate website and document library are published on claimevidence.tech; the application service is available through the separate app.claimevidence.tech domain. Hostinger provides infrastructure and, according to the applicable configuration, mail transport. MySQL/MariaDB is software running in the controlled environment and not a separate subprocessor unless a distinct managed service is used. OpenAI provides API services only for enabled functions; any separate email provider must be identified and assessed before use.

The relevant operations concern guided photo and document collection, case organisation, completeness checks, configurable analytical support, human review and export. Potential information categories are: demo and security-pack requests on the site; in the application, case identifiers, authorised contacts, photographs, documents, notes, session metadata and assisted outputs. The actual privacy role, lawful basis and extent of processing depend on the contractual relationship and the lawful instructions of the party determining purposes and essential means.

Definitions and interpretation

• “Service” means the ClaimEvidence functions made available under the agreement.
• “Customer” means the legal person or professional entering into the agreement with Niltech.
• “Authorised User” means an individual enabled by the Customer to use the Service under its responsibility.
• “Customer Data” means data, documents, images, instructions and other content submitted or generated on the Customer’s behalf.
• “Assisted Output” means a result produced through automated rules or artificial-intelligence components and subject to the stated controls.
• “Further Supplier” means a third party providing Niltech with a technical service relevant to the documented scope.
• “Incident” means an event compromising or capable of compromising confidentiality, integrity, availability, authenticity or resilience.
• “Business Day” means a day other than Saturday, Sunday or an Italian national public holiday.

Specific duties and safeguards

1. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall identify the contracting legal entity and actual function. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

2. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall map data, subjects, access, support and onward flows. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

3. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall verify DPA, contractual locations and subprocessors. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

4. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall assess transfer mechanism, TIA and supplementary measures. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

5. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall provide change notice and objection handling. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

6. Within its assigned role and without prejudice to the Customer’s responsibilities, Niltech shall plan portability, termination and verified deletion. The applicable file identifies the owner, scope, dependencies, acceptance criterion and evidence; absent those elements, the safeguard is not treated as demonstrated.

Public notice

Suppliers and components relevant to the scope: Hostinger, OpenAI, MySQL/MariaDB, email transport.

Hostinger provides infrastructure and, according to the applicable configuration, mail transport; OpenAI provides API services only where the function is enabled. MySQL/MariaDB is software running in the controlled environment and is not a separate subprocessor unless a distinct managed service is used. Email transport is a function: where included in hosting it falls under that supplier; any separate provider must be identified and assessed before use.

Payment services are outside the scope described by this documentation.

Controlled information

For each supplier the restricted register records entity, service, data, purpose, contractual location, onward processing, DPA, transfer basis, supplementary measures, owner, review and decision.

Transfers

A European server location does not prove that support, telemetry or AI services remain in the EEA. Conclusions follow updated contracts and transfer assessment.

Changes

Material changes are assessed before use and notified under contract. The customer may raise reasoned objections within applicable terms.

Scope, audience and status of this document

This document is intended for customers, prospects, authorised users, advisers and control functions needing to understand the ClaimEvidence scope. Its specific objective is to distinguish suppliers, software components and subprocessors and describe the controlled process for approving locations, onward processing and transfers. It applies to the stated document revision and date and must be read with the applicable agreement, order, DPA, technical specifications and controlled procedures.

The corporate website and document library are published on claimevidence.tech; the application service is available through the separate app.claimevidence.tech domain. Hostinger provides infrastructure and, according to the applicable configuration, mail transport. MySQL/MariaDB is software running in the controlled environment and not a separate subprocessor unless a distinct managed service is used. OpenAI provides API services only for enabled functions; any separate email provider must be identified and assessed before use.

Executed agreements and actually approved configurations prevail in case of inconsistency. Public information describes the control programme; it does not turn optional provider capabilities into Niltech controls or automatically attest legal applicability or satisfaction.

Exceptions, non-conformity and escalation

A deviation is not accepted by custom. The owner records the affected requirement, cause, impact, exposed data and persons, compensating measures, approver, expiry and closure criterion. The exception is reviewed if risk changes or a measure does not work as expected.

Incidents, possible unlawful processing, loss of data control, outputs with severe impact, contractual breaches, unapproved suppliers or unreliable evidence must be escalated without delay. Current Legal and functional scope: Payment services are outside the scope described by this documentation.

• contain risk and suspend the affected phase where needed
• preserve evidence, timing, decisions and communications
• involve privacy, security, product, legal or management owners as appropriate
• resume only after measure verification and documented authorisation

Review, change and improvement

The document is reviewed at least every six months and earlier when purpose, audience, data, GDPR or AI Act role, supplier, model, architecture, location, contractual terms or legal requirements change. Incidents, complaints, failed tests and new vulnerabilities trigger an extraordinary review.

Each review records inputs, participants, decision, changes, superseded evidence, remaining gaps and next date. Material corrections are published without retroactively altering the prior document revision. Contact and requests: info@nil-tech.net.

• check change register and related documents
• retest affected controls
• update manifest, PDF, HTML and hashes
• notify recipients where the change affects their rights or duties

Public-notice criteria

The notice distinguishes contractual supplier, service, software component, function, potential data access, privacy role, processing or access countries stated in current terms, transfer mechanism and verification date. A component running in Niltech’s environment does not become a subprocessor merely because it is third-party software; a supplier with potential access does not cease to be one merely because data are encrypted in transit.

For ClaimEvidence, Hostinger identifies the infrastructure provider and, according to the applicable configuration, the mail-transport provider; OpenAI identifies the API service only where enabled. MySQL/MariaDB identifies software running in the controlled environment, not a separate subprocessor unless a distinct managed service is used. The names do not attest a particular contracting entity, region, certification or retention period: those properties are stated only where evidenced by an order, configuration or applicable contractual document.

Due diligence, change and transfers

Due diligence considers security, continuity, confidentiality, downstream suppliers, rights assistance, deletion, incidents and transfers. Supplier marketing statements are not treated as verified controls. The file retains the DPA, terms, subprocessor list, SCCs or adequacy decision, any necessary TIA and the approval decision.

Material changes are assessed before effectiveness where contractually possible. A Customer objection must be substantiated; Niltech assesses an alternative, mitigation or termination of the function. The public notice does not replace the controlled register or any notice or authorisation required under the DPA.

Allocation of responsibility and reliance limitations

Within its sphere of responsibility, the Customer warrants the lawfulness of submitted data and instructions, user authorisation, suitable lawful bases and notices, and professional verification of outputs. Niltech remains responsible for activities directly under its control and does not assume the Customer’s regulatory, professional or decision-making functions.

Outputs from ClaimEvidence are auxiliary. Unless expressly agreed and subject to mandatory law, they are not legal advice, an expert determination, insurance decision, liability finding, credit assessment or other reserved professional act. The recipient must examine sources, completeness, consistency and consequences before use.

Nothing excludes liability that cannot lawfully be excluded. Outside those cases, attribution, remedies, limitations and quantification principles follow the applicable agreement, taking account of contributory conduct, mitigation duties and foreseeability under the governing law.

Evidence, review, requests and governing law

Every material assertion must be traceable to a contract, approved configuration, register, minutes, test, log or other reliable evidence. Supplier statements and Niltech controls are kept distinct. Absence of incidents is not, by itself, proof that a measure is effective.

Revisions are dated, reasoned and approved. A later revision does not retroactively alter facts or commitments applicable to earlier periods. Published copies are identified by code, date and cryptographic digest; those elements evidence copy integrity, not the substantive effectiveness of described controls.

Reports, clarification requests, rights requests and complaints may be sent to info@nil-tech.net. Niltech verifies identity and authority where necessary, records the request, responds within applicable periods and communicates any reasoned extension or refusal.

Unless mandatory law or a written agreement provides otherwise, Italian law governs interpretation. The Italian text is controlling; the English translation is provided for convenience.