Privacy Policy

PiirZ Digital Limited, registration number C114280, registered office at 63 Level 1, Unit 17 ConnectiClub Business Center, Triq ii-Ballot, Mosta MST 4000, Malta, is the data controller for personal data processed through piirz.com, piirz.eu and their subdomains. Privacy requests: hello@piirz.com

• Contact form: name, email address, organization, phone number, subject and message. • Conversations with PAN: the text written in the chat and, in voice mode, the audio of what is said, with the resulting transcript. Any personal data shared during the conversation, such as a name or an email address, is part of the transcript. • Agri-food position paper form: name, email address, organization, role, sector, the optional link and note, and the consents given. • AI self-assessment: name, email address, organization details, role and answers. For the paid version, payment is handled by Stripe: card data is entered on Stripe's pages and is not received by PiirZ. • Technical data: IP address, browser, operating system, pages requested and time of access, recorded in the hosting provider's server logs. • Usage statistics: aggregated counts collected by Cabin and Vercel Web Analytics, without cookies and without identifiers that single out a visitor.

• Replying to contact requests and to requests made through PAN: steps taken at the request of the person before a contract, and legitimate interest in handling inbound requests (Art. 6(1)(b) and (f) GDPR). • Analysis of PAN conversations: each transcript is processed by a language model to produce an internal summary for PiirZ. If an email address is given during the conversation, a summary is sent to that address. Basis: legitimate interest in following up requests made by the visitor (Art. 6(1)(f) GDPR). • AI self-assessment and report: the answers are processed by a language model to produce the report. Basis: consent given before starting, and performance of the contract for the paid version (Art. 6(1)(a) and (b) GDPR). • Agri-food position paper: sending the document requested, and commercial communications only with the separate consent given in the form (Art. 6(1)(a) GDPR). • Security and operation of the site, aggregated statistics: legitimate interest (Art. 6(1)(f) GDPR). • Accounting and tax obligations: legal obligation (Art. 6(1)(c) GDPR). No decision with legal or similarly significant effects is taken by automated means alone.

• Contact requests, PAN transcripts and their summaries: 24 months from the last interaction. • Self-assessment and position paper form data: until consent is withdrawn, and in any case no longer than 24 months from the last interaction. • Contractual and accounting data: duration of the contract plus 10 years, as required by Maltese law. • Server logs: according to the hosting provider's retention periods. • Usage statistics: kept in aggregated form only.

Under the GDPR, the data subject has the right to: • access personal data and obtain a copy; • rectify inaccurate or incomplete data; • obtain erasure where applicable; • restrict processing in specific cases; • receive the data in a structured, machine-readable format; • object to processing based on legitimate interest; • withdraw consent at any time, without affecting processing carried out before. Requests: hello@piirz.com A complaint can be lodged with the Office of the Information and Data Protection Commissioner (IDPC) in Malta.

Personal data is processed by the following service providers, each acting on PiirZ's instructions: • Vercel: hosting of the site, server logs and cookieless usage statistics (Web Analytics). • Cabin: cookieless usage statistics. • Provider of the conversational agent behind PAN: text conversation, speech recognition and speech synthesis. • Groq: language model used to analyse PAN transcripts and self-assessment answers. • Email service providers, including Resend for the position paper form: delivery of contact requests, documents, summaries and reports. • Stripe: payments for the paid self-assessment. Calendly is reached through an external link: booking a meeting happens on Calendly's site, under Calendly's own policy. The support panel on the institutional pages embeds pcpan.piirz.eu, which loads fonts from Google Fonts: the browser sends its IP address to Google when the panel is opened. Data is not sold or transferred to third parties for marketing.

Some providers process data outside the European Economic Area. Each transfer relies on an adequacy decision of the European Commission or on Standard Contractual Clauses (SCCs) approved by the Commission.

Technical and organizational measures protect personal data against unauthorized access, alteration, disclosure or loss. They include encryption in transit (TLS), access control on the systems involved and periodic review of the providers.

This policy is updated when the processing changes. The date of the current version is shown at the top of the page.