Legal & Compliance

1Who we are and who the service is for

Emawerly S.r.l., Via Caduti di Cefalonia 2, 40125 Bologna (Italy) · VAT no. and Tax Code 04289341200 · PEC pec@pec.emawerly.com · email contact@emawerly.com.

The service is intended exclusively for businesses, professionals and entities acting for purposes related to their trade or profession (B2B). It is not offered to consumers. By registering you declare that you have the authority to bind the organisation you represent (the “Customer”).

2Documents forming the contract

The contract consists of: (a) these Terms; (b) any order or selected plan; (c) the Data Processing Agreement (DPA); (d) the Security Policy; (e) AI Transparency; (f) the list of sub-processors. In case of conflict, the DPA prevails for personal data, then the order, then these Terms.

3The service

Emawerly is a cloud platform (SaaS) bringing together modules for orders, shipping and tracking, returns, warehouse, marketing, CRM, data analysis and Ema AI, the agentic AI assistant. Emawerly is a technology integrator: it connects the systems and services the Customer already uses (e-commerce, marketplaces, carriers, advertising platforms, payment and invoicing systems) through API integrations.

Available modules and features depend on the chosen plan. We may introduce improvements and new features; if a change substantially reduces the service we will notify you at least 30 days in advance.

4Account, free trial and access

• The account is personal and credentials must be kept safe. The Customer is responsible for activity carried out with its users’ credentials.
• The free trial lasts 15 days, with no purchase obligation. After the trial the service continues only once a plan is activated.
• The Customer designates an administrator and keeps contact and billing details up to date.
• We may suspend an account in case of unlawful use, security risk or non-payment, giving prior notice where possible.

5Plans, prices and payments

• Plan prices are those shown on the Pricing page at the time of purchase, excluding VAT and taxes.
• The fee is invoiced in advance with the plan’s billing period and renews automatically, unless cancelled from the control panel before renewal.
• Payments are handled by Stripe; we do not store full card details.
• Invoices are issued electronically. Any usage-based modules or additional services are indicated before activation.
• Carrier rates and third-party services remain governed by the contracts the Customer has with those parties: Emawerly is not a party to them.
• In case of late payment we may apply the interest provided by Italian Legislative Decree 231/2002 and suspend the service after a reminder.

6Acceptable use

The Customer undertakes to use the service in compliance with the law and third-party rights. In particular, it is prohibited to:

• upload unlawful data or content, or process personal data without a valid legal basis;
• attempt unauthorised access, bypass technical limits, or interfere with the security or availability of the service;
• resell or sub-license the service without a written agreement (the Partner Programme has a dedicated contract);
• send commercial communications in breach of email marketing and consent rules;
• use Ema AI for purposes prohibited by the AI Act or for the high-risk decisions listed on the AI Transparency page.

7Customer Data and personal data protection

Data the Customer uploads or generates in the platform remains its property (“Customer Data”). The Customer grants Emawerly a limited licence to process it to provide the service. For personal data contained in Customer Data (for example shipment recipients) the Customer is the controller and Emawerly is the processor under Art. 28 GDPR, according to the DPA, which forms an integral part of these Terms. For data whose purposes and means Emawerly determines (account, billing, website) the Privacy Policy applies.

8Ema AI and use of artificial intelligence

Ema AI is an assistant that relies on third-party AI models (Anthropic, OpenAI, Google Gemini, xAI Grok). Responses are generated automatically and may contain errors: the Customer must verify relevant information before acting. Actions affecting data or systems are executed within the assigned permissions and, where configured, after human approval. We do not use Customer Data to train our own AI models; the conditions of model providers are described on the AI Transparency page.

9Third-party integrations

Integrations with third-party services (e-commerce, marketplaces, carriers, Google Ads, Meta, payment systems) work only if the Customer activates them and has a valid relationship with the third party. The Customer authorises Emawerly to access those services on its behalf. Emawerly is not liable for interruptions, API changes or limits imposed by third parties, but works to adapt integrations promptly.

10Intellectual property

The platform, software, trademarks, interfaces, documentation and training materials are and remain the property of Emawerly or its licensors. The Customer is granted a non-exclusive, non-transferable, revocable right to use the service for the term of the contract. Any feedback and suggestions may be freely used by Emawerly to improve the service.

11Availability, support and security

We provide the service with professional diligence and the security measures described in the Security Policy. We do not guarantee uninterrupted service; scheduled maintenance is announced in advance where possible. Specific service levels (SLA) and priority support apply only if included in the plan or in a written agreement.

12Warranties and limitation of liability

• Except as provided by law, the service is provided “as available” and we offer no implied warranties of fitness for a particular purpose.
• No limitation applies to liability for wilful misconduct or gross negligence, or where the law does not allow limitation (Art. 1229 of the Italian Civil Code).
• To the extent permitted by law, Emawerly’s total liability to the Customer for each event is limited to the fees paid in the 12 months preceding the event.
• Emawerly is not liable for indirect damages, lost profits or loss of opportunity, nor for damages arising from third-party services, non-compliant use, or decisions taken on the basis of AI-generated content without verification.

13Term, withdrawal and termination

• The contract lasts for the chosen plan period and renews automatically. The Customer may cancel at any time from the control panel, effective at the end of the period already paid.
• Either party may terminate for material breach not remedied within 15 days of written notice.
• On termination the Customer may export its data for 30 days; we then delete it under the DPA, subject to legal retention obligations.
• Right to switch provider (Reg. EU 2023/2854, Data Act): the Customer may request switching to another data processing service provider with a maximum notice of 2 months and assistance in migrating exportable data. We do not charge switching costs above actual costs.

14Changes to the Terms

We may update these Terms for legal, technical or commercial reasons. Material changes are communicated at least 30 days in advance by email or in the platform. If the Customer does not accept them it may withdraw without penalty before they take effect.

15Governing law and jurisdiction

The contract is governed by Italian law. The Courts of Bologna have exclusive jurisdiction over any dispute, except where mandatory law provides otherwise. Before taking legal action the parties undertake to attempt an amicable settlement by writing to the contacts above.

16Specific approval (Arts. 1341 and 1342 of the Italian Civil Code)

The Customer declares that it has read and specifically approves the clauses: Account and suspension (4), Plans and payments (5), Warranties and limitation of liability (12), Term, withdrawal and termination (13), Changes to the Terms (14), Governing law and jurisdiction (15).

17Contacts

Emawerly S.r.l., Via Caduti di Cefalonia 2, 40125 Bologna (Italy) · VAT no. and Tax Code 04289341200 · PEC pec@pec.emawerly.com · email contact@emawerly.com.

Data Protection Officer (DPO): Avv. Carmelo Prestileo, privacy@emawerly.com.

1Controller and DPO

Emawerly S.r.l., Via Caduti di Cefalonia 2, 40125 Bologna (Italy) · VAT no. and Tax Code 04289341200 · PEC pec@pec.emawerly.com · email contact@emawerly.com.

Data Protection Officer (DPO): Avv. Carmelo Prestileo, privacy@emawerly.com.

Emawerly is the controller of the data described in this notice. For data contained in Customer Data (for example shipment recipients) Emawerly acts as processor on behalf of the Customer, within the limits of the DPA: in that case the Customer is the controller and data subject requests should be addressed to it.

2What data we process

• Contact and profile data: first name, last name, email, phone, company, role, language, content of requests sent through forms.
• Account and platform usage data: credentials (in encrypted form), users and permissions, access logs, settings, usage events, IP address.
• Billing data: company name, VAT number, address, recipient code/PEC, invoice and payment history (card data is processed by Stripe).
• Browsing data and cookies: see the Cookie Policy.
• Academy and Partner data: course progress, exam results, credentials, professional profile data published on request.
• Communications: messages exchanged with support and sales.

Some data is not collected directly from you (Art. 14 GDPR): professional contact details (name, role, company, business email) coming from LinkedIn profiles and campaigns, from publicly available sources (company websites, public registers and directories) or from referrals by customers and partners. In these cases we inform you at first contact, and in any case within one month, stating the source; you may object to the processing at any time (section 8).

3Purposes and legal bases

Providing the data necessary for the service is mandatory: without it we cannot activate the account. Providing data for marketing is optional.

4Who we share data with

Data is processed by authorised staff and by providers acting as processors (Art. 28 GDPR), listed on the Sub-processors page: hosting (Contabo), cloud storage (AWS, Milan), payments (Stripe), e-invoicing (Growth System Platform S.r.l.) and, when you use Ema AI, AI model providers (Anthropic, OpenAI, Google, xAI). We may also share data with professional advisers bound by confidentiality, with authorities where required by law and, in the event of corporate transactions, with the parties involved. We do not sell personal data.

5Transfers outside the EEA

Where possible data stays in the European Economic Area. If a provider processes data in the United States or other third countries, the transfer relies on an adequacy decision (EU-US Data Privacy Framework for certified providers) or on the European Commission’s Standard Contractual Clauses (Decision 2021/914), with supplementary measures where necessary. You may ask us for a copy of the safeguards adopted.

6Automated decisions and artificial intelligence

We do not take decisions based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). With your consent, the marketing cookies described in the Cookie Policy may involve profiling for measurement and advertising purposes; it does not produce legal or similarly significant effects on you and you may object at any time (section 8). Ema AI assists platform users; information on how it works and how we protect data is on the AI Transparency page.

7Security

We adopt appropriate technical and organisational measures (encryption in transit and at rest, access control, backups, monitoring) described in the Security Policy. In case of a personal data breach we notify the supervisory authority and data subjects in the cases and within the terms of Arts. 33 and 34 GDPR.

8Your rights

You may at any time exercise the rights of access, rectification, erasure, restriction, portability and objection (Arts. 15-21 GDPR), and withdraw consent without affecting processing already carried out. Write to privacy@emawerly.com: we reply within one month, extendable by two in complex cases. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority of your Member State of residence.

Objection to direct marketing. You have the right to object at any time, without giving reasons, to the processing of your data for direct marketing purposes, including related profiling (Art. 21(2) and (3) GDPR): after your objection we no longer process it for those purposes. You can use the unsubscribe link in every communication, write to privacy@emawerly.com or switch off marketing cookies from “Cookie preferences” in the footer.

9Minors

The service is intended for professionals and businesses and is not aimed at persons under 16. We do not knowingly collect data from minors.

10Updates

We update this notice when processing or legislation changes. The date at the top shows the latest version; for material changes we notify you in the platform or by email.

1What cookies are

Cookies are small text files the website stores on your device. Similar technologies (local storage, pixels, device identifiers) fall under the same rules.

2Controller

Emawerly S.r.l., Via Caduti di Cefalonia 2, 40125 Bologna (Italy) · VAT no. and Tax Code 04289341200 · PEC pec@pec.emawerly.com · email contact@emawerly.com.

Data Protection Officer (DPO): Avv. Carmelo Prestileo, privacy@emawerly.com.

3Cookie categories

Current status: the website uses technical cookies. Analytics and marketing cookies are not installed without your prior consent.

List of cookies and similar technologies present on the public website. Marketing cookies are installed only after your consent; LinkedIn sets them when you consent to marketing cookies. LinkedIn’s complete, up-to-date cookie list is published on its website.

4Third-party cookies

When you enable, with consent, third-party tools (for example LinkedIn, Google Ads or Meta), those parties may set their own cookies and act as independent controllers. Their notices are available on their websites. Integrations with such services connected by the Customer to the platform do not install cookies on the public website.

5How to manage your preferences

• On your first visit you can accept, reject or customise non-technical categories; rejecting is as easy as accepting.
• You can change your mind at any time from the “Cookie preferences” link in the footer. Consent is requested again after 6 months or on material changes.
• You can also block or delete cookies from your browser settings (Chrome, Firefox, Safari, Edge): disabling technical cookies may prevent parts of the service from working.

6Data processing and rights

Data collected through cookies is processed according to the Privacy Policy. You may exercise your GDPR rights by writing to privacy@emawerly.com.

7Updates

We update this policy when the tools used change. The detailed list of cookies, with name, provider, purpose and duration, is in the table in section 3.

1Approach and governance

Security is a management responsibility. We operate with a risk-based approach: we identify assets, threats and vulnerabilities, assign responsibilities and review measures at least once a year and after every significant incident. The DPO oversees personal data protection.

2Alignment with NIS2

As a digital service provider to customers, we adopt measures consistent with Art. 21 of the NIS2 Directive (Art. 24 of Italian Legislative Decree 138/2024), also to support NIS2-regulated customers who must manage supply-chain security. Areas covered:

3Infrastructure and data location

Servers are hosted by Contabo GmbH (Germany, EU). Files and backups are stored on AWS, Milan region (eu-south-1). Environments are logically segregated by customer (multi-tenant isolation), and development, test and production environments are separate.

4Encryption

• In transit: TLS 1.2 or higher for all connections.
• At rest: encryption of data and backups; passwords are stored only as salted hashes.
• Secrets and API keys are managed separately from code and rotated.

5Access control

• Role-based access (RBAC) and least privilege; periodic permission reviews.
• Multi-factor authentication for administrative access to infrastructure.
• Logging of access and sensitive actions (audit log).
• Immediate revocation of access when the relationship ends.

6Secure development and vulnerability management

• Code review, automated tests and dependency checks before release.
• Timely application of security patches, prioritised by severity.
• Periodic security assessments and penetration tests.

7Security of Ema AI and integrations

• Agents operate only with assigned permissions and, where configured, require human approval for sensitive actions.
• Measures against prompt injection and data leakage between customers; context sent to models is limited to what is necessary.
• Customer Data is not used to train Emawerly AI models.
• API integrations use credentials limited to the necessary scope, stored encrypted and revocable by the Customer at any time.

8Business continuity and backup

We run periodic data backups and test restoration. The continuity plan defines recovery objectives and responsibilities; details are available to customers on request under a confidentiality agreement.

9Incident management and notification

We continuously monitor the platform. In case of an incident we apply a procedure of detection, classification, containment, root-cause analysis and improvement.

• If an incident involves the Customer’s personal data, we inform the Customer without undue delay and in any case within 48 hours of discovery, so that it can meet Art. 33 GDPR.
• For incidents significantly affecting the availability or security of the service, we provide an initial warning, where possible, within 24 hours and subsequent updates.
• If Emawerly is subject to NIS2 for the affected service, it makes notifications to CSIRT Italia and ACN within the legal deadlines (early warning within 24 hours, notification within 72 hours, final report within one month).

10Suppliers and supply chain

We choose suppliers by assessing security and compliance and bind them with agreements requiring equivalent measures. The updated list is on the Sub-processors page.

11Reporting a vulnerability

If you believe you have found a vulnerability, write to contact@emawerly.com with the subject “Security”. We will reply within 3 business days. We ask that you act in good faith: do not access other users’ data, do not degrade the service, and give us reasonable time to fix before disclosure.

12Customer responsibilities

The Customer protects its users’ credentials, enables multi-factor authentication, assigns permissions sensibly, revokes access for people who leave the organisation and reports suspected compromise to us without delay.

13Contacts

Emawerly S.r.l., Via Caduti di Cefalonia 2, 40125 Bologna (Italy) · VAT no. and Tax Code 04289341200 · PEC pec@pec.emawerly.com · email contact@emawerly.com.

Data Protection Officer (DPO): Avv. Carmelo Prestileo, privacy@emawerly.com.

1Parties, roles and definitions

The Customer is the controller (or processor, if acting on behalf of its own customer). Emawerly S.r.l. (Via Caduti di Cefalonia 2, 40125 Bologna (Italy), VAT no. and Tax Code 04289341200) is the processor (or sub-processor). “Personal data”, “processing”, “personal data breach” and “data subject” have the meaning given in the GDPR. Emawerly’s DPO is Avv. Carmelo Prestileo (privacy@emawerly.com).

2Subject matter, duration, nature and purpose

• Subject matter: provision of the Emawerly platform and the modules activated by the Customer.
• Duration: for the whole term of the contract, plus the export and deletion period.
• Nature: collection, recording, organisation, storage, retrieval, processing including through AI functions, transmission to connected services, deletion.
• Purpose: management of orders, shipments, tracking, returns, warehouse, marketing, CRM, data analysis, invoicing and use of Ema AI, as configured by the Customer.

3Categories of data and data subjects

• Data subjects: the Customer’s end customers and shipment recipients, leads and CRM contacts, the Customer’s users and employees, contacts at suppliers and carriers.
• Data: identity and contact data, delivery addresses, order and shipment data, communications, online identifiers, billing data, content uploaded by the Customer.
• The Customer must not upload special categories of data (Art. 9) or data relating to criminal convictions (Art. 10) without prior written agreement.

4Customer instructions

Emawerly processes personal data only on the Customer’s documented instructions, represented by the contract, and by the use and configuration of the platform. If it believes an instruction infringes the law, it informs the Customer without delay. Emawerly does not process data for its own purposes and does not use it to train AI models.

5Confidentiality

Emawerly ensures that persons authorised to process data are bound by confidentiality and have received adequate training.

6Security measures

Emawerly applies the technical and organisational measures described in Annex II and in the Security Policy, appropriate to the risk under Art. 32 GDPR. They may be updated provided the overall level of protection is not reduced.

7Sub-processors

• The Customer gives general authorisation to use the sub-processors listed on the Sub-processors page.
• Emawerly imposes on sub-processors data protection obligations equivalent to those of the DPA and remains liable for their performance.
• Additions or replacements are notified at least 30 days in advance (email or platform). The Customer may object on reasonable data protection grounds within that period; if no solution is found, it may terminate the affected service without penalty.

8Assistance to the Customer

Taking into account the nature of the processing, Emawerly assists the Customer with appropriate measures: (a) in responding to data subject requests (Arts. 15-22): requests received directly are forwarded to the Customer without delay; (b) in complying with Arts. 32-36 (security, breach notification, impact assessments, prior consultation). Extraordinary assistance requiring significant effort may be subject to a reasonable agreed fee.

9Personal data breaches

Emawerly informs the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach, providing the information available (nature, categories and approximate number of data subjects, likely consequences, measures taken) and subsequent updates. Notification is not an acknowledgement of liability.

10Transfers to third countries

Data is stored in the EEA (servers in Germany, storage in Milan). If the sub-processors providing AI models process data outside the EEA, the transfer relies on an adequacy decision (e.g. EU-US Data Privacy Framework) or the Standard Contractual Clauses (EU Decision 2021/914), hereby referenced and incorporated (Module 2 controller-to-processor and/or Module 3 processor-to-processor, with options and annexes completed in accordance with this DPA, Italian law, courts of Bologna), with the necessary supplementary measures.

11Audits and information

Emawerly makes available to the Customer the information necessary to demonstrate compliance with Art. 28 and allows audits, including by an auditor appointed by the Customer and bound by confidentiality, with at least 30 days’ notice, at most once a year (except in case of breach) and during business hours, so as not to compromise other customers’ security. Costs are borne by the Customer.

12Return and deletion

On termination of the contract the Customer may export its data within the following 30 days. After that period Emawerly deletes personal data from production systems and, within a further 60 days, from backups, unless retention is required by EU or Italian law. On request it certifies deletion in writing.

13Liability, term and governing law

The limits of the Terms apply to liability, without prejudice to Art. 82 GDPR towards data subjects. The DPA remains in force as long as Emawerly processes data on behalf of the Customer. Italian law applies; Bologna courts have jurisdiction.

14Annex I · Description of the processing

15Annex II · Technical and organisational measures

• Encryption of data in transit (TLS 1.2+) and at rest; password hashing.
• Role-based access control, least privilege, MFA for administrative access, audit logs.
• Logical segregation of customer data and of development, test and production environments.
• Periodic backups and restore tests; business continuity plan.
• Vulnerability and update management; secure development lifecycle.
• Incident management and notification procedure.
• Contractual confidentiality and staff training; supplier selection and monitoring.
• For AI functions: context limited to what is necessary, minimum permissions for agents, no model training on Customer data.

16Annex III · Sub-processors

The updated list of authorised sub-processors is published on the Sub-processors page.

1Authorised sub-processors

AI model providers receive data only if the Customer uses Ema AI and only to the extent of the context needed to answer the request.

2Third-party integrations activated by the Customer

These are not Emawerly sub-processors: they are services the Customer chooses to connect with its own credentials. Emawerly accesses them on its behalf, through APIs. The Customer remains bound by those providers’ terms.

3How to receive updates

List updates are communicated to customers by email or in the platform at least 30 days in advance. To ask to be notified at a specific address, or to object to a new sub-processor, write to privacy@emawerly.com.

4Contacts

Emawerly S.r.l., Via Caduti di Cefalonia 2, 40125 Bologna (Italy) · VAT no. and Tax Code 04289341200 · PEC pec@pec.emawerly.com · email contact@emawerly.com.

Data Protection Officer (DPO): Avv. Carmelo Prestileo, privacy@emawerly.com.

1You are interacting with an AI

Ema AI Assistant and the AI Avatars created with Hive are artificial intelligence systems. Interfaces make this clear (Art. 50 AI Act). AI-generated content is labelled as such where required by law.

2How it works

Ema AI is an orchestrator: it coordinates several third-party AI models (Anthropic, OpenAI, Google Gemini, xAI Grok) and uses them to understand requests, analyse platform data the user has access to, suggest actions and carry out tasks within assigned permissions. Ema AI is not a model trained by Emawerly on customer data.

3Data and training

• We send models only the context needed to answer the request.
• Customer Data is not used by Emawerly to train AI models.
• Model providers are sub-processors listed on the dedicated page; they process data under their API terms of service and our DPA.
• Isolation between customers prevents one customer’s data from appearing in another’s answers.

4Human oversight

Ema AI proposes and the Customer decides: actions affecting data or systems are executed only within assigned permissions and, where the Customer configures it, after explicit approval. Agent activity is logged and viewable.

5Limits and responsible use

• Answers may be incomplete, inaccurate or out of date: verify important information.
• Ema AI does not replace legal, tax or professional advice.
• Ema AI is designed for logistics, e-commerce, marketing and administration. It must not be used for practices prohibited by the AI Act (Art. 5), nor for high-risk systems in Annex III, such as recruitment and evaluation of staff, access to essential services, or credit scoring of natural persons.
• A Customer using AI towards its own staff or end customers informs the persons concerned as required by applicable law.

6Literacy and responsibility

Emawerly promotes AI training (Art. 4 AI Act) through Emawerly Academy. The Customer, as deployer, is responsible for the compliant use of Ema AI in its own processes.

7Contacts

Emawerly S.r.l., Via Caduti di Cefalonia 2, 40125 Bologna (Italy) · VAT no. and Tax Code 04289341200 · PEC pec@pec.emawerly.com · email contact@emawerly.com.

Data Protection Officer (DPO): Avv. Carmelo Prestileo, privacy@emawerly.com.