Privacy Policy

Last updated: 2026-04-17

1. Introduction

This Privacy Policy explains how this deployment of MatchMaking Intelligence ("Service") collects, uses, stores, and shares personal data when you use the platform. It is intended to describe the data flows implemented in the current application build and must be read together with the contractual and organizational arrangements of the entity operating the service.

2. Data Controller

The data controller is the organization operating this deployment of the Service.

Operational privacy contact for this deployment: m.ferramola@nsbproject.com

3. Personal Data We Collect

3.1 Registration Data

• First name and last name
• Business email and optional phone
• Organization profile and collaboration interests
• Consent preferences and technical audit metadata

3.2 Search and Query Data

• Search prompts and query parameters
• Filter criteria and classification requests
• Export requests and download history

3.3 Partner Matching Data

• Counterpart descriptions and matching criteria
• AI-generated matching results
• Web search results related to partner discovery

3.4 Technical Data

• IP address and browser information
• Session identifiers and timestamps
• Error logs and system diagnostics

4. Legal Basis for Processing

5. Use of Data

We use your personal data to:

• Provide the MatchMaking Intelligence service and its features
• Facilitate partner discovery and collaboration opportunities
• Send confirmation emails and consent management links
• Improve and optimize the platform based on usage patterns
• Ensure security and prevent unauthorized access

6. Visibility of Registration Data — Two Tiers

Your registration data is exposed at two distinct levels of visibility, depending on who is viewing it:

6.1 Public Member Directory (visible to any signed-in user)

• Visible: contact person initials only (e.g. "M.F."), company name, health segment, organization type, ecosystem role, company size, city, country, company description, main challenge
• Never visible at this level: contact person full name, email, phone number, VAT number, internal notes

6.2 Pro Directory (visible to Premium subscribers only)

RehAllianCE offers a Premium tier for users who pay for full partner-discovery features. Premium subscribers, and RehAllianCE admin staff, may access a "Pro Directory" dashboard that includes the following additional fields:

• Contact person full name (first name + last name)
• Email address
• Phone number
• VAT number
• Recorded consent timestamps and audit metadata

Default = OFF. By default your profile is NOT shown in the Pro Directory. To be discoverable by Premium subscribers, you must explicitly enable this option in My Profile → Consents → "Pro Directory visibility". You can disable it at any time and your profile will be removed from the Pro Directory immediately.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract — the matchmaking service inherently involves making profiles discoverable to interested counterparts) combined with Art. 6(1)(f) (legitimate interest of RehAllianCE in offering a sustainable Premium service to its community), bounded by your right to opt out under Art. 21 GDPR at any time via My Profile → Consents.

Audit logging: every access by a Premium subscriber to a partner profile is logged (viewer ID, partner ID, timestamp, IP address) in our internal partner_view_log for accountability under Art. 30 GDPR (records of processing activities). This log is reviewed by RehAllianCE staff to detect abuse.

If you have any concern about being included in the Pro Directory, contact us at support@nsbmatchmaking.com.

7. Use of AI and External Processors

This service uses AI/LLM technology for:

• Query Analysis: Understanding natural language search prompts
• Partner Matching: Analyzing registered profiles and web search results
• Classification: Categorizing search results based on criteria

AI processing is performed using:

• OpenAI API (US-based, DPA in place)
• Google Gemini (US-based, DPA in place)

Important: Contact person fields (names, emails, phone numbers) are never sent to LLM providers. Only organization-level data is processed.

8. Data Retention

9. Data Sharing

We may share your data with:

• RehAllianCE consortium partners for collaboration facilitation
• Cloud service providers (Microsoft Azure) for hosting
• Email service providers (Resend) for transactional emails
• AI providers (OpenAI, Google) for intelligent features

All third parties are bound by Data Processing Agreements (DPAs) ensuring GDPR compliance.

10. International Transfers

Some data may be transferred to countries outside the European Economic Area (EEA), specifically the United States, for AI processing. These transfers are protected by:

• EU-US Data Privacy Framework certification
• Standard Contractual Clauses (SCCs)
• Additional technical and organizational safeguards

11. Your GDPR Rights

Under the GDPR, you have the following rights:

• Right of Access (Art. 15): Obtain a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate data
• Right to Erasure (Art. 17): Request deletion of your data
• Right to Restriction (Art. 18): Limit how we process your data
• Right to Portability (Art. 20): Receive your data in a machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests

12. How to Exercise Your Rights

To exercise any of your rights:

• Consent Management: Use the link in your confirmation email to manage consents
• Data Requests: Email m.ferramola@nsbproject.com with your request
• Account Deletion: Contact us to request complete removal of your data

We will respond to all requests within 30 days.

13. Cookies and Tracking

This application uses only essential technical cookies for:

• Session management and authentication
• CSRF protection

We do not use tracking cookies, advertising pixels, or analytics services that collect personal data.

14. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (TLS/HTTPS)
• Encrypted database storage (Azure SQL TDE)
• Access controls and authentication
• Regular security assessments
• Incident response procedures

15. Children's Privacy

This service is intended for business professionals and is not directed at children under 16. We do not knowingly collect personal data from children.

16. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via:

• Email notification to registered users
• Prominent notice on the platform

Continued use after changes indicates acceptance of the updated policy.

17. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

• Italian Data Protection Authority (Garante): www.garanteprivacy.it
• Or your local supervisory authority in any EU Member State

18. Contact Us

For any privacy-related questions, partner-matching inquiries, or to request Pro Directory access, contact NSBproject:

Email: m.ferramola@nsbproject.com
Subject line: "Privacy Inquiry — NSB Matchmaking Platform" (or "Pro Directory upgrade", "Partner introduction request" as relevant)

NSBproject S.r.l. acts as the operator of this matchmaking deployment within the RehAllianCE Interreg Central Europe consortium. We respond to all inquiries promptly and transparently.