Artificial intelligence and data processing addendum

1. Subject matter and scope

This addendum applies to every processing of personal data that Toroidal Winding di Antonio Perin carries out on behalf of a customer in the course of supplying windings, and to every use of artificial intelligence systems touching customer data or technical documents.

Where this addendum and the main contract conflict, this addendum prevails for the matters covered here.

2. Definitions

• AI system: automated system as defined in article 3.1 of Regulation EU 2024 1689.
• Provider and deployer: the roles defined in article 3 of the same Regulation. In relation to the general purpose models we use, we act as deployer and never as provider.
• Controller and processor: the roles defined in article 4 of Regulation EU 2016 679.
• Customer data: drawings, specifications, test data, contact records and any other information the customer sends us.

3. Roles of the parties

For the data of its own staff and contacts that it sends us, the customer acts as controller and we act as processor. For data we collect on our own account, such as commercial contacts, we act as an independent controller under the privacy policy.

We process customer data only on documented instructions. The purchase order, the technical specification and this addendum constitute those instructions. If an instruction appears to us to infringe applicable law we say so in writing before carrying it out.

4. How we use artificial intelligence systems

We use generative AI tools for a limited set of internal activities, listed here in full.

• Drafting and reviewing commercial text and internal technical documentation.
• Translating correspondence and data sheets.
• Summarising long technical requests in order to prepare a quotation.
• Assisting a calculation, always checked by hand before it is used.

No decision concerning a person, a supply or the outcome of a test is taken by an automated system. The final check is always human and rests with the owner of the workshop.

5. Limits we impose on ourselves

• We do not put drawings, confidential specifications, price lists or customer personal data into a public AI system without specific written authorisation.
• We authorise no supplier to use customer data to train, retrain or improve models. Where the service allows it, the training option is switched off.
• We use no systems falling under the prohibited practices in article 5 of Regulation EU 2024 1689.
• We do not use AI systems to screen or evaluate people.
• We do not generate content that could be mistaken for a certificate, a test report or a declaration of conformity. Those documents are written and signed by a person.

6. Sub processors

We use the sub processors listed in the privacy policy. Authorisation is general under article 28.2 of the Regulation: we give written notice of every addition or replacement at least thirty days in advance and the customer may object on reasoned grounds within that period.

Every sub processor is contractually bound to obligations no less strict than those taken on here, including the ban on training with customer data.

7. International transfers

Where a supplier processes data outside the European Economic Area, the transfer relies on an adequacy decision or on the standard contractual clauses in Commission implementing decision 2021 914, supplemented by whatever additional measures the case assessment shows to be necessary.

8. Security measures

We apply the technical and organisational measures required by article 32 of the Regulation, proportionate to the size of the workshop and to the risk:

• Encrypted transmission of everything passing through the site and email.
• Multi factor authentication on accounts holding customer data.
• Access to drawings limited to the people who have to build the part.
• Regular backups with restore verification.
• Secure erasure of decommissioned media.

9. Transparency and human oversight

Where a text intended for the customer was produced with a material contribution from an AI system and the context could mislead, we say so, in line with article 50 of Regulation EU 2024 1689.

The people using these tools in the workshop know the limits set out in point 5. Every output touching a calculation, a tolerance or a test is checked before it leaves.

10. Assistance to the customer as controller

On request and within reason we assist the customer with:

• Responding to data subject requests, within five working days of being notified.
• Data protection impact assessments and prior consultation.
• Breach notification: we inform the customer without undue delay and in any case within 48 hours of becoming aware, with the information in article 33.3.
• Demonstrating compliance, by making the necessary information available.

11. Audits

The customer may carry out one audit per year, on at least fifteen working days notice, directly or through a non competing auditor bound by confidentiality. Audits take place during working hours and without interrupting production.

12. Return and deletion

At the end of the relationship, at the customer choice, we return or delete the personal data processed on their behalf within sixty days, except where the law requires retention. Batch technical documentation stays archived for traceability for at least five years, held separately and accessible only on request.

13. Term, applicable law and contact

This addendum stays in force for the whole supply relationship and, for the obligations that say so, beyond it. Italian law applies. For jurisdiction see the legal notice.

For questions on this addendum write to info@toroidalwinding.it. On request we provide a signed copy on letterhead.

Annex A. Processing details