Privacy notice regarding the processing of personal data - Velvet models
Almawave S.p.A. (“Almawave” or the “Controller”) develops artificial intelligence models for natural language processing belonging to the Velvet family.
This notice describes the processing of personal data related to the development and training of such models.
The Velvet models are also trained on data from publicly available sources or third parties. In such cases, Almawave is generally unable to identify or contact individual data subjects; therefore, where the individual provision of this notice proves impossible or would involve a disproportionate effort, this notice is made publicly available on the Controller’s website, pursuant to Article 14(5)(b) GDPR.
1. The Velvet models
The Velvet family includes language models with several configurations, including:
- Velvet 14B: a 14-billion parameter large language model, designed for complex analyses and advanced application contexts;
- Velvet 2B: a compact model, optimized for resource-constrained environments and deployments on lightweight infrastructures.
The models share the same training methods, the same categories of data used, and similar purposes and operating logics.
Their differences concern only technical aspects (size, performance, context of use) and do not affect how personal data are processed.
2. Data Controller
The Data Controller is: Almawave S.p.A.
Data Protection Officer (DPO): DPO.GruppoAlmaviva@almaviva.it.
3. Purposes of data processing
Personal data are processed in connection with the development and operation of the Velvet models to:
- train and optimize language models;
- develop natural language processing capabilities, including:
- automatic text synthesis;
- information extraction;
- generation of responses also through integration with external sources (RAG);
- rephrasing and paraphrasing;
- classification and semantic analysis;
- machine translation;
- question answering systems;
- text completion and multi-turn conversation management;
- ability to make inferences about text content.
4. Type of data processed
In the context described above, the following data may be processed:
- common personal data (e.g. identification data included in texts);
- browsing data and publicly available content;
- data included in the datasets used for training;
- to a limited extent, special categories of personal data, if expressly made public by the relevant data subjects.
Processing mainly involves textual data and is not aimed at intentionally collecting personal data.
5. Data origin
Personal data may come from:
publicly accessible sources (licensed third-party datasets).
6. Legal basis
Data processing is based on:
- Article 6(1)(f) GDPR – the legitimate interest of the Controller in the development and improvement of artificial intelligence models; disclosed“
- Article 9(2)(e) GDPR – for any data belonging to special categories that are manifestly made public.
7. Methods of data processing
Data are processed using electronic and automated tools, including operations such as:
- data collection, recording and organization;
- storage, modification, consultation and retrieval.
Personal data are not publicly disclosed.
8. Scope of data processing and third-party use
This notice applies exclusively to the processing of personal data carried out by Almawave in connection with the development, training, and provision of the Velvet family of models.
Once the model is made available, its use falls within the responsibility of the person implementing and using it. As a rule, Almawave does not determine the purposes or methods of any processing operations carried out by users and is not the Controller in relation to such operations.
Users of the model are required to verify that their processing operations comply with applicable laws on the protection of personal data.
9. Data storage
Personal data are stored for:
- up to 2 years in case of raw data;
- up to 5 years in case of data processed or used in training processes.
10. Data recipients
Data may be processed by:
- authorized internal personnel (employees and collaborators);
- providers of technological and infrastructure services.
11. Transfers outside the EU
Personal data are not transferred to non-EU countries.
12. Security measures
Almawave takes appropriate technical and organizational measures, including the following:
Organizational measures
- definition of roles and responsibilities (including the DPO);
- internal policies and staff training;
- need-to-know access management;
- incident and data breach management procedures;
- supplier control.
Technical measures
- encryption of data at rest and in transit;
- multi-factor authentication (MFA);
- backup and disaster recovery systems;
- continuous logging and monitoring;
- endpoint protection;
- separation between development, test and production environments with data anonymization.
13. Rights of data subjects
Data subjects may exercise the rights laid down in Articles 15–22 GDPR.
If the Controller is unable to identify the data subject in the processed data, it may not be possible to process the former’s request.
In any case, the data subject may lodge a complaint with the Italian Data Protection Authority.
14. Nature of data processing and limits of the models
The Velvet models are statistical systems that:
- learn linguistic patterns from training data;
- are not designed to identify specific individuals;
- do not intentionally store personal information.
However, content may be occasionally generated that can be traced back to the data used during training.
Almawave takes measures to reduce these risks, including dataset controls and mitigation techniques.
15. Third-party use
If the Velvet models are incorporated into solutions developed by third parties, the processing of personal data within such solutions is regulated by the privacy policies of their respective controllers.
16. Updates
This notice may be updated to take account of any regulatory or technological developments.