Skip links

Information on the processing of personal data Velvet Models

pursuant to art. 14, par. 5, letter b), GDPR

Introduction

Almawave Labs S.r.l. (hereinafter the “Controller“) develops artificial intelligence models for natural language processing belonging to the Velvet family.

The models of the Velvet family are artificial intelligence systems based on statistical and machine learning techniques that learn correlations and linguistic patterns from the data used in training activities.

The Velvet family includes several artificial intelligence models that can support features such as text generation and understanding, information extraction, machine translation, information classification, question answering, retrieval augmented generation (RAG), speech processing, and speech transcription. 

Each model is distinguished by technical, functional and application aspects (such as size, performance, specialized skills and type of inputs processed), but these aspects do not affect the general principles of personal data protection that the Data Controller adopts to design and develop them.

For the training of the models, the Data Controller does not collect personal data directly from the data subjects but only uses information acquired from third parties legitimately authorized to make them available, distribute or reuse, in accordance with the applicable legislation and the related license conditions, which, in some cases, may also contain personal data.

Although the Velvet family models are not designed to store or reproduce personal information and measures are taken to reduce this risk, it cannot be absolutely excluded that, in exceptional circumstances, content may be generated that can be traced back to information present in the data used during development. In such cases, the Data Controller makes dedicated channels available to data subjects for reporting and managing the related requests.

Taking into account the nature of the sources used and the difficulty or impossibility of providing individual information to all data subjects without disproportionate effort, the Data Controller makes this information available on its website as a transparency measure pursuant to art. 14, par. 5, letter b), GDPR.

This information concerns the processing of personal data carried out by the Data Controller as part of the development and training activities of the Velvet family models. Therefore, any use of the models by third parties, including their integration into applications, platforms or services, involves autonomous processing of personal data, governed by the information and privacy policies of the respective operators.

1. Data Controller

The Data Controller is Almawave Labs S.r.l. with registered office in Via di Casal Boccone 188-190, 00137 Rome.  The Data Controller can be reached by contacting the e-mail address servizioprivacy@almaviva.it.

2. Data Protection Officer

The Data Protection Officer (“DPO”) can be contacted at the e-mail address DPO.GruppoAlmaviva@almaviva.it

3. Data processed, purposes and legal basis of the processing

The data used as part of the development activities of the Velvet family models come from datasets and sources that can be legitimately used for the purposes of research, development and training of artificial intelligence systems. Such sources include, but are not limited to, academic and scientific publications, books and editorial publications, documents and information from institutional or governmental sources, encyclopedic texts, legal documentation, collections of content, and third-party datasets distributed under licenses compatible with these purposes.

The sources and datasets used may occasionally contain personal data relating to natural persons, such as:

  • identification data (e.g. name and surname);
  • contact information that may be contained in the original content;
  • contextual information contained in the texts, such as roles, qualifications or assignments;
  • in residual cases, special categories of personal data and judicial data that may be contained in the sources of origin and, where applicable, manifestly made public by the data subjects.

Any personal data present in the datasets are processed exclusively as part of the data selection, collection, verification, organization, filtering, minimization and transformation activities (jointly, the “data curation activities“) necessary for the preparation of the datasets used for the development of the models.

As part of data curation activities, datasets are previously subjected to technical and organisational procedures aimed at identifying and, as the case may be, anonymizing, pseudonymizing or removing any personal data that may be present. If it is not possible to adequately reduce the risk of identification without compromising the content of the data, the relevant portions of the content are excluded from the datasets intended for training.

The training of the Velvet family models takes place exclusively on the datasets resulting from the data curation activities described above and is not aimed at identifying natural persons or at learning, storing or reproducing personal information referable to identified or identifiable subjects.

The purpose of the processing is the development, training, validation, improvement and evaluation of artificial intelligence models belonging to the Velvet family, intended to support functionalities such as natural language understanding and generation, information extraction, content classification, machine translation, question answering systems, retrieval augmented generation (RAG),  as well as, for specialized models, speech processing and speech transcription.

The legal basis for the processing of any personal data present in the datasets is the legitimate interest of the Data Controller pursuant to art. 6, par. 1, letter f), GDPR, consisting in the development and improvement of artificial intelligence models through the use of appropriately selected datasets subjected to measures of minimization, filtering and reduction of the risk of identification. The Data Controller has assessed this interest taking into account the nature of the sources used, the reasonable expectations of the data subjects and the measures taken to minimise the impact of the processing on the fundamental rights and freedoms of the data subjects. If the datasets contain data belonging to special categories pursuant to art. 9 GDPR, the relevant processing takes place exclusively in the cases permitted by the applicable legislation and, in particular, on the basis of art. 9, par. 2, letter e) GDPR, where such data have clearly been made public by the data subject.

4. Data retention

At the end of the data curation activities, the data is anonymized or removed. In any case, the raw datasets are kept for a period not exceeding 2 years and the processed datasets for a period not exceeding 5 years.

5. Recipients of the data

As part of the activities described in this policy, personal data may only be processed by authorised parties or suppliers who support the Data Controller in carrying out the development and training activities of the Velvet family models.

In particular, the data can be accessed at:

  • personnel specifically authorised to process the data, including employees and collaborators who work in the field of development, research, dataset management and technical support activities;
  • providers of technological, infrastructural, cloud, hosting, data processing and IT support services, appointed, where required by applicable legislation, Data Processors pursuant to art. 28 GDPR;
  • other subjects whose knowledge of the data is necessary for purposes strictly related to the activities described in this information or to comply with legal obligations.

6. Transfers outside the EU

The transfer of personal data to non-EU countries is not envisaged.  If, for needs related to the development and training of the models of the Velvet family, it is necessary to make transfers to third countries, such transfers will be carried out in compliance with the applicable legislation on the protection of personal data and, where required, on the basis of an adequacy decision of the European Commission or through the adoption of the additional guarantees provided for by articles 44 et seq. of the GDPR.

7. Rights of the data subjects

Data subjects may exercise, in the cases provided for by applicable legislation, the rights recognized by Articles 15-22 of the GDPR.

Requests can be addressed to the Data Controller at the e-mail address servizioprivacy@almaviva.it.

It should be noted that the processing described in this policy concerns large datasets from publicly accessible sources or from third parties and that, as described in this policy, the Data Controller adopts anonymization, pseudonymization, minimization and removal measures of personal data as part of data curation activities.

In accordance with art. 11 GDPR, the Data Controller is not required to store, acquire or process further information for the sole purpose of identifying data subjects in the context of the processing described in this policy. Therefore, if the Data Controller is not able to identify the data subject on the basis of the available information or the personal data have been irreversibly anonymized, it may not be possible to follow, in whole or in part, the requests to exercise the rights.

If a data subject believes that personal data concerning him or her has been processed as part of the activities described in this policy, he or she may contact the Data Controller and provide further elements suitable for identifying him or her for the purposes of managing the request. Upon receipt of such information, the Data Controller will evaluate the request and provide feedback within the limits and in the manner provided for by applicable legislation.

In any case, the right to lodge a complaint with the Data Protection Authority remains.

8. Updates

This policy may be updated to reflect regulatory or technological developments. Any changes will be posted on this page.

Last updated on: 14/09/2026