Privacy Policy

This Policy describes the processing of personal data in connection with the Festina.ai platform, websites, user accounts, support services and Festina – Word Add-in. Offers acquired through Microsoft Marketplace are governed by the applicable Marketplace Order and the Standard Contract for Microsoft Marketplace. This Policy explains how personal data is processed and does not amend those contractual documents.

1. Who We Are and Scope of this Policy

Festina Technology d.o.o. za informatičke usluge ("Festina Technology", "Festina", "we", "us" or "our") provides the Festina.ai platform for AI-assisted legal analysis and related applications and services, including Festina – Word Add-in for Microsoft Word (the "Word Add-in").

This Privacy Policy applies to:

• the Festina.ai platform and application;
• Festina – Word Add-in;
• the festina.ai websites and related legal, registration, contact, subscription and support pages;
• user accounts, demonstrations, pilot projects, subscriptions and direct business relationships with Festina Technology;
• offers and subscriptions acquired through Microsoft Marketplace, to the extent Festina Technology processes personal data; and
• communications, customer and technical support, newsletters and other related business activities.

We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR"), applicable Croatian data protection laws and, where applicable, Regulation (EU) 2024/1689 on artificial intelligence (the "AI Act").

For an offer acquired through Microsoft Marketplace, the contractual relationship relating to the acquisition and use of that offer is governed by the applicable Marketplace Order and the Standard Contract for Microsoft Marketplace. This Policy is a privacy notice and does not replace or amend those contractual documents.

2. Our Roles in Processing Personal Data

2.1. Festina Technology as Controller

Festina Technology acts as a controller where it independently determines the purposes and means of processing, in particular when processing personal data relating to:

• website visitors;
• persons requesting a quote, demonstration or information;
• users who create and manage a user account;
• organisation administrators, contact persons and authorised users;
• Microsoft Marketplace users, to the extent Festina Technology receives data for activation, licensing and provision of the offer;
• persons who contact customer or technical support;
• newsletter recipients and marketing contacts; and
• suppliers, partners, candidates and other business contacts.

2.2. Festina Technology as Processor or Subprocessor

When a user or organisation uploads, stores, searches or analyses documents and other content containing personal data through Festina, the relevant user or organisation generally determines the purposes and legal basis for the processing, and Festina Technology acts as a processor. Where the user itself acts as a processor for another controller, Festina Technology may act as a subprocessor.

In that role, Festina Technology processes personal data:

• only on the documented instructions of the relevant user or organisation;
• to provide the contracted functionality and support;
• in accordance with the applicable DPA, the Standard Contract for Microsoft Marketplace where applicable, and other binding contractual documents; and
• subject to appropriate technical and organisational safeguards.

The user or organisation is responsible for the lawfulness of personal data processed through Festina, for providing required information to data subjects, determining the legal basis for processing and handling data subject requests. Festina Technology provides the assistance required under the applicable agreement and law.

3. Microsoft Marketplace and Festina – Word Add-in

3.1. Data Related to Microsoft Marketplace

If a user acquires, installs or uses the Word Add-in through Microsoft Marketplace, Microsoft may provide Festina Technology with limited data required to activate and manage the offer, depending on the configuration of the offer and user account. This may include:

• the name and business email address of the user or administrator;
• the name and identifier of the organisation or Microsoft tenant;
• a user account identifier;
• installation, licence, subscription or Marketplace Order status;
• country or region of purchase;
• offer, plan and transaction identifiers; and
• other limited data Microsoft makes available to the publisher for the purpose of providing the offer.

Microsoft separately processes data associated with Microsoft accounts, the Microsoft 365 environment, Microsoft Word, Entra ID and Microsoft Marketplace in accordance with its own terms and privacy notices. Festina Technology does not determine the purposes and means of such separate Microsoft processing.

3.2. How the Word Add-in Accesses Content

The Word Add-in may access and transmit document content to Festina only to the extent necessary for the function initiated by the user and in accordance with permissions granted to the Add-in. Depending on the selected function, processing may include:

• selected text or another portion of the document chosen by the user;
• a larger portion of, or the entire document, if the user initiates a function that requires it;
• user prompts, instructions and analysis parameters;
• results, drafts, summaries, translations, comparisons and other output data;
• the file name and limited document metadata where technically necessary for the selected function; and
• account, organisation, licence and session identifiers required for authentication and service delivery.

The Word Add-in does not publish User Content publicly or send it to other users without an appropriate user action or authorisation. Before using relevant functionality, the user is informed that selected content will be processed outside Microsoft Word for the purpose of providing the Festina service.

If a user does not want particular content to be processed through Festina, the user should not initiate a function that sends that content for processing. Before sending content, the user should verify applicable permissions, confidentiality obligations, professional secrecy and the legal basis for processing.

4. Personal Data We Process

4.1. Data You Provide Directly or We Receive from Your Organisation

• Identification data — name and surname, username, internal identifier
• Contact data — business or personal email address, telephone number, postal address
• Organisation data — organisation name, department, job title, role, tenant and permissions
• Account data — profile, account status, authentication identifiers, settings and permissions
• Contract and subscription data — offer, plan, licence, subscription, pilot, Marketplace Order and payment status
• Communications data — enquiries, support requests, feedback, requests and other communications
• Marketing data — consent, selected preferences and opt-out records

4.2. User Content

User Content may include documents, text, prompts, instructions, files, notes, case materials, contracts, submissions, legal sources, AI-generated results and other data entered, uploaded or submitted by a user or their organisation through the platform or Word Add-in.

Such content may contain personal data relating to clients, employees, opposing parties, witnesses, family members and other persons, including identification, financial, contractual, employment-related and other personal data. Depending on the document, it may include special categories of personal data or data relating to criminal convictions and offences.

4.3. Technical, Security and Usage Data

For authentication, operation, maintenance, diagnostics, security and usage measurement, we may process limited technical data, including:

• IP address and network data processed by the infrastructure;
• device type, operating system, browser and Microsoft Word version;
• Word Add-in version and installation or session identifier;
• access time and type of operation performed;
• internal request, user and organisation identifiers;
• status codes, request duration, performance and error data; and
• security and audit logs relating to access and changes.

We do not intentionally record the full content of documents, user prompts or AI outputs in diagnostic logs, except where limited content is necessary to resolve a specific support request and the user knowingly provides it.

4.4. Support Data

Support Data includes information a user submits to report an issue, obtain technical assistance or verify functionality, including descriptions of the issue, screenshots, files, diagnostic data and communications. We use such data internally to provide support and do not use it for unrelated purposes without an appropriate agreement or legal basis, except where processing is necessary for security, abuse prevention or compliance with legal obligations.

4.5. Cookies and Similar Technologies

On our websites and web-based parts of the platform, we may use strictly necessary cookies and similar technologies for sign-in, security, session management and core functionality. We use analytics, functional or marketing cookies only where we have an appropriate legal basis, including consent where required. Further information is provided in our Cookie Policy.

5. Purposes and Legal Bases for Processing

• Provision of the platform, Word Add-in and contracted functionality — performance of a contract or steps taken at the request of the data subject prior to entering into a contract; where we act as processor, the documented instructions of the user or organisation
• Creating and managing user accounts — performance of a contract; legitimate interest in secure account administration
• Activation and management of the Marketplace offer, licence and subscription — performance of the contract and Marketplace Order; legitimate interest in managing the offer
• Authentication, access control and permissions management — performance of a contract and legitimate interest in protecting systems and data
• Processing documents, prompts and AI outputs — performance of a contract; where we act as processor, the controller determines the legal basis
• Customer and technical support — performance of a contract or legitimate interest in responding to enquiries and resolving issues
• Security, abuse prevention and incident management — legitimate interest in protecting the service, users and business; legal obligation where applicable
• Diagnostics and reliability improvement — legitimate interest, with data minimisation and use of aggregated or anonymised data where possible
• Newsletter and marketing — consent or legitimate interest where such processing is permitted by applicable law
• Accounting, tax and business records — compliance with legal obligations
• Establishment, exercise or defence of legal claims — legitimate interest and applicable law

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6. Artificial Intelligence and Automated Processing

Festina uses artificial intelligence systems to analyse, structure, summarise, search, compare, translate and generate content based on user prompts and documents.

• AI-powered features are clearly identified as such.
• AI outputs may be inaccurate, incomplete, outdated or contain incorrect statements or legal sources.
• Festina does not make autonomous legal decisions and is not a substitute for legal, tax, financial or other professional advice.
• The user is responsible for professional review of facts, citations, sources, conclusions and final decisions.
• Festina Technology does not use User Content, and does not permit its subprocessors to use User Content, to train or fine-tune general-purpose, shared or publicly available AI models without the prior express written consent of the relevant user or organisation.
• Anonymised or aggregated technical data that does not contain User Content and does not permit identification of an individual or organisation may be used for security, statistics, performance measurement and service improvement.
• Festina Technology does not carry out automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR.

7. How We Share Personal Data

We do not sell personal data.

7.1. Microsoft

Microsoft may have different roles depending on the relevant processing activity:

• as an independent controller for Microsoft accounts, Microsoft 365, Microsoft Word, Entra ID, Microsoft Marketplace, billing and other Microsoft services;
• as the provider of Marketplace infrastructure that provides Festina Technology with data required for offer activation, licensing and management; and
• as a processor or subprocessor of Festina Technology where contracted Microsoft Azure or other business services are used to provide Festina.

Microsoft's separate processing is governed by Microsoft's terms and privacy notices. Processing carried out by Microsoft on behalf of Festina Technology is governed by applicable data processing agreements and security obligations.

7.2. Subprocessors and Other Service Providers

We may use providers of infrastructure, hosting, storage, AI processing, vector storage, authentication, communications, diagnostics, security, customer support and business tools that process data on our behalf and are subject to contractual confidentiality, security and data protection obligations.

The current list of specific subprocessors is published in the DPA available at: https://festina.ai/dpa/.

For users of offers acquired through Microsoft Marketplace, we provide at least 14 days' advance notice of new subprocessors that will have access to personal data, in accordance with the Standard Contract for Microsoft Marketplace. Users' rights to object are governed by that contract and the applicable DPA.

7.3. Other Recipients

We may also make personal data available to:

• competent authorities where required by law or a lawful and binding request;
• lawyers, auditors, accountants, insurers and other professional advisers subject to confidentiality obligations;
• affiliated companies where there is an appropriate legal basis and business need;
• a potential acquirer, investor or other party in connection with a corporate transaction, investment or transfer of business, subject to appropriate safeguards; and
• other persons where the user expressly requests or authorises such sharing.

8. International Transfers of Personal Data

We seek to organise our primary infrastructure and processing within the European Economic Area (EEA). Certain services or support activities may involve processing in other countries depending on the contracted configuration and provider.

Where personal data is transferred outside the EEA, we use an appropriate transfer mechanism, such as:

• an adequacy decision of the European Commission;
• the European Commission Standard Contractual Clauses under Implementing Decision (EU) 2021/914;
• the EU–US Data Privacy Framework where applicable; or
• another safeguard or derogation permitted by the GDPR.

Where required, we conduct transfer impact assessments and apply supplementary technical, contractual or organisational safeguards. For processing covered by the Standard Contract for Microsoft Marketplace and the DPA, relevant Standard Contractual Clauses and transfer information are available through the DPA at https://festina.ai/dpa/.

9. Security of Personal Data

We implement technical and organisational measures appropriate to the nature of the data, scope of processing and assessed risks, including:

• encryption of data in transit using TLS 1.2 or later;
• encryption of data at rest within the contracted infrastructure;
• role- and permission-based access controls;
• multi-factor authentication where applicable;
• logical separation of data belonging to different organisations;
• logging and monitoring of security-relevant events;
• backups, business continuity and recovery procedures;
• vulnerability, update and security patch management;
• periodic access-right reviews and security controls;
• contractual confidentiality obligations and security training for persons with access to personal data; and
• security incident and personal data breach management procedures.

No information system is absolutely secure. If a personal data breach occurs, we will comply with applicable notification obligations to the competent supervisory authority, the relevant user or organisation, and data subjects, depending on our role and the assessed risk.

10. Retention Periods

• User Content, documents and AI outputs — for the duration of the contractual relationship and up to 30 days after termination for export or migration, unless otherwise agreed or an authorised person requests earlier deletion
• Deactivated account and profile data — deletion or anonymisation generally within 30 days, except for data we are required to retain longer
• Marketplace and subscription data — for the duration of the subscription and thereafter for as long as necessary to meet contractual, accounting, tax and legal obligations
• Diagnostic logs — generally 30 to 90 days, depending on the system and security requirements
• Security and audit logs — generally up to 12 months, and longer where necessary for an incident investigation or legal obligation
• Support Data — for the duration of the support request and thereafter in accordance with legitimate business needs and applicable limitation periods
• Marketing data — until consent is withdrawn, the user opts out or a valid objection is made, subject to retaining a minimal suppression record
• Business, contractual, tax and accounting data — for the duration of the business relationship and at least 11 years after the end of the year to which the records relate, or longer where required by law or legal proceedings

At the end of the applicable retention period, we delete, anonymise or remove personal data from active systems. Data may remain for a limited period in protected backups until routine overwrite or deletion, without being used for unrelated purposes.

11. Your Rights

• Access — the right to obtain confirmation as to whether we process your data, information about the processing and a copy of the data
• Rectification — the right to request correction of inaccurate data and completion of incomplete data
• Erasure — the right to request erasure where the conditions under the GDPR are met
• Restriction of processing — the right to request temporary restriction of the use of data in the circumstances provided by law
• Data portability — the right to receive data in a structured, commonly used and machine-readable format where the legal conditions are met
• Objection — the right to object to processing based on legitimate interests
• Direct marketing — the right to object at any time to processing for direct marketing
• Withdrawal of consent — the right to withdraw consent without affecting the lawfulness of processing carried out before withdrawal
• Automated decision-making — the rights under Article 22 GDPR where the conditions for their application are met

You may submit a request to privacy@festina.ai or privacy@festina.ai, or by post to the address set out in Section 16. To protect your data, we may request additional information necessary to verify your identity.

We respond to requests without undue delay and no later than one month after receipt. This period may be extended by up to two additional months where necessary due to the complexity or number of requests, provided the data subject is informed in a timely manner.

If your request concerns personal data processed by your organisation through Festina, please direct the request to that organisation in the first instance. Festina Technology, acting as processor, will provide the required assistance in accordance with the organisation's instructions.

Complaint to a Supervisory Authority

If you believe that your personal data is being processed in breach of applicable law, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, azop@azop.hr, www.azop.hr. You may also contact us first so that we can try to clarify and resolve the issue.

12. Personal Data of Other Persons and Customer Data

If you submit personal data relating to other persons through Festina or the Word Add-in, you are responsible for ensuring an appropriate legal basis and complying with applicable transparency obligations, unless an exception is permitted by law.

Users and organisations are specifically responsible for:

• the lawfulness of personal data contained in documents and prompts;
• compliance with professional secrecy, confidentiality and third-party rights;
• selecting appropriate user permissions and access rights;
• assessing whether a particular document or data item may be submitted for AI processing; and
• handling data subject requests where they act as controllers.

13. Minors

Festina and the Word Add-in are not intended for persons under 18 years of age as independent users. We do not knowingly collect personal data from minors for the purpose of creating an independent account. Personal data relating to minors may appear in legal or business documents processed by a user, in which case the relevant user or organisation determines the legal basis and purpose of such processing.

14. External Services and Links

Our websites, platform and Word Add-in may contain links to or integrations with third-party services. Their separate processing of personal data is governed by their own terms and privacy policies. This applies in particular to Microsoft services used independently of Festina.

15. Changes to this Policy

We may update this Policy from time to time to reflect changes to the Services, Word Add-in, Microsoft Marketplace offer, technology, processing activities or applicable law. The updated version will be published with the applicable version number and effective date.

We may notify users of material changes by email, through a notice in the platform or Word Add-in, via Microsoft Marketplace, or by another appropriate means. Where consent is required for a new processing activity, we will request it before the processing begins; continued use alone will not constitute consent where the law requires express consent.