MATERIA and PATCHWORK Privacy Policy

Last updated: 12 October 2026

MATERIAINTEL S.R.L. uses personal data to provide its websites, PATCHWORK, and professional intelligence services. This policy explains how we handle the data connected with your account and use of those services, and how you can exercise your rights.

It covers materiaintel.com, materiainsight.com, MATERIA Insight, and the PATCHWORK application and report pages we provide through website links or direct access. The same privacy principles apply across the Free, Open, and Premium access levels and other agreed customer-facing versions. If an organization provides a service under its own privacy notice, that notice explains its responsibilities and our role in that arrangement.

PATCHWORK presents commodity and CBAM analysis through interactive reports and application views. The available pages and controls depend on your edition, account access, and agreed service. Registering, receiving paid access, or moving between report versions does not by itself authorize a new use of your personal data.

Who is responsible for your data

MATERIAINTEL S.R.L., trading as MATERIA, is the controller for the personal data we use for our own purposes described here. Our registered office is Via Pietro Mascagni 130, 00199 Rome, Italy. Our VAT number is 17965801008.

You can contact our Data Protection Officer (DPO) at dpo@materiaintel.com, or write to our registered office, marked for the DPO. Use these details for privacy questions, requests about your data, and concerns about information shown in PATCHWORK.

When we process personal data solely on a business customer's instructions, our role is different. The section on customer content explains that distinction.

Data you provide

When you register or receive access, we use your name and business email address to identify your account. Company details help us administer the professional relationship, while account identifiers and access information determine which version you can use. Sign-in also involves the credentials or identity information needed to authenticate you.

When you contact us, request a demonstration, subscribe to MATERIA Insight, or join a waitlist, we receive the contact details and message you submit. We collect a telephone number where you provide it, and record your subscription choice and associated consent or withdrawal.

For a paid engagement, we use the professional contact and billing details needed to manage the relationship. These can include the invoicing address and tax information, together with payment status. If you provide business documents or support material, we receive any personal data contained in that material.

Data collected through use of our services

A visit creates technical information needed to deliver the website or report. This can include an IP address and browser information, together with the time of a request and whether it succeeded. These records can arise in the Free version even when you have not registered.

Your filters and scenario settings are processed to display the analysis you request. Where interaction tracking is active, we also record report navigation and interactions, including selections made within a report.

For signed-in users, recorded interactions can be associated with an account identifier. Such records remain personal data even if they contain no name or email address. We use them within the service, security, and analytics purposes explained below, with consent where required.

Data received from other sources

Your organization or an authorized colleague can provide your professional contact details when arranging access or managing a subscription. Suppliers and market participants can provide business contact information in the material they share with MATERIA.

For our intelligence activities, we use licensed datasets and public sources, including company disclosures and industrial or official databases. Those sources primarily describe companies and facilities, but some records can identify an individual owner, a sole trader, or a professional contact. In that case, the relevant personal data can include the person's name, professional role or contact details, and connection to the business or facility. Public availability does not remove the protection that applies to personal data.

We use relevant professional information from those sources to provide our intelligence services. Our legal basis is our legitimate interest in providing those services. We assess the person's reasonable expectations and the effect of disclosure, and exclude private contact details that the service does not need. Source permissions do not replace that assessment.

Where we obtain your personal data indirectly, we provide the required information within the applicable period, normally within one month and earlier if we first contact you or disclose it to another recipient. We rely on an exception to individual notification only where the law permits it and the required safeguards apply. You can ask the DPO about the source of data concerning you.

Providing access and responding to requests

We use account details and sign-in information to register you and provide the appropriate report or application access. Your organization's entitlement can determine which views and outputs are available. Separately configured customer reports follow the access arrangement agreed for that organization.

We process your analytical selections to deliver the requested view. Where you contract with us personally, necessary processing rests on performance of that contract or steps you ask us to take before entering it. Where you act for a company or institution, we rely on our legitimate interest in delivering and administering that organization's service.

We use your contact details and message to answer an inquiry or arrange a requested demonstration. Necessary steps towards a contract with you use the contractual basis; other professional correspondence rests on our legitimate interest in responding to the person who contacted us. A request for information does not automatically subscribe you to promotional messages.

Security and protection against misuse

We use access and usage records to detect unauthorized access and investigate misuse, including unauthorized extraction of platform content. This serves our legitimate interests in protecting the service, licensed content, and other users, and in enforcing the applicable terms.

The information used for these checks is limited to what is necessary for the suspected activity. Monitoring does not authorize unrestricted tracking of a person's browsing outside our services. Where a device-based technique requires consent, its use remains subject to the cookie rules below.

Security checks can restrict access where necessary to protect the service. You can contact the DPO to request human review if you believe a restriction based on your activity is incorrect. We do not use personal data to make decisions about you solely through automated processing that produce legal effects or similarly significant effects.

Usage analysis and service development

We analyze visits and report interactions to understand service use and improve our content and navigation. Optional tracking that requires consent operates on that consent.

Limited operational measurements that do not require device-tracking consent rest on our legitimate interest in maintaining and improving the service, where the processing is necessary and proportionate. We use aggregate results where individual identification is unnecessary. Linking selected report values to an account identifier remains identifiable usage analysis and requires the applicable legal basis.

Newsletters and product updates

We use consent for newsletter subscriptions, waitlist updates, and other optional promotional messages. Joining a waitlist authorizes the updates you request about that waitlist; a separate marketing choice governs broader promotional communications.

You can withdraw consent through the unsubscribe option in a message or by contacting the DPO. Withdrawing marketing consent does not prevent essential account, security, or contractual communications. Merely reading or acknowledging this policy, accepting the Terms and Conditions, or continuing to use PATCHWORK does not give consent to optional marketing or tracking.

Business records and legal obligations

We process invoicing and related records to comply with applicable accounting and tax obligations. We also process the information needed to respond to legally binding requests and fulfill our data-protection duties, including requests to exercise your rights.

Where necessary, we retain and use relevant evidence to establish, exercise, or defend legal claims. This rests on our legitimate interest in protecting our rights, or on a legal obligation where one applies. We assess whether each use based on legitimate interests is necessary and whether your rights or interests outweigh it.

Customer content and confidential submissions

Where a customer provides personal data for processing solely on its instructions, the customer determines the purpose and we act as its processor. If the customer itself acts for another controller, we can act as a subprocessor under the agreed arrangement. A data-processing agreement governs those operations, including protection of the data, assistance with rights requests, and return or deletion of the content.

The customer is responsible for having a lawful basis to provide that data and for informing the individuals concerned. Consent is required only where it is the applicable legal basis. Our own obligations as processor continue to apply. A person whose data is in that customer's content should normally direct a rights request to the customer; if the request reaches us, we assist the responsible controller in accordance with the agreement and applicable law.

Private customer submissions do not automatically become part of MATERIA's shared intelligence content. Data supplied for inclusion in that content are handled under the specific sharing terms. Where MATERIA determines its own purpose for personal data in those submissions, we act as controller and provide the required information for that use.

Information about a business or facility is personal data where it relates to an identifiable person. Confidentiality and source-license restrictions can apply to business information even where it is not personal data. This policy does not grant permission to republish a confidential submission or extend rights under a source licence or NDA.

Your analytical inputs and report choices

Your analytical selections and scenario inputs are used to produce the views and results you request. A report's reset or navigation controls change the analytical view; they do not erase account or usage records already collected. To request deletion of personal data, use the rights procedure below.

We do not send customer data to external AI providers or use customer data to train AI models. Private customer information is used only for the agreed purpose and the lawful processing described in this policy.

Who receives personal data

Authorized MATERIA personnel and contractors receive access where their work requires it and under applicable confidentiality obligations. Providers helping us deliver website access and interactive reports receive the data needed for those services. Providers supporting customer communications or billing receive information needed for those tasks. Analytics and security providers receive data within the purposes and choices described above.

Interactive report delivery can involve processing your report selections and scenario settings, together with technical information needed to display the result. Where a provider acts on our behalf, we require a data-processing agreement and instructions limiting its use of the data. A bank, professional adviser, or authority can instead act as a separate controller for the purposes required by its role.

Your organization's authorized subscription contacts can receive the account and usage information needed to administer its access and billing. Where necessary professional information about an individual forms part of a lawful intelligence record, it can be shown to authorized recipients within the permitted purpose. This does not make private customer submissions available to other customers.

We do not sell or rent your personal data. Disclosure to an authority occurs where legally required, and disclosure to an adviser is limited to the relevant legal or professional matter. If a business transaction requires disclosure to a prospective buyer or successor, we limit it to what is necessary and apply confidentiality and data-protection safeguards.

Transfers outside the European Economic Area

A provider's processing or remote access can involve a country outside the European Economic Area (EEA). Where a transfer occurs, we use an applicable European Commission adequacy decision or appropriate safeguards, such as the Commission's Standard Contractual Clauses. Where those clauses are used, we assess the destination's laws and practices and apply additional measures where necessary.

You can ask the DPO which recipients and countries are relevant to your data and request information about, or a copy of, the applicable safeguards. We can redact information that needs protection without preventing you from understanding the safeguards. For data processed on a customer's behalf, transfers must also comply with that customer's documented instructions and the data-processing agreement.

How long we keep personal data

We keep personal data for the purpose that requires it and remove it when that purpose ends. Where a valid erasure request applies, we delete the affected personal data within 30 days unless applicable law requires or permits continued retention of specific records. We explain any such exception and retain only the information needed for it.

Accounts and customer content. We keep ordinary account details while the account is active and delete or anonymize them within 30 days after closure, apart from the specific legal records described below. For content processed on a customer's behalf, documented instructions and the agreement govern return or deletion; unless a different lawful period is agreed, we complete it within 30 days after the relevant service ends. Closing one user's account does not delete content that the organization lawfully retains for its continuing users.

Inquiries and subscriptions. We keep ordinary inquiry, demonstration, and support correspondence for up to 24 months after the last substantive interaction or resolution, unless it forms part of a continuing contract or a necessary legal record. We remove you from an active waitlist or marketing list when you withdraw consent and delete unnecessary contact-profile data within 30 days. Waitlist data are otherwise deleted when the waitlist ends or after 24 months without substantive interaction. Marketing contact data are kept for up to 24 months from consent or express renewal; opening a message alone does not restart that period.

Technical and analytics records. Routine access and security logs are kept for up to 90 days. Identifiable data used only for optional usage analytics are deleted or anonymized within 12 months of collection. Evidence isolated for a specific security or misuse investigation is kept for up to 24 months after the investigation closes, unless a legal claim requires a different period. Irreversibly anonymous statistics can be retained because they no longer identify an individual.

Professional source information. We keep personal data associated with a supplier or facility only while they remain relevant to the intelligence or business relationship for which they were obtained. We review that relevance at least annually, correct outdated details, and remove unnecessary personal information. Evidence needed to establish a source permission or defend a specific claim is retained separately for that purpose.

Legal records and preferences. Accounting and invoicing records are normally kept for ten years from the relevant final accounting entry, and longer where a specific obligation requires it. Necessary contractual or dispute evidence is retained for the applicable claim period. We retain consent evidence while relying on it and, where necessary to demonstrate compliance, for up to five years after its last use. A minimal objection or unsubscribe record is retained while needed to prevent renewed contact, with annual review. Rights-request correspondence is normally retained for three years after closure.

Retained copies. The 30-day deletion commitment also applies to copies of the affected personal data. We remove them or make them permanently unrecoverable within that period unless a specific lawful preservation requirement applies. Copies awaiting removal are not used for ordinary business purposes, and retained copies do not extend the deadline for an applicable erasure request.

Cookies and similar technologies

Necessary session, authentication, and security technologies support the service you request. We use them without optional tracking consent only where the applicable exemption permits it. Browser settings can block cookies, but blocking a necessary session cookie can prevent sign-in or interrupt a requested function.

Optional analytics cookies or similar technologies that require consent are activated only after you choose to allow them. Refusing or withdrawing that consent does not prevent access to functions that do not need those technologies. You can revisit the cookie choices offered on the relevant service; the DPO can also help with a request about those choices.

A narrowly configured analytics service can qualify for an exemption under applicable Italian rules, but using analytics for security does not itself create that exemption. The configuration must meet the relevant conditions, including limits on identification and use of the measurements. We do not treat acceptance of this policy, scrolling, or continued browsing as cookie consent.

Before optional tracking is activated, the relevant cookie notice or settings explain the provider, purpose, and duration of the technologies offered. Cookies and similar identifiers have their own lifetimes, disclosed there; deleting an identifier does not automatically delete data already collected through it. Websites or services reached through an external link have their own privacy information. Embedding third-party content in our service remains subject to the applicable tracking rules.

Protecting your data

We apply technical and organizational measures appropriate to the data and risks. Access is limited according to the person's responsibilities and the user's entitlement. Our safeguards include authentication controls, protection of data in transit, and procedures for handling security incidents and deletion. We review those measures as the service and risks change.

You should safeguard your credentials and avoid including unnecessary personal data in submissions or support requests. PATCHWORK is a professional intelligence service and does not require sensitive personal information about health or other special categories, or criminal-record information, for ordinary use. Do not submit such information without a separately agreed lawful arrangement. If it reaches us unexpectedly, we assess the lawful response and remove or restrict it where appropriate.

If a personal-data breach occurs, we assess it and notify the relevant authority and affected individuals where required. Where we act as a processor, we inform the responsible customer without undue delay and assist it with its obligations.

Your rights

You can ask for access to your personal data and a copy, and ask us to correct inaccurate or incomplete information. Where the applicable conditions are met, you can request deletion or restriction of processing. For data you provided and that we process by automated means on consent or a contract with you, you can request a portable copy and transfer to another controller where technically feasible.

You can object to direct marketing at any time, including any profiling related to it. We then stop using your personal data for that purpose. For processing based on legitimate interests, you can object for reasons relating to your situation; we stop unless we demonstrate overriding legitimate grounds or a need concerning legal claims. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Send a request to dpo@materiaintel.com. Tell us enough to locate the relevant data. Where we have reasonable doubts about identity, we request only the additional information necessary to verify the request. You do not need to send an identity document with every request.

We respond without undue delay and normally within one month of receiving the request. Where complexity or the number of requests requires up to two additional months, we explain the extension within the first month. Requests are normally free; a legally permitted fee or refusal applies only in the limited circumstances allowed for manifestly unfounded or excessive requests. If we cannot fulfill a request, we explain the reason and how you can challenge it.

You can complain to the Italian Data Protection Authority, the Garante, or the competent authority where you live, work, or believe an infringement occurred. You can also seek a judicial remedy. Contractual restrictions on software use, attribution, or ownership of outputs do not waive your statutory data-protection rights.

Providing data and age requirements

You can browse the Free preview without creating an account, although necessary technical records still arise from the visit. Registration is needed for Open access, while Premium and separately configured customer reports require the relevant account entitlement. Without required details, we cannot provide that access. Required invoicing information is necessary for a paid engagement. Optional contact fields and marketing consent remain optional; refusing them does not prevent an unrelated service.

Account creation is limited to people aged 18 or over under the Terms and Conditions. Our services are intended for professional use. If you believe a child has provided personal data, contact the DPO so we can assess the circumstances and take the appropriate action. Mandatory rights under the law applicable to you remain available.

Changes to this policy

We update this policy when our processing or legal obligations change and show the revised date above. We provide additional notice where a change materially affects the use of your data. Before using existing data for a new purpose, we provide the required information and obtain fresh consent where that basis is necessary. Continued use of our services does not replace that consent.