LegalSign in to the platform →Navica AI Data Protection Notice
NAVICA AI DATA PROTECTION NOTICE
Last updated: 10 August 2026
Navica (“Navica”, “we”, “us”, “our”) takes its responsibilities under applicable data protection law, including the General Data Protection Regulation and implementing legislation (“Data Protection Law”) very seriously. The purpose of this notice is to inform you of the personal data relating to you that Navica may collect and process as a ‘controller’ and the uses (including disclosures to third parties) that Navica may make of your personal data.
Controller
This notice applies to the collection and processing of your personal data by Navica as a controller. The following entities may act as the relevant controller for the activities set out below:
- Navica Italy S.r.l. (registered number: 03074050992) with a registered office at Salita dei Sassi 7/2, 16128 Genova, Italy (“Navica Italy”) is the controller of your personal data processed in the context of pre-contractual and contractual matters.
- Navica AI Limited (registered number: 783556) with a registered office at Riverside One, Sir John Rogerson’s Quay, Dublin 2, Dublin, D02 X576 (“Navica Ireland”) is the controller of your personal data processed in connection with the website and other globally operated business activities.
For the avoidance of doubt, Navica Italy and Navica Ireland are separate controllers and do not act as joint controllers of your personal data (unless we inform you otherwise). If you have any questions about Navica’s use of your personal data as a controller, please contact us at privacy@navica.ai or any other contact address published by Navica.
Processor
In providing the Navica platform and services, Navica generally acts as a processor when processing identifiable Customer Data and Personal Data on behalf of customers. Navica processes that data only on the customer’s documented instructions and under Navica’s Data Processing Addendum.
Navica does not use identifiable Customer Data to train or fine-tune foundation models, general-purpose AI models or third-party AI models by default. Such use may occur only where the customer separately and expressly opts in through an identified Order Form or documented product setting that states the scope, purpose and duration of that use. Where an opted-in activity would make Navica a controller, Navica will identify a lawful basis and provide the required information before that processing begins.
Navica may use information that has been genuinely anonymised and aggregated so that neither a customer, an authorised user nor another individual is identified or reasonably identifiable for analytics, benchmarking, security, capacity planning and service improvement.
Information we collect, purposes of processing and legal basis
We collect and process personal data relating to you. The table below details the types of personal data we process, the purposes of the processing and the legal basis under Data Protection Law for the processing. The types of personal data we process may change over time.
| Purpose of processing | Types of personal data | Legal basis for processing |
|---|---|---|
| Account administration: To set-up your account and for account administration purposes, including to enable you to access and use the platform and services. | Account and contact data: Account and contact data, such as name, business email, company, role, account credentials, account identifiers, billing contacts, personal data provided on an order form or otherwise as part of the sign-up process and communications preferences. | Processing is necessary to perform a contract or to enter into a contract with you. Processing is necessary for the purposes of Navica’s legitimate interests. It is in Navica’s legitimate interest to sign-up customers and to administer their accounts so that they can access and use the platform and services. |
| Billing: To facilitate Navica in billing customers for products and services provided. | Contact data: Identity and contact data for billing contacts (such as the contact’s name, business email, company and role) and communications related to billing and payments. Payment data: Personal data processed for billing purposes, such as details of the customer’s subscription tier, order forms, invoices, tax details, payment status, purchase history, customer support interactions and any other relevant payment information. | Processing is necessary for the purposes of Navica’s legitimate interests. It is in Navica’s legitimate interest to receive payments. Processing is necessary for the performance of a contract with you or to take steps prior to entering into a contract with you. Processing is necessary for compliance with a legal obligation to which Navica is subject including the Taxes Consolidation Act 1997 (as amended) and other relevant regulations and legal obligations. |
| Usage, support and troubleshooting: To operate, support, troubleshoot, secure and plan capacity for the platform and services. | Usage and support data: IP address, device and browser data, logs, telemetry, API and feature usage, performance metrics, authentication and security events, diagnostics, support requests, ticket content, communications and diagnostic files supplied for troubleshooting. | Processing is necessary to perform the contract and for Navica’s legitimate interests in delivering support, maintaining the intended functionality and security of the platform, preventing misuse, troubleshooting faults and planning capacity. |
| AI inputs and outputs: To provide customer-requested AI functionality. Where prompts, datasets or other inputs contain Personal Data, Navica may process that Personal Data and generate outputs containing Personal Data only for the customer-directed use. | Personal Data provided by the customer or Authorised Users in prompts, datasets or other inputs, and Personal Data generated in AI outputs. Customers and users should not include Personal Data or confidential information that is unnecessary or prohibited for the selected use case. | For identifiable Customer Data, the customer determines the applicable lawful basis and Navica processes the data as processor under the DPA and the customer’s documented instructions. Where Navica separately processes limited related Personal Data as controller for account administration, security, support or legal compliance, the relevant lawful basis stated in this notice applies. Identifiable Customer Data is not used for model training unless the customer separately and expressly opts in. |
| Communications: To enable Navica to provide service updates and otherwise communicate with customers and users. | Contact and communications data: Contact data, such as name, business email or other contact information and any personal data processed in connection with sending and receiving communications (including surveys). | Processing is necessary for the purposes of Navica’s legitimate interests. It is in Navica’s legitimate interests to (i) provide customers with service updates and other important updates; and (ii) maintain customer relations through communications. |
| Marketing: To send marketing communications only where permitted by applicable law, including Directive 2002/58/EC as transposed. Where consent is required, Navica will obtain it before sending the communication. Every electronic marketing message will provide an effective unsubscribe method. | Marketing data: Name, contact details, marketing preferences and details of prior purchases. | Where Navica has obtained consent to process an individual’s personal data in connection with sending marketing communications. Processing is necessary for the purposes of Navica’s legitimate interests. It is in Navica’s legitimate interest to promote the platform, services and Navica’s offerings. |
| Security and safeguarding: To enable Navica to monitor and maintain appropriate security measures in relation to the platform and services, and generally safeguard its interests. | Identity and contact data: Name and contact details. Communications data: Personal data processed in connection with communications. Usage data: Usage and technical data, such as IP address, device and browser data, logs, telemetry, API usage, usage of custom connectors and configurations, feature usage, performance metrics, usage metrics, authentication events, security logs, diagnostics, safety tools usage, authentication data and details of breaches of Navica’s policies and terms or other issues. | Processing is necessary for the purposes of Navica’s legitimate interests. It is in Navica’s legitimate interests to (i) ensure that the platform and services (and any customer data) are secure; (ii) prevent, detect or investigate unauthorised activity or any activity that might compromise the platform or services; (iii) enable Navica to respond to and co-operate with requests, investigations, audits or orders from competent bodies (including regulatory authorities and courts); (iv) pursue or defend legal claims or threats; and (v) address complaints and disputes. Processing is necessary for compliance with a legal obligation to which Navica is subject, including ensuring the platform maintains appropriate technical and organisational measures as required by the GDPR and compliance with export controls. |
| Feedback: To enable Navica to use any feedback provided. | Feedback: Personal data processed in connection with customer feedback, ideas and suggestions, and any communications in relation to Navica’s proposed or actual use of feedback. Identity and contact data: Name and contact details. | Processing is necessary for the purposes of Navica’s legitimate interests. It is in Navica’s legitimate interests to use customer feedback to promote the platform and services, or improve the platform, services and/or its offering. |
| Website and cookies: To provide essential website functions and, only with any consent required by law, measure engagement or use non-essential analytics technologies. Further information is available in Navica’s Cookie Policy at https://navica.ai/legal/cookie-policy.html. | Website and cookie data: pages viewed, device and browser information, preferences, consent records and similar identifiers. | Consent, where required, for non-essential cookies or similar technologies. Essential security, authentication and service-delivery cookies do not require consent where the applicable ePrivacy rules permit them. Navica’s legitimate interests in providing a secure and functional website, limited to processing that does not require consent under applicable ePrivacy rules. |
| Service improvement: Navica may create and use genuinely anonymised and aggregated information for analytics, benchmarking, security, capacity planning and service improvement. | Aggregated feature-use counts, performance and capacity metrics, security trends and support outcomes. This category excludes Customer Data content and any information from which a customer, authorised user or individual is identified or reasonably identifiable. | Navica may process limited Usage Data on the basis of its legitimate interests to create anonymous statistics, subject to appropriate safeguards. Information that is genuinely anonymous is no longer Personal Data. |
Sharing your data
We may disclose your personal data to other organisations in connection with the above purposes, including:
to other members of Navica’s corporate group;
to third parties who we engage to provide services to us including in connection with the platform and services, such as outsourced service providers, IT services providers, professional advisers and auditors;
to third parties, their agents and professional advisors, subject to confidentiality obligations, for the purpose of a due diligence exercise by third parties in connection with any proposed merger, acquisition, re-organisation or transfer of our business and to any person proposing to participate in, or promote or underwrite or manage any such arrangement; and
to competent regulatory authorities and bodies as requested or required by law.
Sources of Personal Data
We collect personal data directly from you, and from the following sources:
Customers – Our customers may provide us with personal data relating to their users (e.g. names of users); and
account administrators and other authorised users within a customer organisation; identity, payment, security and communications providers; customer-selected connected services; and publicly available business sources such as company websites and professional directories.
Retention
We will not hold your personal data for longer than is necessary. We retain your personal data for as long as we need it to for the purposes described in this notice, or to comply with our obligations under applicable law and, if relevant, to deal with any claim or dispute that might arise in connection with you (or the customer).
Transfers abroad
Navica’s core production hosting and storage are located in the EEA on Hetzner infrastructure. Some service providers, including selected AI, payment, identity and communications providers, may process Personal Data outside the EEA. Navica will use an applicable transfer safeguard for each restricted transfer.
The current provider list, processing purposes and principal processing locations are published at https://navica.ai/legal/subprocessors.html. Where required, Navica relies on one or more of the following safeguards:
Adequacy decisions - where the European Commission has decided that the destination provides an adequate level of protection. Navica may rely on adequacy decisions for transfers to the United Kingdom, Switzerland and other approved destinations.
Standard Contractual Clauses - the European Commission’s 2021 Standard Contractual Clauses, together with a transfer assessment and supplementary measures where required, are included in relevant contracts where no adequacy decision applies.
EU–U.S. Data Privacy Framework - for a transfer to a participating U.S. recipient, Navica may rely on the European Commission adequacy decision for the Framework after confirming that the recipient’s certification is active and covers the relevant data. Otherwise Navica uses another valid safeguard, such as the Standard Contractual Clauses.
Further details, including a copy or summary of the applicable safeguard where available, may be requested from privacy@navica.ai.
Automated-decision making
Navica does not make decisions about you based solely on automated processing where those decisions produce legal effects or similarly significantly affects you.
Your rights and how to update your information
You have the following rights, in certain circumstances and subject to certain restrictions, in relation to your personal data:
Right to access the data – You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.
Right to rectification – You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.
Right to erasure – You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.
Right to restriction of processing or to object to processing – You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.
Right to data portability – You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.
Right to withdraw your consent – Where our processing of your personal data is based on you having provided your consent, you have the right to withdraw such consent.
Please note that these rights are not absolute, and are subject to certain restrictions and exemptions. For example, the right to erasure of personal data will not apply where we have a legitimate reason to continue to hold such data.
In order to exercise any of the rights set out above, please contact privacy@navica.ai.
Navica is required to keep all data accurate and up to date. To enable us to do this more easily, please ensure that you keep us up to date with any changes to your personal data.
Questions and Complaints
If you are not happy with the way we have used your information or addressed your rights, you have the right to make a complaint to the relevant supervisory authority:
- Garante per la protezione dei dati personali (https://www.garanteprivacy.it/) where Navica Italy is the relevant controller; or
- Irish Data Protection Commission (https://www.dataprotection.ie/) where Navica Ireland is the relevant controller.