AI Transparency Notice

CONSOO S.R.L.S. — hice

Edition: English master (international)

Last updated: 23 July 2026

---

1. Introduction and purpose of this document

1.1 Why this notice

The hice Service integrates certain features based on artificial intelligence systems (the AI Features). This notice transparently explains: what those features are, what they do, what data they use, where processing (inference) takes place, and what rights the data subjects have.

1.2 Dual function of this document

This document serves a twofold purpose:

1. Transparency under the GDPR (Reg. (EU) 2016/679), in particular the obligation to inform about the existence of any automated decision-making and the logic involved (Art. 13(2)(f) and Art. 22 GDPR).
2. Transparency under Regulation (EU) 2024/1689 on artificial intelligence (hereinafter the «AI Act»): information on the use of AI systems, on the limitations of such systems, and on the human oversight required.

1.3 Relationship with other documents

This notice is complementary and must be read together with:

• the General Terms of Service (condizioni-generali-servizio.md);
• the Privacy Notice (informativa-privacy.md), for the data of which hice is Data Controller;
• the Data Processing Agreement — DPA (dpa-trattamento-dati.md), for the Customer Data of which hice is Data Processor;
• the Customer notice templates (modelli-informative-cliente.md), which the Customer provides to its own data subjects (e.g. candidates).

Capitalized terms have the meaning defined in the General Terms of Service and in the shared glossary. In particular: Service, Customer, User, Tenant, Customer Data, AI Features / AI Systems, Data Controller, Data Processor, Data Subject.

1.4 Recipients

This notice is addressed to all Users of the Service. It is particularly relevant for Customers who use hice in the recruiting vertical (personnel selection) and for the persons whose data is processed in that context (primarily the candidates).

---

2. General principles on the use of AI in hice

hice adopts the following principles in the use of the AI Features. They are summarized here and detailed in the following sections.

1. AI is a supporting tool, not a decision-maker. The AI Features support the User; they do not autonomously make decisions producing legal or similarly significant effects on persons (see §6).
2. Human-in-the-loop (HITL) on write actions. Actions by which the AI assistant proposes to create, modify or delete data require explicit human confirmation before being executed (see §5.1 and §7.1).
3. No-training on Customer Data. hice does not use Customer Data to train foundation AI models (see §8).
4. Human oversight and output verification. AI outputs may contain errors or «hallucinations» and must be verified by the User before any use (see §7).
5. Transparency and traceability. hice documents its AI Features and records relevant actions through audit logs for security and verification purposes.
6. Preference for local processing and minimization. Where technically possible, processing is carried out with local and deterministic components; recourse to external language models is limited to what is necessary (see §4 and §9).

---

3. The AI Features of hice (detailed description)

This section lists the AI Features actually present in the Service. For each one, the following are indicated: (a) what it does; (b) what data it uses; (c) where inference takes place; (d) whether and how it affects decisions concerning persons.

Technical note. The four features have different degrees of automation and different technologies. In particular, two of them (OCR and the main matching component) are deterministic and do not employ generative language models; the others may use a language model.

3.1 AI assistant in chat

a) What it does. It is a conversational assistant, in the Italian language, that helps the User query and operate on the data of its own Tenant (for example: obtaining information on candidates, contacts, companies, projects; or proposing the creation or update of an entry). When the request corresponds to a structured action, the assistant routes it to a deterministic internal tool; when the request is free-form, it may generate a text response through a language model.

b) What data it uses. The text of the User's message, the conversation history, the screen context, any attachments the User chooses to send (e.g. PDF, DOCX, text), and the Tenant data relevant to the request. This data may contain personal data of third parties (for example, text relating to a candidate or a contact).

c) Where inference takes place. For free-form responses, inference takes place through the AI models, executed at the provider of processing services for the AI Features (see §4 and §9). The intent-recognition and tool-routing phases may take place locally on the Service's infrastructure through software components executed locally that are deterministic and based on semantic search.

d) Effect on decisions. The assistant does not make decisions about the User or third parties. The proposed write actions require human confirmation (HITL, §5.1). Access to the assistant is subject to permissions and may not be available to all roles.

3.2 Candidate ↔ opportunity matching

a) What it does. It produces a ranked list of candidates or consultants potentially relevant to an opportunity/position, or to a text search. It is designed to help the recruiter identify profiles to evaluate; it is the most relevant feature for recruiting purposes.

b) What data it uses. On the one hand, the data of the candidate's/ consultant's profile (for example: role, seniority level, years of experience, skills, languages, city/area of availability, education, and information derived from interview notes); on the other hand, the data of the opportunity (title, description, notes, location). This consists largely of personal data of candidates and professional data of consultants.

c) Where inference takes place. The ranking is produced through a deterministic comparison engine that operates on normalized profiles stored in the Service's infrastructure; the score is calculated using predefined criteria (for example, correspondence between skills, role, seniority, area), without resorting, at this stage, to a generative artificial intelligence model.

Upstream, asynchronously with respect to the search, profiles may be normalized/enriched (for example, to standardize the naming of skills and roles) also with the assistance of the AI models (see §4); such enrichment takes place only once per profile, in the background, and does not in itself determine any selection outcome. For semantic search/similarity, the Service may use vector-representation techniques («embedding» vectors), processed by software components executed locally on the Service's infrastructure.

To be completed. Any introduction of a re-ranking phase through an artificial intelligence model downstream of the deterministic comparison, where activated, will have to be described here and assessed as a priority for the purposes of the AI Act (§10). As of now, ranking generation is deterministic.

d) Effect on decisions. Matching is an AID to human decision-making and does not automatically select or reject any candidate. The decision on interviews, advancements or hires remains with a person (the Customer's User). See §6 (automated decisions and rights) and §10 (allocation of roles under the AI Act).

3.3 CV parsing and normalization

a) What it does. It extracts structured information from a CV (PDF/DOCX) (for example: name, contact details, role, years of experience, skills, languages, education, work experience) to pre-fill the candidate's record and reduce manual entry.

b) What data it uses. The CV file uploaded by the User and the text contained therein, which constitutes personal data of the candidate.

c) Where inference takes place. Extraction takes place according to a two-path architecture:

1. a local deterministic path based on software components executed locally (text extraction + regular expressions + linguistic entity recognition + comparison with a skills catalog), which operates locally on the Service's infrastructure and is the baseline path;
2. an optional enrichment through the AI models (§4), which can be activated to improve the structuring of the data. In the event of unavailability or error of the models, the Service falls back to the result of the local path (fallback).

d) Effect on decisions. Parsing does not evaluate the candidate and does not make decisions: it merely transcribes/structures information, which the User must verify and correct (automatic extraction may contain errors, §7.2).

3.4 OCR (text recognition) of receipts and invoices

a) What it does. It recognizes the text of receipts/invoices (from an image or PDF) and extracts certain fields (for example: supplier, amount, tax, date, line items) to facilitate the entry of expense reports and purchases.

b) What data it uses. The file uploaded by the User (image or PDF of the document) and the recognized text. It may contain identifying data and tax data of third parties (suppliers).

c) Where inference takes place. OCR is performed by software components executed locally entirely on the Service's infrastructure, without resorting to artificial intelligence models or external cloud services for inference. The subsequent field extraction is carried out with deterministic rules. This is an optical character recognition function, not a generative AI system.

d) Effect on decisions. OCR does not make decisions and does not evaluate persons: the extracted data is proposed to the User, who verifies and confirms it.

3.5 Summary table

---

4. Models and providers involved

4.1 Artificial intelligence models

For the features that require it (chat assistant; CV parsing enrichment; possible profile normalization), hice uses the AI models, executed at the provider of processing services for the AI Features. This provider acts as a sub-processor (see §4.3).

4.2 Local and deterministic components

The following processing takes place through software components executed locally on the Service's infrastructure and does not involve sending data to the external AI models:

• the baseline extraction and structuring of the CV (regular expressions, linguistic entity recognition, comparison with a skills catalog);
• the OCR of receipts and invoices (with the related local image pre-processing and compression phases);
• the deterministic matching engine and the vector representations («embedding») for semantic search/similarity.

4.3 Providers and sub-processors

Processing through the external AI models entails the use of a sub-processor (the provider of processing services for the AI Features). The up-to-date list of sub-processors, with the services provided, the categories of data and the safeguards for any transfers, is set out in the DPA (dpa-trattamento-dati.md) and is consistent with the internal register of sub-processors. The software components executed locally do not constitute external sub-processors as they operate on the Service's infrastructure.

4.4 Provider separation for Mail and Calendar

AI features may use third-party cloud language models and API services selected by HICE. Turns containing data or results originating from Mail or Calendar are routed to a separate, dedicated API project, distinct from the provider used for general features. The separation is applied before content is sent to a model, and the flow is blocked if the dedicated provider is not configured.

For this channel, HICE selects terms under which inputs and outputs are not used to train models by default and does not opt in to voluntary data-sharing programs. The specific disclosure required for Google Workspace is set out in Privacy Policy §9.7.

---

5. Human-in-the-loop and human oversight

5.1 Human confirmation on write actions (HITL)

When the AI assistant proposes a write action — that is, the creation, modification or deletion of data in the Service (for example, creating a task, updating a record, deleting a contact) — that action is not executed automatically. The Service shows the User a summary of the proposal, and the action is executed only after the User's explicit confirmation (human-in-the-loop mechanism). The User therefore always remains the author of the change.

5.2 Human oversight of evaluations and selections

For features potentially relevant in the area of selection (primarily candidate matching), the Service is designed as a support tool: every evaluation, advancement or exclusion of a candidate requires the intervention and decision of a person. Neither matching nor CV parsing autonomously takes measures regarding candidates.

5.3 Permissions and roles

Access to the AI Features is governed by the Service's permission system. Some features (for example, the chat assistant) may be reserved for certain roles and not be available to all Users of the Tenant.

---

6. Automated decisions and the Data Subject's rights (Art. 22 GDPR)

6.1 Absence of solely automated decisions

hice designs the AI Features so that there are no decisions based solely on automated processing producing legal effects or similarly significantly affecting persons (Art. 22(1) GDPR). In particular, in the recruiting context, matching is an aid and the final decision always rests with a person (see §5.2).

6.2 hice's role and the Customer's role

It is essential to clarify the roles (see also §10):

• for the Customer Data (including candidate data), the Data Controller is the Customer; hice acts as Data Processor on its behalf (Art. 28 GDPR), pursuant to the DPA;
• it follows that the obligations to inform candidates and the guarantee of human oversight in selection rest, primarily, on the Customer as Data Controller and employer/decision-maker. hice provides tools and templates (modelli-informative-cliente.md) to facilitate compliance.

6.3 The Data Subject's rights

Without prejudice to the above, should a processing operation amount — by reason of the configuration adopted by the Customer — to an automated decision under Art. 22 GDPR, the Data Subject has the right to:

• obtain human intervention from the Data Controller (the Customer);
• express their point of view;
• contest the decision;
• receive meaningful information about the logic involved and about the envisaged consequences of the processing (Art. 13(2)(f), 14(2)(g), 15(1)(h) GDPR).

The exercise of these rights should be addressed primarily to the Data Controller (the Customer). hice, as Data Processor, assists the Customer in responding to Data Subjects' requests pursuant to the DPA. For the data of which hice is Data Controller (see Privacy Notice), the rights are exercised by writing to info@hice.ai.

6.4 Complaint to the authority

The Data Subject is in any case entitled to lodge a complaint with the competent supervisory authority (in Italy, the Garante per la protezione dei dati personali, the Italian data protection authority).

---

7. Limitations of AI and verification responsibility

7.1 «As-is» output to be verified

The AI Features are provided «as is». The outputs generated — assistant responses, matching rankings, fields extracted from CVs or receipts — may be incomplete, inaccurate or wrong. It is the User's responsibility to verify and validate the outputs before using them or making decisions.

7.2 «Hallucinations» and errors

Language models may produce information that is plausible but untrue (so-called «hallucinations»). The deterministic components (parsing, OCR) may also make extraction errors (for example, on low-quality or non-standard documents). hice does not guarantee the accuracy, completeness or fitness for a specific purpose of the AI outputs, to the extent permitted by law.

7.3 Human confirmation on writes

Consistently with §5.1, the write actions suggested by the AI are subject to human confirmation: this constitutes a safeguard against the execution of erroneous actions, but does not replace the substantive verification of the content by the User.

7.4 Compliant use

The User undertakes not to use the AI Features in breach of the law, of third parties' rights or of the Acceptable Use Policy (politica-uso-accettabile.md), and in particular not to make decisions without adequate human oversight on the basis of AI outputs alone.

7.5 Limitation of liability

The provision of the AI Features is subject to the exclusions and limitations of liability set out in the General Terms of Service (condizioni-generali-servizio.md), within the mandatory limits of law (the cases of willful misconduct and gross negligence, and the damages that cannot be excluded by law, remain unaffected).

---

8. «No-training» commitment on Customer Data

hice does not use Customer Data to train or re-train foundation artificial intelligence models. The Customer Data sent to the AI Features is processed solely for the purpose of delivering the requested feature (for example, generating a response, normalizing a profile, structuring a CV) and not for the purpose of training general models.

The artificial intelligence models used are pre-trained third-party models employed in inference only: hice does not perform fine-tuning of the models on Customer Data. This commitment is reiterated in the General Terms of Service, in the Privacy Notice and in the DPA.

To be completed. Any prompt retention/logging policies on the part of the provider of processing services for the AI Features must be verified and regulated in the agreements with the sub-processor (see §9).

---

9. Location of inference and data transfers

9.1 Local processing

The OCR functions, the baseline extraction of the CV, the deterministic matching and the generation of vector representations take place locally, through software components executed locally on the Service's infrastructure.

9.2 Processing through the artificial intelligence models

The features that employ the artificial intelligence models (chat assistant; CV parsing enrichment; profile normalization) send the text of the prompts to the provider of processing services for the AI Features. Such prompts may contain personal data (for example, the text of a CV or of a chat).

9.3 Location and transfers

The cloud services and servers used to deliver the Service are located in the reference region of this edition (European Union / EEA). Should a processing operation exceptionally require a transfer outside that region, it is carried out by adopting appropriate safeguards under applicable law (for the EU edition: Chapter V of the GDPR — Standard Contractual Clauses or an adequacy decision). The details of the sub-processors and the related safeguards are set out in the DPA (dpa-trattamento-dati.md).

---

10. AI Act framework: allocation of roles and human oversight

10.1 Why it is relevant

Regulation (EU) 2024/1689 (the AI Act) introduces differentiated obligations depending on the role held with respect to an AI system and the level of risk of the system itself. It is useful to distinguish the roles, because some obligations rest on hice and others on the Customer.

10.2 Classification of candidate matching as a «high-risk» system

AI systems intended for personnel selection and for decisions relating to the employment relationship fall, under the AI Act, among the «high-risk» systems (Annex III, area of employment/personnel selection). Consequently, candidate ↔ opportunity matching is classified as a high-risk AI system. The enhanced obligations provided for by the AI Act apply to such systems, differentiated according to the role of provider or deployer, described in §10.3 and §10.4. The other AI Features (chat assistant, CV parsing, OCR) are not intended for personnel selection and do not fall within that classification.

10.3 hice's role (provider) and related obligations

hice develops and makes available the AI Features as part of the Service and, with reference to candidate matching, assumes the role of provider of a high-risk AI system under the AI Act. In that capacity, hice is required, among other things, to:

• establish and maintain a risk management system throughout the system's life cycle;
• apply appropriate data governance and quality practices for the training, validation and testing data;
• prepare the technical documentation of the system and keep it up to date;
• ensure the automatic recording of events (logs) during operation, for traceability purposes;
• ensure an adequate level of transparency and provide information and instructions for use to deployers — this notice and the Documentation;
• design the system so as to enable effective human oversight by natural persons;
• ensure appropriate levels of accuracy, robustness and cybersecurity.

hice has designed matching as a non-decisional aid with human oversight, and does not automate decisions about persons (§5–§6).

10.4 The Customer's role (deployer) and related obligations

The Customer that uses the AI Features in the course of its own activity — specifically to select personnel — acts as a deployer of a high-risk AI system under the AI Act, in addition to being the Data Controller and the employer/decision-maker. In that capacity the Customer is required, among other things, to:

• inform candidates and workers about the use of automated tools in the selection/evaluation process (also using the modelli-informative-cliente.md);
• ensure human oversight of the use of the system and of the final decision, entrusting it to competent persons;
• monitor the operation of the system and oversee its use in accordance with the instructions for use, reporting any risks or malfunctions;
• use the system in accordance with the instructions for use and applicable law (including employment and non-discrimination law);
• assess the impacts on persons (also in coordination with any required impact assessments).

10.5 Implementation status of the technical obligations

The technical obligations specific to a high-risk AI system (in particular the technical documentation file, the formalized risk management system and the compliant recording/logging functionalities) are being implemented. This notice is updated as those obligations are completed. The classification of candidate matching as a high-risk system and the allocation of roles described above remain fully applicable in any case.

10.6 AI literacy and responsible use

hice encourages the conscious use of the AI Features. The Customer is invited to ensure that the Users who employ such features have adequate information about their operation and their limitations (cf. the «AI literacy» obligations provided for by the AI Act).

---

11. Processing of personal data and rights — reference

The processing of personal data connected with the AI Features is governed:

• by the Privacy Notice (informativa-privacy.md), for the data of which hice is Data Controller;
• by the DPA (dpa-trattamento-dati.md), for the Customer Data of which hice is Data Processor, including the sub-processors (§4.3) and the transfers (§9).

For the exercise of rights and for any information, the contact details are indicated in §13.

---

12. Changes to this notice

hice may update this notice to reflect changes to the AI Features, to the models/providers used or to the regulatory framework. The updated version will be made available with an indication of the date of last update. Material changes will be communicated in accordance with the procedures provided for in the General Terms of Service.

---

13. Contacts