Legal documents

PROTOCOL-Z - LEGAL DOCUMENTS v1.5

Last updated: 27 August 2026

PART I - TERMS AND CONDITIONS (EULA)

PLEASE READ CAREFULLY BEFORE USING THE SERVICE. By accessing, browsing, or using the Protocol-Z Service in any way - including the 3D/AR Viewer accessible via links shared by real estate agencies or other clients - the User agrees to be fully bound by these Terms of Service ("Terms"). If you do not accept these Terms, you may not use the Service. The full, always up-to-date text of the Terms, Privacy Policy, Cookie Policy, and Accessibility Statement is available at protocol-z.com/en/legal/, reachable at any time from the footer of every page.

1. DEFINITIONS

"Service" means the Protocol-Z SaaS platform in its entirety, including the web dashboard, the 3D/AR viewer ("Viewer"), APIs, source and compiled code, graphical interfaces, visual design, logos, text, animations, UX/UI flows, and related software.

"Operator" means Protocol-Z, developer and operator of the Service, based in Milan, Italy.

"B2B User" means the real estate agency, architecture firm, broker, or any professional or commercial entity accessing the Service via subscription or registered account.

"End User" (or "Visitor") means any natural person accessing the Viewer - even without registration - via a shared link, QR code, embed, or any other distribution method.

"User Content" means 3D models (GLB, USDZ), images, PDFs, and any other material uploaded by the B2B User to the platform.

"Operator's Intellectual Property" means, by way of example and without limitation: source and compiled code, algorithms, 3D optimization pipelines, software architectures, databases and their structures, graphical interface (UI), visual design, graphic components, animations, logos, trademarks, trade names, domain names, technical documentation, internal AI prompts, proprietary AI models and parameters, know-how, and trade secrets.

2. SCOPE AND BINDING ACCEPTANCE

These Terms apply to any party using the Service in any form, including End Users accessing the Viewer via links shared by B2B Users. Use of the Service constitutes full and binding acceptance of these Terms.

B2B Users warrant that their end users have or will accept these Terms prior to using the Viewer, and shall indemnify and hold the Operator harmless against any claim or damages request brought by End Users to whom the B2B User has granted access.

3. LICENSE GRANT

The Operator grants the User a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Service solely for the purposes permitted under these Terms.

The following are expressly prohibited for any User:
(i) sublicensing, reselling, renting, or transferring access to unauthorized third parties;
(ii) reverse engineering, decompiling, disassembling, extracting, or copying the source code, compiled code, shaders, data models, or algorithms of the platform;
(iii) reproducing, imitating, adapting, "cloning", or distributing the graphical interface (UI), visual design, or any aesthetic or functional element of the platform without written authorization;
(iv) using automated tools (scrapers, bots, crawlers) to extract data, 3D models, or content from the Service, including the Viewer;
(v) using the Service to develop, train, or improve competing products, services, or models - including artificial intelligence models - derived from the Service;
(vi) using content, code, output, or data from the Service to train, fine-tune, or benchmark artificial intelligence or machine learning models or algorithms, whether owned by the User or third parties, without written authorization;
(vii) removing, obscuring, or tampering with copyright, trademark, watermark notices, or technical protection measures present in the Service;
(viii) accessing the Service for competitive benchmarking purposes without written authorization.

4. INTELLECTUAL PROPERTY - ENHANCED PROTECTION

All of the Operator's Intellectual Property is and remains the exclusive property of Protocol-Z. No use of the Service transfers to the User any right in such property, except for the limited license granted under clause 3.

The following are specifically protected, without limitation:
- Source and compiled code of the entire platform, including the Service Worker and 3D pipelines;
- The graphical interface (UI/UX): layouts, components, color palette, animations, and micro-interactions;
- Data models and database structure, also protected under the sui generis database right (Art. 102-bis of Italian Law 633/1941, EU Directive 96/9/EC);
- The Protocol-Z brand, including name, logo, domain names, and visual identity, as registered or de facto trademarks;
- Proprietary know-how, methodologies, and calculation algorithms, protected as trade secrets under Articles 98-99 of the Italian Industrial Property Code and Legislative Decree 63/2018 (EU Trade Secrets Directive 2016/943).

PROHIBITION ON USE FOR ARTIFICIAL INTELLIGENCE: it is expressly prohibited to use or reproduce any element of the Operator's Intellectual Property to train, fine-tune, or feed artificial intelligence or machine learning systems, whether owned by the User or third parties, without written authorization.

Any violation may be pursued under Italian and European copyright, trademark, trade secret, database, and unfair competition law, with the Operator entitled to claim damages and emergency injunctive relief.

User Content remains the property of the B2B User, who grants the Operator a royalty-free, non-exclusive license limited to the technical purpose of delivering the Service. The B2B User warrants they hold all necessary rights over uploaded User Content and agrees to indemnify the Operator against third-party claims relating to such content.

4-bis. SPECIFIC PROHIBITIONS FOR END USERS (VIEWER VISITORS)

The End User specifically agrees not to: (i) download, copy, or record by any technical means the 3D models or User Content displayed, beyond normal interactive use; (ii) circumvent or bypass technical protection or streaming measures; (iii) reuse or commercially redistribute displayed User Content without authorization; (iv) use the Viewer for purposes other than reviewing the property in the context of an ongoing sale, lease, or analysis. Violation results in immediate revocation of access.

5. ACCOUNT, SECURITY, AND SUSPENSION (B2B Users)

The B2B User is responsible for maintaining the confidentiality of their login credentials. The Operator may suspend the account for: non-payment, violation of these Terms, use that compromises security/stability, or attempts at unauthorized extraction of Intellectual Property.

6. PAYMENT AND SUBSCRIPTION (B2B Users)

The Service is offered on a subscription basis. Non-payment may result in suspension of access. Payments are non-refundable unless otherwise required by applicable law or written agreement.

7. LIMITATION OF LIABILITY

The Service is provided "as is." The Operator does not guarantee the absolute accuracy of estimates generated by the Viewer (including energy cost estimates, purely indicative and not a substitute for a professional energy assessment). Maximum liability to B2B Users is limited to the amount paid in the preceding 3 months; liability to End Users is excluded to the maximum extent permitted. Nothing excludes liability for fraud or gross negligence.

8. UPDATES TO TERMS

The Operator may modify these Terms at any time; the updated version will be published at protocol-z.com/en/legal/. Continued use of the Service after publication constitutes acceptance of the changes.

9. DATA COLLECTION, ARTIFICIAL INTELLIGENCE, AND THIRD-PARTY PROVIDERS

The Service automatically collects technical data (IP, device, Viewer logs) from both B2B Users and End Users. For legal bases, purposes, and retention, refer in full to Part II - Privacy Policy of this document. The Service may use AI providers, including outside the EU, in compliance with GDPR safeguards; the prohibition on using the Operator's Intellectual Property to train third-party AI models remains in force in all cases. The Controller further reserves the right to use User Content and other data collected from B2B Users and End Users to train and improve artificial intelligence models, whether owned by the Operator or third parties, with the possibility of sharing such data with third parties, as governed - including the corresponding right to object - by Part II, section 4-bis of this document.

10. GOVERNING LAW AND JURISDICTION

This Agreement is governed by Italian law. Exclusive competent forum: Court of Milan, except for mandatory consumer protection provisions.

11. CONTACT

E-mail: info@protocol-z.com. This document includes the Terms and Conditions, Privacy Policy, Cookie Policy, and Accessibility Statement.

PART II - PRIVACY POLICY

1. DATA CONTROLLER

The Data Controller is Protocol-Z, based in Milan, Italy. Contact: info@protocol-z.com

Given the size of the organization and the nature of the processing, there is no obligation to appoint a Data Protection Officer (DPO) under Art. 37 GDPR. Any request may nonetheless be sent to the address above.

2. DATA COLLECTED

B2B Users (agencies and professionals):

Account data: email address, password (hashed), agency name.
Agency profile data: phone, website, WhatsApp, physical address, description, logo.
Uploaded content: 3D models (GLB, USDZ), preview images, property PDFs.
Technical data: access logs, IP addresses, device type, browser.
Billing data, where applicable.

End Users (Viewer visitors):

Technical data collected automatically: IP address, device type, operating system, browser, viewing session, Viewer interaction logs.
No identifying data (name, email) is collected unless voluntarily provided via contact forms.

Anyone filling in a form on one of our sites:

The name of the person and of the organisation, email address, telephone number if given, the text of the message, the language of the page and which site the request came from.
The data goes into a contact management system the Controller uses to reply and to follow the conversation. It is not passed to third parties for their own purposes.
Legal basis: pre-contractual measures requested by the data subject, Art. 6(1)(b) GDPR, for answering the request; legitimate interest, Art. 6(1)(f), for the commercial contact that follows, with the right to object at any time.

No special categories of data under Art. 9 GDPR are collected. The Service does not carry out solely automated decision-making or profiling under Art. 22 GDPR: estimates provided by the Viewer are informational calculations based on average statistical parameters.

3. PURPOSES AND LEGAL BASES FOR PROCESSING

a) Service delivery (contract performance, Art. 6.1.b GDPR): account management, 3D model storage and streaming, property dashboard.
b) Security and fraud prevention (legitimate interest, Art. 6.1.f GDPR): access logs, anomaly monitoring, protection of the Operator's intellectual property.
c) Service improvement and AI features (legitimate interest, Art. 6.1.f GDPR): analysis of technical data to improve performance and develop AI features, with third-party providers (see section 4).
d) Direct marketing (legitimate interest, Art. 6.1.f GDPR): offers to existing B2B customers, with the ability to object at any time.
e) Legal obligations (Art. 6.1.c GDPR): tax and accounting regulations.
f) Establishment, exercise, or defense of legal claims (legitimate interest, Art. 6.1.f GDPR).

4. DATA PROCESSORS, AI PROVIDERS, AND TRANSFERS

The Controller uses the following providers as Data Processors (Art. 28 GDPR):

Server infrastructure and storage provider for 3D models and account data, based and hosted in Switzerland. Switzerland is recognised as an adequate country by a European Commission decision, so the transfer needs no further safeguards.
Publishing and delivery provider for the public websites, based in the United States. The transfer relies on Standard Contractual Clauses and the provider adheres to the EU-US Data Privacy Framework.
Content delivery network and hostile traffic protection provider, based in the United States, which processes the IP addresses of whoever requests the files and the technical data of the request. Transfer relies on Standard Contractual Clauses.

An up to date list of providers, naming each of them, is available by writing to info@protocol-z.com. The Service may use artificial intelligence model providers, whose servers may be located in the EU, USA, or other jurisdictions; extra-EEA transfers comply with GDPR safeguards (SCCs or equivalent). Data is not sold, assigned, or disclosed to third parties for their own purposes, except as set out in section 4-bis regarding the training of artificial intelligence models.

4-bis. USE OF DATA TO TRAIN ARTIFICIAL INTELLIGENCE MODELS AND RIGHT TO OBJECT

To the extent permitted by applicable law, the Controller reserves the right to use User Content (including 3D models/scans uploaded by B2B Users) and other data collected from both B2B Users and End Users - including technical Viewer usage data - to train, fine-tune, and improve artificial intelligence models and systems, whether owned by the Operator or third parties, as well as more generally for any purpose connected with improving and providing its services. Such data may be shared with third-party providers and partners, including outside the EEA, for the same purposes, subject to the transfer safeguards described in section 4.

Right to object (opt-out): a User who does not wish to allow the use of their User Content and/or data for the AI-training purposes described above may exercise their right to object by sending a written communication to info@protocol-z.com no later than 14 (fourteen) calendar days from the date these Terms were accepted. After that period, the right to object with respect to this purpose can no longer be exercised.

Where timely exercised, the objection takes effect only for the future, with respect to processing carried out after it is received: any User Content and data already used for AI-training purposes prior to receipt of the objection remain lawfully processed, and such prior use cannot be revoked, undone, or reversed in any way.

5. DATA RETENTION

Account and profile data (B2B Users): duration of contract + 24 months.
3D models: local (offline) cache up to 24 hours; server-side for the subscription duration.
Technical logs (including End User IPs): maximum 90 days.
Requests sent through the site forms: 24 months from the last contact, unless a contractual relationship has begun in the meantime, in which case account data retention applies.
Billing data: as required by law (typically 10 years, Art. 2220 of the Italian Civil Code).

6. DATA SUBJECT RIGHTS

Under Articles 15-22 GDPR, you have the right to: access, rectify, erase, restrict processing, receive your data in portable format, object to processing, withdraw consent where given, and lodge a complaint with the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it) or your EU member state's supervisory authority.

To exercise your rights: info@protocol-z.com (response within 30 days, extendable by 60 in complex cases).

What they are: cookies are small text files sent to a user's device by the websites visited, stored and then retransmitted to the same websites on the next visit. Protocol-Z also uses equivalent technologies (browser cache, local storage) for similar purposes.

Which cookies Protocol-Z uses: only technical and session cookies, strictly necessary for the platform to function. No profiling, advertising, or cross-site tracking cookies are used, and there are no third-party cookies or pixels: no analytics, advertising or social network service is integrated into the Service. What remains are the technical requests to the delivery networks described in the table below, which set no cookies.

Type	Purpose	Duration
Session / authentication cookie	Maintain the dashboard login session for B2B Users	Session duration or a few days at most
Technical preferences (language, theme)	Remember the language and theme (light/dark) chosen by the user	Up to 12 months
Components loaded from third party delivery networks	Some technical libraries needed by the 3D viewer and by the pages are served from external delivery networks. The browser connects to them directly, so the request carries the device's IP address and the technical data of the request. These parties set no cookies. Typefaces and icons are hosted on our own servers instead and involve no third party request.	No cookies; technical logs are kept by the provider under its own policies

Equivalent technologies for offline functionality: to allow the Viewer to be used even without a connection, the Service temporarily stores a copy of already-viewed content on the user's device (via the browser's standard local storage capabilities). This data stays on the user's device, is never shared with the Operator or third parties, and is automatically overwritten or removed by the browser according to normal cache refresh cycles.

Legal basis: as these are strictly necessary technical cookies and technical components functional to delivering the Service, their use does not require prior consent under Art. 122 of Italian Legislative Decree 196/2003 and the Italian Data Protection Authority's Cookie Guidelines (9 July 2021).

How to manage cookies: you can manage or delete technical cookies at any time through your browser settings. As these are strictly necessary cookies, disabling them may prevent the dashboard or Viewer from working correctly.

8. DATA SECURITY

The Controller adopts appropriate technical and organizational measures proportionate to risk (Art. 32 GDPR). In the event of a personal data breach posing a risk to data subjects, it will notify the Garante and, where required, data subjects, within statutory timeframes (Arts. 33-34 GDPR).

9. CHANGES TO THIS PRIVACY POLICY

The Controller may update this Policy at any time; the updated version will be published on this page within 14 days of the update.

PART III - ACCESSIBILITY STATEMENT

1. PROTOCOL-Z'S COMMITMENT

Protocol-Z is committed to making its website and platform accessible to as many people as possible, including people with disabilities, in line with the principles of EU Directive 2016/2102 on the accessibility of websites and mobile applications and, for the Italian market, Law No. 4 of 9 January 2004 ("Legge Stanca") as amended.

Protocol-Z is a B2B SaaS service provided by a private operator, not a public body legally required to comply with the above regulations; adopting the accessibility principles described here therefore represents a voluntary commitment by the Operator toward its B2B Users and Viewer End Users.

2. REFERENCE STANDARDS

The Service is designed with reference to the Web Content Accessibility Guidelines (WCAG) 2.1 and, where possible, 2.2, Level AA, published by the World Wide Web Consortium (W3C).

3. MEASURES ADOPTED

By way of example, the Service adopts the following measures:

Semantic page structure (headings, landmarks, ARIA labels where appropriate);
Alternative text for informational images;
Keyboard navigation support for the main interaction flows;
Color contrast verified for the light and dark interface themes;
Interface components with visible focus states;
Resizable text without loss of functionality.

4. KNOWN LIMITATIONS

Given the nature of the 3D/AR Viewer - which inherently presents visual and spatial content (three-dimensional models, augmented reality measurements) - some features may not be fully accessible to users with severe visual disabilities. Protocol-Z works to provide, where technically possible, text alternatives and equivalent information (e.g. dimensional data, floor plans, and energy cost estimates in a text format accessible via screen readers).

5. REPORTING ACCESSIBILITY BARRIERS

If you encounter accessibility barriers while using the website, dashboard, or Viewer, please report them to info@protocol-z.com, indicating the page involved and, if possible, the device/browser and assistive technology used. We are committed to evaluating every report and responding within a reasonable time.

6. UPDATES

This statement is reviewed periodically whenever significant changes are made to the Service's interface.