This notice describes processing connected with use of the ProdigysKERP MCP service with ChatGPT. It supplements Prodigys’ general privacy notice and the notice provided by the controller responsible for data processed in K-ERP.
1. Controllers and roles
Prodigys Technology S.r.l., Via San Domenico 6, 20025 Legnano (MI), Italy, VAT no. 06180320969, email info@prodigysgroup.it, determines the purposes of processing relating to service operation, security and support. For data in a customer’s K-ERP instance, Prodigys acts according to its role and the instructions in the customer agreement, generally as a processor; the customer remains the controller and determines the purposes and legal bases. ChatGPT is a third-party service selected and used by you or your organization; its provider processes prompts and responses under its own terms and privacy notices.
2. Data and purposes
Use of the connection may involve processing: identifiers for the authenticated account and organization; authentication and authorization information needed for the connection; requests sent to MCP tools; operation parameters; data returned from K-ERP; and technical information needed to transmit and protect requests. If you contact support, contact details and the content of your communication are also processed.
Data is used to authenticate you, check permissions, perform requested functions, return results to ChatGPT, protect and maintain the service, and respond to support requests. Do not submit unnecessary data. Requests and results may contain personal data held in K-ERP.
3. Recipients and transfers
The request and data needed to produce a response pass between K-ERP/the MCP service and ChatGPT. The ChatGPT provider receives the transmitted content and processes it according to the service, plan and account settings in use. Prodigys does not control the ChatGPT provider’s settings, retention periods or transfers. Review OpenAI’s information about connected apps and your organization’s applicable settings.
Prodigys uses Amazon Web Services (AWS) for hosting, with infrastructure in Europe. Providers involved in delivering the service act under the applicable roles and agreements. K-ERP data is not intended to be made public. Information is disclosed to public authorities when required by law.
4. Retention
The MCP service is configured to be stateless and does not maintain a persistent application session between requests. Technical service logs and support requests are retained for 30 days. Application data in K-ERP remains subject to the retention rules set by the customer and the applicable agreement; it is not covered by the 30-day period for logs and support requests.
ChatGPT may retain prompts and responses according to the plan, account settings and terms of that service. For details, see OpenAI’s chat and file retention policies.
5. Legal basis and rights
For processing where Prodigys is the controller, the legal basis depends on the purpose and may include performance of an agreement and service operation, legitimate interests in security and handling requests, or compliance with legal obligations. For data processed on behalf of a customer, the customer as controller determines the legal bases.
To exercise rights concerning processing for which Prodigys is the controller, email info@prodigysgroup.it. For data managed in K-ERP, contact your organization’s controller. Further rights and complaint information are set out in the general privacy notice.
6. Security and responsible use
Access is tied to the authenticated user and operations are limited to permissions available in K-ERP. Changes require confirmation. Do not share credentials or tokens, and do not submit information to ChatGPT unless you are authorized to share it with that service. No technical measure removes every risk; review responses and proposed changes before proceeding.