From 04a1892c0dfd04efabd2649ff3b34509f7c4d67b Mon Sep 17 00:00:00 2001 From: Javaxman Date: Wed, 29 Jul 2026 23:53:46 +0200 Subject: [PATCH 1/3] Completa le traduzioni EN/TH e corregge sezioni home ancora solo in italiano. Stats e prodotti non usavano il locale, quindi dopo lo switch lingua lo scroll mostrava ancora l'italiano. Co-authored-by: Cursor --- src/components/ChatGateModal.astro | 7 +- src/components/CookieConsent.astro | 39 +- src/data/about.ts | 208 +++ src/data/codice-etico.ts | 1712 +++++++++++++++++++++++-- src/data/cookie-consent.ts | 176 ++- src/data/cookies.ts | 829 ++++++++++++ src/data/dove-siamo.ts | 95 ++ src/data/gdpr.ts | 396 ++++-- src/data/home/chat.ts | 129 +- src/data/home/index.ts | 3 + src/data/home/products.ts | 224 +++- src/data/home/stats.ts | 83 +- src/data/modello-organizzativo.ts | 1037 ++++++++++++--- src/data/news.ts | 208 +++ src/data/privacy.ts | 648 +++++++--- src/data/terms.ts | 430 +++++-- src/pages/about.astro | 107 +- src/pages/codice-etico.astro | 684 ++++------ src/pages/cookies.astro | 367 +++--- src/pages/dove-siamo.astro | 45 +- src/pages/gdpr.astro | 51 +- src/pages/index.astro | 6 +- src/pages/modello-organizzativo.astro | 356 ++--- src/pages/news.astro | 67 +- src/pages/privacy.astro | 51 +- src/pages/terms.astro | 44 +- 26 files changed, 6172 insertions(+), 1830 deletions(-) create mode 100644 src/data/about.ts create mode 100644 src/data/cookies.ts create mode 100644 src/data/dove-siamo.ts create mode 100644 src/data/news.ts diff --git a/src/components/ChatGateModal.astro b/src/components/ChatGateModal.astro index a7e144c..82cf19c 100644 --- a/src/components/ChatGateModal.astro +++ b/src/components/ChatGateModal.astro @@ -1,6 +1,11 @@ --- -import { chat } from '../data/home'; +import { getChat } from '../data/home'; +import type { SupportedLocale } from '../data/home/navigation'; +const path = Astro.url.pathname; +const localeMatch = path.match(/^\/(en|th)(\/|$)/); +const currentLocale = (localeMatch?.[1] ?? 'it') as SupportedLocale; +const chat = getChat(currentLocale); const pc = chat.prechat; const hasFormspree = typeof pc.actionUrl === 'string' && pc.actionUrl.length > 0; diff --git a/src/components/CookieConsent.astro b/src/components/CookieConsent.astro index bced16a..9274341 100644 --- a/src/components/CookieConsent.astro +++ b/src/components/CookieConsent.astro @@ -1,5 +1,18 @@ --- -import { cookieConsentMeta, cookieCategories } from '../data/cookie-consent'; +import { + cookieConsentMeta, + getCookieCategories, + getCookieConsentUi, +} from '../data/cookie-consent'; +import type { SupportedLocale } from '../data/home/navigation'; + +const path = Astro.url.pathname; +const localeMatch = path.match(/^\/(en|th)(\/|$)/); +const currentLocale = (localeMatch?.[1] ?? 'it') as SupportedLocale; +const cookieCategories = getCookieCategories(currentLocale); +const ui = getCookieConsentUi(currentLocale); +const cookiesHref = + currentLocale === 'it' ? '/cookies' : `/${currentLocale}/cookies`; const model = { storageKey: cookieConsentMeta.storageKey, @@ -28,15 +41,14 @@ const model = { id="nx-cc-banner-title" class="text-sm font-semibold tracking-tight text-nx-fg" > - Utilizziamo cookie e memorizzazione locale + {ui.bannerTitle}

- Seleziona le categorie che preferisci. I necessari restano attivi per - registrare la tua scelta. Dettagli nella{' '} - informativa cookie. + {ui.bannerDescBefore}{' '} + {ui.bannerPolicyLinkLabel}.

- Rifiuta non essenziali + {ui.rejectLabel}
@@ -86,11 +98,10 @@ const model = { >

- Preferenze cookie + {ui.dialogTitle}

- Versione informativa v{cookieConsentMeta.policyVersion}. Puoi modificare - le scelte in qualsiasi momento dal footer. + {ui.dialogIntroBefore}{cookieConsentMeta.policyVersion}{ui.dialogIntroAfter}

{cat.required ? ( - Sempre attivi + {ui.alwaysOnLabel} ) : (
diff --git a/src/data/about.ts b/src/data/about.ts new file mode 100644 index 0000000..2802e3b --- /dev/null +++ b/src/data/about.ts @@ -0,0 +1,208 @@ +/** + * Pagina Chi siamo / About / เกี่ยวกับเรา — contenuti localizzati. + */ +import type { SupportedLocale } from './home/navigation'; + +export type AboutBullet = { + title: string; + text: string; +}; + +export type AboutSection = { + title: string; + paragraphs?: readonly string[]; + bullets?: readonly AboutBullet[]; +}; + +type AboutLocaleBundle = { + page: { + title: string; + description: string; + heading: string; + lead: string; + }; + intro: string; + sections: readonly AboutSection[]; +}; + +const aboutByLocale: Record = { + it: { + page: { + title: 'Chi siamo — NexStudio', + description: + 'Missione, valori e come lavoriamo con studi legali e strutture sanitarie: qualità, verticalità e impegno nel tempo.', + heading: 'Chi siamo', + lead: + 'Siamo un team internazionale — tra Bangkok e l’Italia — che unisce ingegneria del software, intelligenza artificiale applicata e conoscenza dei domini regolamentati, per strumenti professionali usabili e sostenibili nel tempo.', + }, + intro: + 'Ci impegniamo a rendere la tecnologia invisibile nel lavoro quotidiano. Progettiamo software che assume su di sé processi strutturati, controlli e complessità computazionale, così che chi lavora su norme, pazienti o documentazione possa concentrarsi su giudizio, responsabilità e relazione — non su menu, formati o incertezze operative. Nascondere la complessità sotto interfaccia essenziale, tempi reattivi e tracciabilità è al centro di come disegniamo il prodotto, non un optional estetico.', + sections: [ + { + title: 'La nostra missione', + paragraphs: [ + 'Operiamo dove un errore pesa: Legal Tech e Health Tech. Qui servono precisione, tracciamento delle scelte e rispetto dei vincoli normativi, non sperimenti generici. La nostra missione è fornire piattaforme SaaS mature — come LexAura e MediAura — che integrino modelli d’intelligenza artificiale in flussi già vissuti dallo studio o dalla struttura, con continuità tra automazione, revisione umana e responsabilità riconoscibile.', + ], + }, + { + title: 'Perché possiamo meritare la tua fiducia', + paragraphs: [ + 'La fiducia non si ottiene con un motto, ma con ingegneria, chiarezza e continuità. Significa architetture provate, aggiornamenti regolari dei modelli d’analisi, assistenza e formazione laddove l’adozione chiede metodo oltre al click. Significa anche onestà sui confini: l’IA nelle nostre offerte è pensata per estendere e accelerare il lavoro professionale, lasciando a avvocato, medico o organizzazione la decisione finale e la documentazione che la norma richiede.', + ], + }, + { + title: 'Come lavoriamo, in sintesi', + bullets: [ + { + title: 'Verticalità e dominio.', + text: 'Less genericismo, più requisiti operativi (normative, flussi, audit) incorporati fin dalla progettazione.', + }, + { + title: 'Qualità e sicurezza come priorità, non retorica.', + text: 'Ingegneria, test e infrastrutture coerenti con l’esposizione a dati sensibili.', + }, + { + title: 'Supporto e evoluzione.', + text: 'Il rapporto con il cliente non finisce all’abbonamento: manutenzione evolutiva, assistenza e procedure chiare in caso di urgenze operative, dove serve.', + }, + { + title: 'Comunicazione trasparente.', + text: 'Documentazione, informativa privacy (dove obbligo) e aspettative reciproche esplicite, perché l’onboarding non diventi il primo ostacolo.', + }, + ], + }, + { + title: 'Team e cultura', + paragraphs: [ + 'Siamo developer, product e specialisti di dominio in un modello distribuito: fusi orari diversi e linguaggi comuni, un solo obiettivo prodotto. Ci muoviamo con iterazioni rapide laddove serve innovazione, e con governance laddove un cambiamento impatta validazione, conformità o continuità del servizio. La diversità del gruppo (competenze, contesti) è per noi vantaggio competitivo: riduce l’assunto implicito e costringe a rendere esplicito ciò che il software promette, e a chi.', + ], + }, + { + title: 'Impegno nel tempo', + paragraphs: [ + 'Il settore che ci sceglie non cerca un prototipo, ma un percorso sostenibile: allineamento normativo, adozione in team, affiancamento quando qualcosa non gira. Costruiamo e manteniamo il prodotto con quella lente, perché nelle vostre professioni la continuità non è comodità, è requisito.', + ], + }, + ], + }, + en: { + page: { + title: 'About us — NexStudio', + description: + 'Mission, values, and how we work with law firms and healthcare organizations: quality, domain focus, and long-term commitment.', + heading: 'About us', + lead: + 'We are an international team — between Bangkok and Italy — combining software engineering, applied artificial intelligence, and knowledge of regulated domains, for professional tools that are usable and sustainable over time.', + }, + intro: + 'We aim to make technology invisible in everyday work. We design software that takes on structured processes, controls, and computational complexity, so that people working with norms, patients, or documentation can focus on judgment, responsibility, and relationships — not on menus, formats, or operational uncertainty. Hiding complexity behind an essential interface, responsive performance, and traceability is central to how we design the product, not an aesthetic optional.', + sections: [ + { + title: 'Our mission', + paragraphs: [ + 'We operate where a mistake carries weight: Legal Tech and Health Tech. Here precision, choice tracking, and respect for regulatory constraints are required — not generic experiments. Our mission is to provide mature SaaS platforms — such as LexAura and MediAura — that integrate AI models into flows already lived by the firm or organization, with continuity between automation, human review, and recognizable responsibility.', + ], + }, + { + title: 'Why we can earn your trust', + paragraphs: [ + 'Trust is not won with a slogan, but with engineering, clarity, and continuity. It means proven architectures, regular updates to analysis models, and support and training where adoption needs method beyond the click. It also means honesty about boundaries: AI in our offerings is designed to extend and accelerate professional work, leaving the final decision and the documentation the rules require to the lawyer, clinician, or organization.', + ], + }, + { + title: 'How we work, in brief', + bullets: [ + { + title: 'Verticality and domain.', + text: 'Less genericism, more operational requirements (regulations, flows, audits) built in from design.', + }, + { + title: 'Quality and security as priorities, not rhetoric.', + text: 'Engineering, testing, and infrastructure aligned with exposure to sensitive data.', + }, + { + title: 'Support and evolution.', + text: 'The customer relationship does not end with the subscription: evolutionary maintenance, assistance, and clear procedures for operational emergencies where needed.', + }, + { + title: 'Transparent communication.', + text: 'Documentation, privacy notices (where required), and explicit mutual expectations, so onboarding is not the first obstacle.', + }, + ], + }, + { + title: 'Team and culture', + paragraphs: [ + 'We are developers, product people, and domain specialists in a distributed model: different time zones and shared languages, one product goal. We move with rapid iterations where innovation is needed, and with governance where a change affects validation, compliance, or service continuity. The diversity of the group (skills, contexts) is a competitive advantage for us: it reduces implicit assumptions and forces us to make explicit what the software promises, and to whom.', + ], + }, + { + title: 'Long-term commitment', + paragraphs: [ + 'The sector that chooses us is not looking for a prototype, but a sustainable path: regulatory alignment, team adoption, and support when something does not work. We build and maintain the product with that lens, because in your professions continuity is not a convenience — it is a requirement.', + ], + }, + ], + }, + th: { + page: { + title: 'เกี่ยวกับเรา — NexStudio', + description: + 'พันธกิจ คุณค่า และวิธีที่เราทำงานกับสำนักงานกฎหมายและองค์กรด้านสุขภาพ: คุณภาพ ความเชี่ยวชาญเชิงโดเมน และความมุ่งมั่นระยะยาว', + heading: 'เกี่ยวกับเรา', + lead: + 'เราเป็นทีมนานาชาติ — ระหว่างกรุงเทพฯ และอิตาลี — ที่ผสานวิศวกรรมซอฟต์แวร์ ปัญญาประดิษฐ์เชิงประยุกต์ และความรู้ในโดเมนที่มีการกำกับดูแล เพื่อเครื่องมือระดับมืออาชีพที่ใช้งานได้และยั่งยืนในระยะยาว', + }, + intro: + 'เรามุ่งทำให้เทคโนโลยีมองไม่เห็นในงานประจำวัน เราออกแบบซอฟต์แวร์ที่รับภาระกระบวนการที่มีโครงสร้าง การควบคุม และความซับซ้อนเชิงคำนวณ เพื่อให้ผู้ที่ทำงานกับกฎเกณฑ์ ผู้ป่วย หรือเอกสาร มุ่งเน้นที่การตัดสินใจ ความรับผิดชอบ และความสัมพันธ์ — ไม่ใช่เมนู รูปแบบ หรือความไม่แน่นอนในการปฏิบัติงาน การซ่อนความซับซ้อนไว้ใต้ส่วนติดต่อที่จำเป็น ประสิทธิภาพที่ตอบสนอง และการตรวจสอบย้อนกลับได้ เป็นหัวใจของการออกแบบผลิตภัณฑ์ ไม่ใช่ทางเลือกด้านสุนทรียะ', + sections: [ + { + title: 'พันธกิจของเรา', + paragraphs: [ + 'เราดำเนินงานในที่ที่ความผิดพลาดมีน้ำหนัก: Legal Tech และ Health Tech ที่นี่ต้องการความแม่นยำ การติดตามการตัดสินใจ และการเคารพข้อจำกัดด้านกฎระเบียบ — ไม่ใช่การทดลองทั่วไป พันธกิจของเราคือการมอบแพลตฟอร์ม SaaS ที่เติบโตแล้ว — เช่น LexAura และ MediAura — ที่ผสานโมเดลปัญญาประดิษฐ์เข้ากับเวิร์กโฟลว์ที่สำนักงานหรือองค์กรใช้อยู่แล้ว โดยมีความต่อเนื่องระหว่างระบบอัตโนมัติ การตรวจสอบโดยมนุษย์ และความรับผิดชอบที่ระบุได้', + ], + }, + { + title: 'เหตุใดเราจึงสมควรได้รับความไว้วางใจ', + paragraphs: [ + 'ความไว้วางใจไม่ได้มาจากคำขวัญ แต่มาจากวิศวกรรม ความชัดเจน และความต่อเนื่อง หมายถึงสถาปัตยกรรมที่พิสูจน์แล้ว การอัปเดตโมเดลการวิเคราะห์อย่างสม่ำเสมอ รวมถึงการสนับสนุนและการอบรมเมื่อการนำมาใช้ต้องการวิธีการมากกว่าการคลิก และยังหมายถึงความซื่อสัตย์เรื่องขอบเขต: AI ในข้อเสนอของเราออกแบบมาเพื่อขยายและเร่งงานระดับมืออาชีพ โดยปล่อยให้ทนายความ แพทย์ หรือองค์กรเป็นผู้ตัดสินใจขั้นสุดท้ายและจัดทำเอกสารตามที่กฎกำหนด', + ], + }, + { + title: 'วิธีที่เราทำงาน โดยสรุป', + bullets: [ + { + title: 'ความเชี่ยวชาญเชิงแนวตั้งและโดเมน', + text: 'น้อยลงในความเป็นทั่วไป มากขึ้นในข้อกำหนดเชิงปฏิบัติการ (กฎระเบียบ เวิร์กโฟลว์ การตรวจสอบ) ที่ฝังตั้งแต่การออกแบบ', + }, + { + title: 'คุณภาพและความปลอดภัยเป็นลำดับแรก ไม่ใช่คำพูดสวยหรู', + text: 'วิศวกรรม การทดสอบ และโครงสร้างพื้นฐานที่สอดคล้องกับการสัมผัสข้อมูลที่ละเอียดอ่อน', + }, + { + title: 'การสนับสนุนและการพัฒนาต่อเนื่อง', + text: 'ความสัมพันธ์กับลูกค้าไม่จบที่การสมัครสมาชิก: การบำรุงรักษาเชิงวิวัฒนาการ ความช่วยเหลือ และขั้นตอนที่ชัดเจนเมื่อมีเหตุฉุกเฉินในการดำเนินงานตามที่จำเป็น', + }, + { + title: 'การสื่อสารที่โปร่งใส', + text: 'เอกสาร ประกาศความเป็นส่วนตัว (เมื่อกฎหมายกำหนด) และความคาดหวังร่วมกันที่ชัดเจน เพื่อไม่ให้ออนบอร์ดดิ้งเป็นอุปสรรคแรก', + }, + ], + }, + { + title: 'ทีมและวัฒนธรรม', + paragraphs: [ + 'เราเป็นนักพัฒนา ผู้ดูแลผลิตภัณฑ์ และผู้เชี่ยวชาญโดเมนในโมเดลแบบกระจาย: เขตเวลาต่างกันและภาษาที่ร่วมกัน เป้าหมายผลิตภัณฑ์เดียว เราเคลื่อนไหวด้วยการทำซ้ำอย่างรวดเร็วเมื่อต้องการนวัตกรรม และด้วยการกำกับดูแลเมื่อการเปลี่ยนแปลงกระทบการตรวจสอบ ความสอดคล้อง หรือความต่อเนื่องของบริการ ความหลากหลายของกลุ่ม (ทักษะ บริบท) เป็นข้อได้เปรียบในการแข่งขันสำหรับเรา: ลดสมมติฐานโดยนัยและบังคับให้ทำให้ชัดเจนว่าซอฟต์แวร์สัญญาอะไร และกับใคร', + ], + }, + { + title: 'ความมุ่งมั่นในระยะยาว', + paragraphs: [ + 'ภาคส่วนที่เลือกเราไม่ได้มองหาต้นแบบ แต่เป็นเส้นทางที่ยั่งยืน: การปรับให้สอดคล้องกับกฎระเบียบ การนำไปใช้ในทีม และการสนับสนุนเมื่อมีสิ่งที่ไม่ทำงาน เราสร้างและดูแลผลิตภัณฑ์ด้วยมุมมองนั้น เพราะในวิชาชีพของท่าน ความต่อเนื่องไม่ใช่ความสะดวก — เป็นข้อกำหนด', + ], + }, + ], + }, +}; + +export const getAbout = (locale: SupportedLocale) => aboutByLocale[locale]; diff --git a/src/data/codice-etico.ts b/src/data/codice-etico.ts index bfe6b91..b8d2c5f 100644 --- a/src/data/codice-etico.ts +++ b/src/data/codice-etico.ts @@ -1,15 +1,9 @@ /** * Codice etico — riferimenti a prodotti e domini **separati in dati**: * aggiungere una riga a `productLines` e, se serve, un `ConformityBlock` in - * `codiceEticoConformityBlocks` senza riscrivere la pagina intera. + * `conformityBlocks` senza riscrivere la pagina intera. */ -export const codiceEtico = { - productLines: [ - { id: 'platform' as const, name: 'Piattaforme e servizi SaaS' }, - { id: 'legal' as const, name: 'Legal Tech', productName: 'LexAura' as const }, - { id: 'health' as const, name: 'Health Tech', productName: 'MediAura' as const }, - ], -} as const; +import type { SupportedLocale } from './home/navigation'; export type ConformityBlock = { id: string; @@ -19,117 +13,1613 @@ export type ConformityBlock = { items: readonly string[]; }; -/** - * Sezione 4 — sottosezioni indipendenti. Per una nuova verticalità (es. fintech - * regolamentato): `productLines` + un nuovo blocco qui, più eventuali li dedicati - * altrove mappati da un piccolo elenco in questo file. - */ -export const codiceEticoConformityBlocks: readonly ConformityBlock[] = [ - { - id: 'platform', - anchorId: 'conformita-piattaforma', - title: '4.1 Piattaforma e offerta SaaS (obblighi orizzontali)', - lead: - 'Riferimenti comuni a tutte le attività di trattamento e a tutte le linee in abbonamento, indipendentemente dal dominio del cliente finale.', - items: [ - 'Thailand Personal Data Protection Act (PDPA).', - "Regolamento generale sulla protezione dei dati (GDPR), quando applicabile per utenti o servizi nell'Unione europea.", - ], - }, - { - id: 'legal', - anchorId: 'conformita-legal', - title: '4.2 Ambito legale (Legal Tech / LexAura)', - lead: - 'Misure e riferimenti per software e flussi ad uso di studi legali e professioni regolamentate, inclusa l’attività riferibile a LexAura o ad evoluzioni nello stesso dominio.', - items: [ - 'Norme professionali e di segreto professionale per l’esercizio forense; rispetto di privilegi professionali (ad es. attorney–client privilege) ove applicabili; lealtà e correttezza verso controparti e terzi, nei limiti della legge e deontologia.', - ], - }, - { - id: 'health', - anchorId: 'conformita-sanitario', - title: '4.3 Ambito sanitario (Health Tech / MediAura)', - lead: - 'Dati, rischi e, se del caso, classificazioni regolatorie riferibili a Health Tech e a MediAura (e prodotti nello stesso perimetro).', - items: [ - 'Normative sanitarie e standard locali o internazionali pertinenti (requisiti per la gestione dei dati clinici, standard ISO rilevanti, continuità assistenziale ove toccata dal software).', - 'Requisiti per dispositivi medici o software a scopo medico (es. EU MDR, regolamenti locali) se le funzionalità rientrano nella definizione di dispositivo medico o equivalente per il mercato prescelto.', - "Norme e buone pratiche su segreto e riservatezza in ambito sanitario (es. relazioni con operatori) e, se applicabile: HIPAA (Stati Uniti) oltre a quanto già previsto a livello orizzontale (GDPR, PDPA) per i trasferimenti.", - ], - }, -] as const; +export type LabeledItem = { + label: string; + text: string; +}; -type ProductLine = (typeof codiceEtico.productLines)[number]; +type ProductLine = + | { id: 'platform'; name: string } + | { id: 'legal' | 'health'; name: string; productName: string }; -export function getCodiceEticoProductListPhrase(): string { - const lines = codiceEtico.productLines.filter( - (p): p is ProductLine & { id: 'legal' | 'health' } => p.id !== 'platform', +type CodiceEticoLocale = { + page: { + title: string; + description: string; + heading: string; + lead: string; + versionLabel: string; + inForceLabel: string; + inForceDate: string; + indexTitle: string; + contactsTitle: string; + signatureLabel: string; + dateLabel: string; + anonymousPlatformNote: string; + }; + index: readonly { + href: string; + label: string; + children?: readonly { href: string; label: string }[]; + }[]; + productLines: readonly ProductLine[]; + productListJoiner: string; + premessaTitle: string; + premessaBefore: string; + premessaAfter: string; + ambito: { title: string; text: string }; + valori: { title: string; items: readonly string[] }; + conformita: { + title: string; + introBefore: string; + introAfter: string; + afterBlocks: string; + }; + conformityBlocks: readonly ConformityBlock[]; + tutelaDati: { + title: string; + operationalIntro: string; + principles: readonly LabeledItem[]; + }; + tutelaDatiRuoli: { + anchorId: string; + title: string; + intro: string; + rows: readonly LabeledItem[]; + note: string; + }; + sicurezza: { title: string; items: readonly LabeledItem[] }; + qualita: { + title: string; + itemsBefore: readonly LabeledItem[]; + validazioneLabelLegal: string; + validazioneLabelHealth: string; + itemsAfter: readonly LabeledItem[]; + }; + qualitaValidazioneProdotto: readonly { id: string; text: string }[]; + proprieta: { + title: string; + items: readonly ({ kind: 'text'; text: string } | { kind: 'labeled'; label: string; text: string })[]; + }; + ai: { title: string; items: readonly (string | LabeledItem)[] }; + conflitti: { title: string; items: readonly string[] }; + lineeOperative: { title: string; items: readonly LabeledItem[] }; + governance: { title: string; items: readonly LabeledItem[] }; + onboarding: { + title: string; + item1Before: string; + item1After: string; + itemsRest: readonly string[]; + }; + segnalazioni: { + title: string; + channelsLabel: string; + channelsBefore: string; + channelsAfter: string; + protection: LabeledItem; + investigations: LabeledItem; + }; + violazioni: { title: string; items: readonly string[] }; + monitoraggio: { + title: string; + items: readonly (string | LabeledItem)[]; + }; + documentazione: { + title: string; + intro: string; + items: readonly string[]; + }; + allegati: { title: string; items: readonly string[] }; + approvazione: { + title: string; + items: readonly LabeledItem[]; + contacts: readonly { label: string; email: string; note?: string }[]; + }; + adesione: { title: string; textBefore: string; textAfter: string }; + notePratiche: { + title: string; + items: readonly string[]; + }; + notePraticheDPIA: readonly string[]; +}; + +const codiceEticoByLocale: Record = { + it: { + page: { + title: 'Codice etico — NexStudio', + description: + 'Codice etico definitivo NexStudio: valori, conformità legale e sanitaria, privacy, sicurezza, AI, governance e segnalazioni.', + heading: 'Codice etico definitivo', + lead: 'Per NexStudio — sede: Bangkok, Thailandia. Versione 1.0, in vigore dal 21 aprile 2026. Documento interno ed esterno: principi, obblighi e procedure operative per chi collabora con la Società.', + versionLabel: 'Versione', + inForceLabel: 'Entrata in vigore', + inForceDate: '21 aprile 2026', + indexTitle: 'Indice sintetico', + contactsTitle: 'Contatti', + signatureLabel: 'Firma', + dateLabel: 'Data', + anonymousPlatformNote: '(o link a piattaforma anonima dedicata)', + }, + index: [ + { href: '#premessa', label: 'Premessa' }, + { href: '#ambito', label: 'Ambito di applicazione' }, + { href: '#valori', label: 'Valori e principi fondamentali' }, + { + href: '#conformita', + label: 'Conformità normativa (per perimetro: piattaforma, legale, sanitario)', + children: [ + { href: '#conformita-piattaforma', label: '4.1 Piattaforma e SaaS (orizzontale)' }, + { href: '#conformita-legal', label: '4.2 Ambito legale (LexAura)' }, + { href: '#conformita-sanitario', label: '4.3 Ambito sanitario (MediAura)' }, + ], + }, + { + href: '#tutela-dati', + label: 'Tutela dei dati personali e dati sensibili', + children: [ + { href: '#tutela-dati-ruoli', label: '5.1 Ruoli: pazienti, clienti, abbonati, Società' }, + ], + }, + { href: '#sicurezza', label: 'Sicurezza dell’informazione e resilienza operativa' }, + { href: '#qualita', label: 'Qualità del software, validazione clinica e rischio per gli utenti' }, + { href: '#proprieta-intellettuale', label: 'Proprietà intellettuale e uso di componenti esterni' }, + { href: '#ai-ml', label: 'Uso responsabile di AI/ML e automazione' }, + { href: '#conflitti', label: 'Conflitti di interesse e integrità commerciale' }, + { href: '#linee-operative', label: 'Linee operative: sviluppo, rilascio e gestione vulnerabilità' }, + { href: '#governance', label: 'Governance, ruoli e responsabilità' }, + { href: '#onboarding', label: 'Onboarding, formazione e certificazione' }, + { href: '#segnalazioni', label: 'Segnalazioni, protezione del segnalante e investigazioni' }, + { href: '#violazioni', label: 'Gestione delle violazioni e sanzioni' }, + { href: '#monitoraggio', label: 'Monitoraggio, audit e miglioramento continuo' }, + { href: '#documentazione', label: 'Documentazione obbligatoria e registri' }, + { href: '#allegati', label: 'Allegati e moduli' }, + { href: '#approvazione', label: 'Approvazione e contatti utili' }, + ], + productLines: [ + { id: 'platform', name: 'Piattaforme e servizi SaaS' }, + { id: 'legal', name: 'Legal Tech', productName: 'LexAura' }, + { id: 'health', name: 'Health Tech', productName: 'MediAura' }, + ], + productListJoiner: ' e ', + premessaTitle: '1. Premessa', + premessaBefore: + 'Questo Codice Etico stabilisce i principi, i doveri e le regole di comportamento che tutti i soggetti coinvolti in NexStudio (di seguito «Società») devono osservare nello sviluppo, nella commercializzazione e nella gestione di soluzioni SaaS, con riferimento organizzato per linee (piattaforma comune, ambito legale, ambito sanitario) e, in concreto, in particolare a ', + premessaAfter: + ". Se l'offerta si arricchirà o diverrà, le nuove linee a elevata regolamentazione andranno descritte con lo stesso schema (piattaforma + perimetro di dominio), tramite allegati o revisione del testo, senza mescolare criteri tra verticalità. Mira a garantire conformità normativa, tutela della privacy, sicurezza, qualità tecnica, protezione dei diritti degli utenti e responsabilità professionale.", + ambito: { + title: '2. Ambito di applicazione', + text: 'Si applica a: fondatori, dirigenti, dipendenti (full-time, part-time), collaboratori esterni, consulenti, appaltatori e fornitori. Copre tutte le attività: analisi, progettazione, sviluppo, test, rilascio, manutenzione, supporto, marketing, vendite e ricerca.', + }, + valori: { + title: '3. Valori e principi fondamentali', + items: [ + 'Integrità, onestà e trasparenza.', + 'Rispetto della dignità umana, inclusione e non discriminazione.', + 'Responsabilità tecnico-professionale e qualità del servizio.', + 'Riservatezza e protezione dei dati personali e sensibili.', + 'Sicurezza e resilienza operativa.', + 'Conformità legale e regolamentare.', + 'Miglioramento continuo e accountability.', + ], + }, + conformita: { + title: '4. Conformità normativa specifica', + introBefore: + 'I riferimenti sotto sono raggruppati: obblighi orizzontali a tutte le offerte SaaS, riferimenti distinti per il perimetro Legal Tech / LexAura e per Health Tech / MediAura (ciascuna linea può estendersi o diversificare secondo prodotto e mercato, senza commistione indebita ad altri perimetri). Riepilogo riga prodotto: ', + introAfter: '.', + afterBlocks: + 'La Società effettua DPIA (Data Protection Impact Assessment) per trattamenti ad alto rischio e consulta autorità o regulatory counsel quando necessario, con riferimenti per ciascun trattamento al perimetro (piattaforma, legale, sanitario) ove interessa.', + }, + conformityBlocks: [ + { + id: 'platform', + anchorId: 'conformita-piattaforma', + title: '4.1 Piattaforma e offerta SaaS (obblighi orizzontali)', + lead: + 'Riferimenti comuni a tutte le attività di trattamento e a tutte le linee in abbonamento, indipendentemente dal dominio del cliente finale.', + items: [ + 'Thailand Personal Data Protection Act (PDPA).', + "Regolamento generale sulla protezione dei dati (GDPR), quando applicabile per utenti o servizi nell'Unione europea.", + ], + }, + { + id: 'legal', + anchorId: 'conformita-legal', + title: '4.2 Ambito legale (Legal Tech / LexAura)', + lead: + 'Misure e riferimenti per software e flussi ad uso di studi legali e professioni regolamentate, inclusa l’attività riferibile a LexAura o ad evoluzioni nello stesso dominio.', + items: [ + 'Norme professionali e di segreto professionale per l’esercizio forense; rispetto di privilegi professionali (ad es. attorney–client privilege) ove applicabili; lealtà e correttezza verso controparti e terzi, nei limiti della legge e deontologia.', + ], + }, + { + id: 'health', + anchorId: 'conformita-sanitario', + title: '4.3 Ambito sanitario (Health Tech / MediAura)', + lead: + 'Dati, rischi e, se del caso, classificazioni regolatorie riferibili a Health Tech e a MediAura (e prodotti nello stesso perimetro).', + items: [ + 'Normative sanitarie e standard locali o internazionali pertinenti (requisiti per la gestione dei dati clinici, standard ISO rilevanti, continuità assistenziale ove toccata dal software).', + 'Requisiti per dispositivi medici o software a scopo medico (es. EU MDR, regolamenti locali) se le funzionalità rientrano nella definizione di dispositivo medico o equivalente per il mercato prescelto.', + 'Norme e buone pratiche su segreto e riservatezza in ambito sanitario (es. relazioni con operatori) e, se applicabile: HIPAA (Stati Uniti) oltre a quanto già previsto a livello orizzontale (GDPR, PDPA) per i trasferimenti.', + ], + }, + ], + tutelaDati: { + title: '5. Tutela dei dati personali e dati sensibili', + operationalIntro: + 'Nella concreta operatività, la Società e i collaboratori si attengono ai principi operativi seguenti (complementari ai ruoli sopra):', + principles: [ + { label: 'Minimizzazione', text: 'raccogliere solo i dati necessari e pertinenti.' }, + { + label: 'Base giuridica', + text: 'documentare la base legale per ogni trattamento (consenso, esecuzione del contratto, obbligo legale, interesse legittimo valutato).', + }, + { + label: 'Informativa e consenso', + text: 'fornire informative chiare e ottenere consensi quando richiesto; gestire il consenso in modo verificabile.', + }, + { + label: 'Classificazione', + text: 'definire categorie (PII, dati sanitari, informazioni legali privilegiate) e applicare misure differenziate.', + }, + { + label: 'Conservazione e cancellazione', + text: 'politiche di retention documentate; anonimizzazione o cancellazione al termine delle finalità.', + }, + { + label: 'Trasferimenti internazionali', + text: 'valutare basi legali (clausole contrattuali standard, decisioni di adeguatezza, misure tecniche) per trasferimenti fuori dalla Thailandia.', + }, + { + label: 'Diritti degli interessati', + text: 'procedure per accesso, rettifica, cancellazione, limitazione, portabilità e opposizione, con tempi e log documentati.', + }, + { + label: 'Sub-processori', + text: 'contratti che impongono misure di sicurezza equivalenti, obblighi di notifica in caso di violazione (breach) e divieti di ulteriori sub-affidamenti non autorizzati.', + }, + ], + }, + tutelaDatiRuoli: { + anchorId: 'tutela-dati-ruoli', + title: '5.1 Pazienti, clienti degli studi e abbonamento: ruoli e trattamento', + intro: + 'Sì, va spiegata la divisione di ruoli: il Codice fissa cosa ci aspettiamo da ciascuna parte, senza sostituire l’informativa privacy né i contratti. Sotto, in sintesi, chi tratta i dati dei pazienti e dei clienti rispetto agli studi e con quali doveri (Società, sottoscrittori, interessati).', + rows: [ + { + label: 'NexStudio (fornitore / operatore del servizio)', + text: 'La Società tratta dati personali e, ove presenti, categorie particolari (es. salute, situazione giuridica) solo per fornire, proteggere e migliorare le piattaforme, per supporto, sicurezza, fatturazione, adempimenti di legge e, se contrattualmente previsto, per assistere il titolare nell’onorare i diritti degli interessati. Divieto, per chi lavora in Società, di usi incompatibili, di rivendere i dati a scopi estranei al servizio, e di accedere al contenuto professionale oltre quanto necessario tecnicamente o per la gestione del supporto autorizzata. Le qualifiche giuridiche esatte (es. responsabile del trattamento, art. 28 GDPR, o altro schema sotto PDPA) sono definite per iscritto in DPA e documenti privacy.', + }, + { + label: 'Sottoscrittori in abbonamento (studi legali, medici, strutture, team iscritti)', + text: 'I sottoscrittori sono, di regola, titolari o co-titolari del trattamento sui dati che inseriscono o fanno inserire nella piattaforma: in particolare pazienti o assistiti (Health Tech) e clienti, controparti o terzi coinvolti in fascicoli o pratiche (Legal Tech), oltre ai dati del proprio personale. Devono: avere base giuridica e informative adeguate verso i propri pazienti, clienti e assistiti, rispettare obblighi deontologici (segreto, riservatezza, tenuta degli atti), mappare finalità e tempi, dare istruzioni documentate al fornitore ove serva la nomina di responsabile, e rispondere in prima istanza alle richieste di accesso, rettifica, cancellazione e opposizione degli interessati, collaborando con NexStudio quando servono strumenti tecnici o log.', + }, + { + label: 'Pazienti e clienti (interessati)', + text: 'Esercitano i diritti privacy in primis verso lo studio, la struttura o il professionista che tratti i loro dati. NexStudio, salvo esercizio diretto previsto per legge o canale specifico, inoltra o supporta l’esercizio attraverso il titolare, nei tempi e modi del contratto e del prodotto.', + }, + ], + note: + 'I dettagli operativi (categorie, tempi, tabella del trattamento, sub-responsabili, trasferimenti extra-UE, testi informativa rivolti a pazienti o clienti delle parti) stanno in Privacy policy, informativa cookie, DPA, condizioni d’uso e allegati, aggiornabili senza riformulare l’intero Codice quando cambia solo l’allegato legale.', + }, + sicurezza: { + title: '6. Sicurezza dell’informazione e resilienza operativa', + items: [ + { + label: 'Security by design e privacy by design', + text: 'integrazione di sicurezza e privacy nel ciclo di vita del prodotto.', + }, + { + label: 'Controlli di accesso', + text: 'principio del privilegio minimo, MFA obbligatorio per accesso a risorse sensibili, gestione centralizzata delle identità.', + }, + { + label: 'Crittografia', + text: 'cifratura a riposo e in transito con algoritmi aggiornati; gestione sicura delle chiavi.', + }, + { + label: 'Logging e monitoraggio', + text: 'log immutabili per accessi e operazioni su dati sensibili e ambienti di produzione.', + }, + { + label: 'Vulnerability management', + text: 'scansioni automatiche, penetration test periodici, processo di patching e programma di responsible disclosure o bug bounty.', + }, + { + label: 'Continuità operativa e disaster recovery', + text: 'piani testati regolarmente con RTO/RPO definiti.', + }, + { + label: 'Gestione incidenti', + text: 'playbook documentato (identificazione, containment, eradicazione, recovery, post-mortem), ruoli e tempi di notifica interni ed esterni.', + }, + ], + }, + qualita: { + title: '7. Qualità del software, validazione clinica e rischio per gli utenti', + itemsBefore: [ + { + label: 'Standard di sviluppo', + text: 'codice leggibile, test automatici, code review obbligatorie, CI/CD sicuro.', + }, + { + label: 'Test e copertura', + text: 'definire copertura minima per componenti critici; test di integrazione, performance e sicurezza.', + }, + ], + validazioneLabelLegal: 'Validazione (per perimetro legale)', + validazioneLabelHealth: 'Validazione (per perimetro sanitario)', + itemsAfter: [ + { + label: 'Classificazione del rischio', + text: 'valutare impatto su salute o diritti e applicare misure di mitigazione proporzionate.', + }, + { + label: 'Non sostituzione del professionista', + text: 'la piattaforma fornisce supporto e strumenti informativi; non si presenta come sostitutiva di pareri professionali senza esplicita supervisione e avallo professionale.', + }, + { + label: 'Registri ed evidenze', + text: 'mantenere documentazione di test clinici, valutazioni di rischio e approvazioni regolatorie.', + }, + ], + }, + qualitaValidazioneProdotto: [ + { + id: 'legal', + text: 'per funzionalità che supportano scelte o attività in ambito legale, validazione con esperti legali, studi pilota, documentazione di limiti e avvertenze, così come previsto per LexAura o equivalenti in Legal Tech.', + }, + { + id: 'health', + text: 'per funzionalità che assistono decisioni cliniche o attività sanitarie, validazione con esperti clinici, studi pilota, avvertenze, così come previsto per MediAura o equivalenti in Health Tech.', + }, + ], + proprieta: { + title: '8. Proprietà intellettuale e uso di componenti esterni', + items: [ + { + kind: 'text', + text: 'I contributi di dipendenti e consulenti inerenti a software, documentazione e know-how sono di proprietà della Società, salvo diverso accordo scritto.', + }, + { + kind: 'labeled', + label: 'Open source', + text: 'mantenere SBOM (Software Bill of Materials), verificare la compatibilità delle licenze, rispettare obblighi di disclosure e aggiornamento delle patch.', + }, + { + kind: 'text', + text: 'Divieto di uso non autorizzato di codice o proprietà intellettuale di terzi; gestione dei rischi di contaminazione IP.', + }, + ], + }, + ai: { + title: '9. Uso responsabile di AI/ML e automazione', + items: [ + 'Documentare dataset di training, provenienza, pre-elaborazione e limiti noti.', + { + label: 'Bias assessment', + text: 'condurre analisi per identificare e mitigare pregiudizi che possano discriminare o causare danni.', + }, + { + label: 'Supervisione umana', + text: 'per decisioni che influenzano salute, procedimenti legali o diritti fondamentali, prevedere supervisione umana e avvisi chiari sui limiti del sistema.', + }, + { + label: 'Explainability e responsabilità', + text: 'fornire informazioni comprensibili su come i modelli supportano le decisioni e su prestazioni e affidabilità.', + }, + { + label: 'Monitoraggio post-release', + text: 'misurare le prestazioni in produzione e correggere drift o comportamenti inattesi.', + }, + ], + }, + conflitti: { + title: '10. Conflitti di interesse e integrità commerciale', + items: [ + 'Dichiarazione obbligatoria di conflitti reali o potenziali (investimenti, relazioni con fornitori o clienti).', + 'Politiche anticorruzione e anti-tangenti conformi a leggi nazionali e internazionali.', + 'Comunicazioni commerciali veritiere; non ingannare su capacità, approvazioni regolatorie o risultati.', + 'Trasparenza contrattuale: SLA, limitazioni di responsabilità e condizioni d’uso chiare e accessibili.', + ], + }, + lineeOperative: { + title: '11. Linee operative: sviluppo, rilascio e gestione vulnerabilità', + items: [ + { + label: 'Sviluppo', + text: 'strategia di branch, code review obbligatoria, merge solo con CI positiva, checklist pre-release (sicurezza, privacy, compliance).', + }, + { + label: 'Ambiente di test', + text: 'uso di dati sintetici o anonimizzati; accesso a dati reali solo su base minima e autorizzata, in ambienti isolati.', + }, + { + label: 'Deployment', + text: 'CI/CD standardizzato con piano di rollback e rilasci graduali per funzionalità critiche.', + }, + { + label: 'Gestione vulnerabilità', + text: 'canale pubblico o privato per segnalazioni (bug bounty o indirizzo dedicato security@), conferma di ricezione entro 72 ore, piano di remediation con tempi stimati.', + }, + { + label: 'Patch management', + text: 'tempi di rilascio delle patch definiti in base alla severità.', + }, + { + label: 'Documentazione di rilascio', + text: 'changelog, impatti noti e raccomandazioni operative.', + }, + ], + }, + governance: { + title: '12. Governance, ruoli e responsabilità', + items: [ + { label: 'Board / fondatori', text: 'approvano le politiche, definiscono strategia e risorse.' }, + { label: 'CEO', text: 'responsabilità complessiva di conformità e governance.' }, + { label: 'CTO', text: 'qualità tecnica, architettura e pratiche di sviluppo.' }, + { + label: 'CISO / responsabile sicurezza', + text: 'sicurezza operativa, risposta agli incidenti, gestione delle vulnerabilità.', + }, + { + label: 'DPO / referente privacy', + text: 'conformità PDPA e GDPR, DPIA, gestione richieste degli interessati.', + }, + { + label: 'Legal & compliance', + text: 'supervisione legale, contratti e valutazioni regolatorie.', + }, + { label: 'HR', text: 'formazione, codice di condotta e gestione disciplinare.' }, + { + label: 'Team lead / PM', + text: 'applicano le policy operative e garantiscono conformità quotidiana.', + }, + { + label: 'Comitato etico (consigliato)', + text: 'gruppo multidisciplinare per valutare casi complessi (impatti clinici o legali, conflitti), con riunioni periodiche e su richiesta.', + }, + ], + }, + onboarding: { + title: '13. Onboarding, formazione e certificazione', + item1Before: + 'Onboarding obbligatorio su: sicurezza informatica, privacy (PDPA e GDPR), gestione dati sensibili, requisiti e documentazione riferibili a ciascuna linea prodotto (oggi: ', + item1After: + '; estendere il curriculum quando l’elenco cresce), uso responsabile dell’AI, pratiche di coding sicuro.', + itemsRest: [ + 'Formazione annuale obbligatoria e formazione aggiuntiva per ruoli critici.', + 'Registrazione e conservazione dei record di formazione.', + ], + }, + segnalazioni: { + title: '14. Segnalazioni, protezione del segnalante e investigazioni', + channelsLabel: 'Canali', + channelsBefore: 'almeno un canale confidenziale interno (es.', + channelsAfter: + '), piattaforma anonima esterna o servizio terzo; contatto per escalation indipendente.', + protection: { + label: 'Protezione', + text: 'divieto di ritorsioni; misure disciplinari per ritorsioni comprovate.', + }, + investigations: { + label: 'Indagini', + text: 'condotte in modo imparziale, documentato e con tempi definiti; comunicazione dei risultati alla persona segnalante e alle parti interessate, nei limiti della riservatezza.', + }, + }, + violazioni: { + title: '15. Gestione delle violazioni e sanzioni', + items: [ + 'Azioni proporzionate alla gravità: formazione correttiva, richiamo, riassegnazione, sospensione, risoluzione del rapporto contrattuale, azioni legali se necessario.', + 'Registro delle infrazioni e delle azioni intraprese; diritto di difesa dell’interessato.', + ], + }, + monitoraggio: { + title: '16. Monitoraggio, audit e miglioramento continuo', + items: [ + 'Audit interni ed esterni regolari su sicurezza, privacy, compliance e controllo qualità.', + { + label: 'KPI (esempi)', + text: 'numero di incidenti, tempo medio di remediation, percentuale di copertura dei test, percentuale di formazione completata, tempo medio di risposta alle segnalazioni.', + }, + 'Revisione del Codice: almeno annuale o in caso di cambiamenti normativi, tecnologici o di mercato.', + ], + }, + documentazione: { + title: '17. Documentazione obbligatoria e registri', + intro: 'La Società mantiene e aggiorna, tra l’altro:', + items: [ + 'registro dei trattamenti e DPIA;', + 'SBOM e inventario dei componenti (open source);', + 'log di accesso e audit trail;', + 'registro incidenti e violazioni dei dati;', + 'contratti con fornitori e sub-processori;', + 'record di formazione e dichiarazioni di adesione al Codice.', + ], + }, + allegati: { + title: '18. Allegati e moduli (inclusi)', + items: [ + 'Dichiarazione personale di adesione al Codice (da firmare in onboarding).', + 'Template NDA e clausole minime per fornitori e sub-processori.', + 'Checklist pre-release (security e privacy).', + 'Flowchart gestione incidenti e template di notifica.', + 'Modello DPIA semplificato ed esempio compilato.', + 'Modello informativa privacy e modulo consenso per utenti o pazienti.', + 'Template SBOM.', + 'Policy di retention dei dati (tempi e giustificazioni).', + 'Template per valutazione d’impatto AI/ML.', + ], + }, + approvazione: { + title: '19. Approvazione e contatti utili', + items: [ + { + label: 'Approvato da', + text: 'organo competente / amministratore delegato (nome e cognome alla firma).', + }, + { + label: 'Responsabile aggiornamenti', + text: 'Legal & compliance, con supporto di DPO e CISO.', + }, + { + label: 'Revisione', + text: 'minimo annuale o a fronte di mutamenti rilevanti.', + }, + ], + contacts: [ + { label: 'DPO / referente privacy', email: 'privacy@nexstudio.com' }, + { label: 'Security / incident response', email: 'security@nexstudio.com' }, + { + label: 'Segnalazioni confidenziali', + email: 'ethics@nexstudio.com', + note: 'anonymous', + }, + { label: 'Legal', email: 'legal@nexstudio.com' }, + { label: 'HR', email: 'hr@nexstudio.com' }, + ], + }, + adesione: { + title: 'Clausola finale di adesione (da firmare in onboarding)', + textBefore: 'Dichiaro di aver letto e compreso il Codice Etico di ', + textAfter: + ' e mi impegno a rispettarne i principi e le procedure. Mi impegno inoltre a segnalare, in buona fede, eventuali violazioni di cui dovessi venire a conoscenza.', + }, + notePratiche: { + title: 'Note pratiche e prossimi passi consigliati', + items: [ + 'Personalizzare il documento con il nome ufficiale della società (se diverso dal marchio operativo), firme e riferimenti legali locali a Bangkok.', + 'Allegare i template elencati come documenti separati e implementare i canali tecnici per segnalazioni e bug bounty.', + 'Predisporre un piano di formazione di 90 giorni per l’onboarding e formazione ricorrente annuale.', + ], + }, + notePraticheDPIA: [ + 'Eseguire DPIA per trattamenti critici per ciascun perimetro (in particolare trattamenti sanitari o legali a elevata criticità) documentando il nesso con le linee prodotto coinvolte.', + 'Per la linea Health Tech / MediAura o equivalenti, verificare se parti del prodotto rientrano nella definizione di dispositivo medico o software a scopo medico, ai fini di registrazione o approvazione secondo il mercato e la classificazione scelta.', + ], + }, + en: { + page: { + title: 'Code of ethics — NexStudio', + description: + 'NexStudio definitive code of ethics: values, legal and healthcare compliance, privacy, security, AI, governance and reporting.', + heading: 'Definitive code of ethics', + lead: 'For NexStudio — headquarters: Bangkok, Thailand. Version 1.0, effective from 21 April 2026. Internal and external document: principles, obligations and operating procedures for anyone working with the Company.', + versionLabel: 'Version', + inForceLabel: 'Effective from', + inForceDate: '21 April 2026', + indexTitle: 'Summary index', + contactsTitle: 'Contacts', + signatureLabel: 'Signature', + dateLabel: 'Date', + anonymousPlatformNote: '(or link to a dedicated anonymous platform)', + }, + index: [ + { href: '#premessa', label: 'Preamble' }, + { href: '#ambito', label: 'Scope of application' }, + { href: '#valori', label: 'Core values and principles' }, + { + href: '#conformita', + label: 'Regulatory compliance (by perimeter: platform, legal, healthcare)', + children: [ + { href: '#conformita-piattaforma', label: '4.1 Platform and SaaS (horizontal)' }, + { href: '#conformita-legal', label: '4.2 Legal domain (LexAura)' }, + { href: '#conformita-sanitario', label: '4.3 Healthcare domain (MediAura)' }, + ], + }, + { + href: '#tutela-dati', + label: 'Protection of personal and sensitive data', + children: [ + { + href: '#tutela-dati-ruoli', + label: '5.1 Roles: patients, clients, subscribers, Company', + }, + ], + }, + { href: '#sicurezza', label: 'Information security and operational resilience' }, + { + href: '#qualita', + label: 'Software quality, clinical validation and user risk', + }, + { + href: '#proprieta-intellettuale', + label: 'Intellectual property and use of external components', + }, + { href: '#ai-ml', label: 'Responsible use of AI/ML and automation' }, + { href: '#conflitti', label: 'Conflicts of interest and commercial integrity' }, + { + href: '#linee-operative', + label: 'Operating lines: development, release and vulnerability management', + }, + { href: '#governance', label: 'Governance, roles and responsibilities' }, + { href: '#onboarding', label: 'Onboarding, training and certification' }, + { + href: '#segnalazioni', + label: 'Reporting, whistleblower protection and investigations', + }, + { href: '#violazioni', label: 'Handling of violations and sanctions' }, + { href: '#monitoraggio', label: 'Monitoring, audit and continuous improvement' }, + { href: '#documentazione', label: 'Mandatory documentation and registers' }, + { href: '#allegati', label: 'Annexes and forms' }, + { href: '#approvazione', label: 'Approval and useful contacts' }, + ], + productLines: [ + { id: 'platform', name: 'Platforms and SaaS services' }, + { id: 'legal', name: 'Legal Tech', productName: 'LexAura' }, + { id: 'health', name: 'Health Tech', productName: 'MediAura' }, + ], + productListJoiner: ' and ', + premessaTitle: '1. Preamble', + premessaBefore: + 'This Code of Ethics sets out the principles, duties and rules of conduct that all parties involved in NexStudio (hereinafter the “Company”) must observe in the development, marketing and management of SaaS solutions, organized by lines (shared platform, legal domain, healthcare domain) and, in concrete terms, with particular reference to ', + premessaAfter: + '. If the offering expands or evolves, new highly regulated lines shall be described under the same scheme (platform + domain perimeter), via annexes or text revision, without mixing criteria across verticals. It aims to ensure regulatory compliance, privacy protection, security, technical quality, protection of user rights and professional accountability.', + ambito: { + title: '2. Scope of application', + text: 'It applies to: founders, executives, employees (full-time, part-time), external collaborators, consultants, contractors and suppliers. It covers all activities: analysis, design, development, testing, release, maintenance, support, marketing, sales and research.', + }, + valori: { + title: '3. Core values and principles', + items: [ + 'Integrity, honesty and transparency.', + 'Respect for human dignity, inclusion and non-discrimination.', + 'Technical-professional responsibility and service quality.', + 'Confidentiality and protection of personal and sensitive data.', + 'Security and operational resilience.', + 'Legal and regulatory compliance.', + 'Continuous improvement and accountability.', + ], + }, + conformita: { + title: '4. Specific regulatory compliance', + introBefore: + 'The references below are grouped: horizontal obligations for all SaaS offerings, distinct references for the Legal Tech / LexAura perimeter and for Health Tech / MediAura (each line may expand or diversify by product and market, without improper mixing with other perimeters). Product-line summary: ', + introAfter: '.', + afterBlocks: + 'The Company carries out DPIAs (Data Protection Impact Assessments) for high-risk processing and consults authorities or regulatory counsel when needed, with references for each processing activity to the relevant perimeter (platform, legal, healthcare).', + }, + conformityBlocks: [ + { + id: 'platform', + anchorId: 'conformita-piattaforma', + title: '4.1 Platform and SaaS offering (horizontal obligations)', + lead: + 'Common references for all processing activities and all subscription lines, regardless of the end customer’s domain.', + items: [ + 'Thailand Personal Data Protection Act (PDPA).', + 'General Data Protection Regulation (GDPR), where applicable for users or services in the European Union.', + ], + }, + { + id: 'legal', + anchorId: 'conformita-legal', + title: '4.2 Legal domain (Legal Tech / LexAura)', + lead: + 'Measures and references for software and flows used by law firms and regulated professions, including activity attributable to LexAura or evolutions in the same domain.', + items: [ + 'Professional rules and professional secrecy for legal practice; respect for professional privileges (e.g. attorney–client privilege) where applicable; fairness and correctness toward counterparties and third parties, within the limits of law and professional ethics.', + ], + }, + { + id: 'health', + anchorId: 'conformita-sanitario', + title: '4.3 Healthcare domain (Health Tech / MediAura)', + lead: + 'Data, risks and, where applicable, regulatory classifications attributable to Health Tech and MediAura (and products within the same perimeter).', + items: [ + 'Relevant local or international healthcare regulations and standards (requirements for clinical data management, relevant ISO standards, care continuity where touched by the software).', + 'Requirements for medical devices or software for medical purposes (e.g. EU MDR, local regulations) if features fall within the definition of a medical device or equivalent for the chosen market.', + 'Rules and good practices on secrecy and confidentiality in healthcare (e.g. relations with practitioners) and, where applicable: HIPAA (United States) in addition to horizontal requirements (GDPR, PDPA) for transfers.', + ], + }, + ], + tutelaDati: { + title: '5. Protection of personal and sensitive data', + operationalIntro: + 'In day-to-day operations, the Company and collaborators adhere to the following operating principles (complementary to the roles above):', + principles: [ + { label: 'Minimization', text: 'collect only necessary and relevant data.' }, + { + label: 'Legal basis', + text: 'document the legal basis for every processing activity (consent, contract performance, legal obligation, assessed legitimate interest).', + }, + { + label: 'Notice and consent', + text: 'provide clear notices and obtain consent when required; manage consent in a verifiable way.', + }, + { + label: 'Classification', + text: 'define categories (PII, health data, privileged legal information) and apply differentiated measures.', + }, + { + label: 'Retention and deletion', + text: 'documented retention policies; anonymization or deletion at the end of the purposes.', + }, + { + label: 'International transfers', + text: 'assess legal bases (standard contractual clauses, adequacy decisions, technical measures) for transfers outside Thailand.', + }, + { + label: 'Data subject rights', + text: 'procedures for access, rectification, erasure, restriction, portability and objection, with documented timelines and logs.', + }, + { + label: 'Sub-processors', + text: 'contracts imposing equivalent security measures, breach notification obligations and prohibitions on further unauthorized sub-processing.', + }, + ], + }, + tutelaDatiRuoli: { + anchorId: 'tutela-dati-ruoli', + title: '5.1 Patients, firm clients and subscription: roles and processing', + intro: + 'Yes, role division must be explained: the Code sets what we expect from each party, without replacing the privacy notice or contracts. Below, in summary, who processes patient and client data relative to the firms and with which duties (Company, subscribers, data subjects).', + rows: [ + { + label: 'NexStudio (provider / service operator)', + text: 'The Company processes personal data and, where present, special categories (e.g. health, legal situation) only to provide, protect and improve the platforms, for support, security, billing, legal compliance and, where contractually provided, to assist the controller in honouring data subject rights. Staff working for the Company are prohibited from incompatible uses, from reselling data for purposes unrelated to the service, and from accessing professional content beyond what is technically necessary or for authorized support. Exact legal qualifications (e.g. processor under Art. 28 GDPR, or another scheme under PDPA) are defined in writing in the DPA and privacy documents.', + }, + { + label: 'Subscription subscribers (law firms, physicians, organizations, enrolled teams)', + text: 'Subscribers are, as a rule, controllers or joint controllers of the processing of data they enter or cause to be entered on the platform: in particular patients or care recipients (Health Tech) and clients, counterparties or third parties involved in files or matters (Legal Tech), as well as their own staff data. They must: have an adequate legal basis and notices toward their patients, clients and care recipients; respect professional duties (secrecy, confidentiality, record-keeping); map purposes and retention; give documented instructions to the provider where a processor appointment is needed; and respond in the first instance to access, rectification, erasure and objection requests from data subjects, cooperating with NexStudio when technical tools or logs are needed.', + }, + { + label: 'Patients and clients (data subjects)', + text: 'They exercise privacy rights primarily toward the firm, organization or professional that processes their data. NexStudio, except where direct exercise is provided by law or a specific channel, forwards or supports exercise through the controller, within the timelines and methods of the contract and product.', + }, + ], + note: + 'Operational details (categories, timelines, processing table, sub-processors, extra-EU transfers, notice texts addressed to patients or clients of the parties) are in the Privacy policy, cookie notice, DPA, terms of use and annexes, which can be updated without rewriting the entire Code when only the legal annex changes.', + }, + sicurezza: { + title: '6. Information security and operational resilience', + items: [ + { + label: 'Security by design and privacy by design', + text: 'integration of security and privacy into the product lifecycle.', + }, + { + label: 'Access controls', + text: 'least-privilege principle, mandatory MFA for access to sensitive resources, centralized identity management.', + }, + { + label: 'Encryption', + text: 'encryption at rest and in transit with up-to-date algorithms; secure key management.', + }, + { + label: 'Logging and monitoring', + text: 'immutable logs for access and operations on sensitive data and production environments.', + }, + { + label: 'Vulnerability management', + text: 'automated scans, periodic penetration tests, patching process and responsible disclosure or bug bounty program.', + }, + { + label: 'Business continuity and disaster recovery', + text: 'regularly tested plans with defined RTO/RPO.', + }, + { + label: 'Incident management', + text: 'documented playbook (identification, containment, eradication, recovery, post-mortem), roles and internal/external notification timelines.', + }, + ], + }, + qualita: { + title: '7. Software quality, clinical validation and user risk', + itemsBefore: [ + { + label: 'Development standards', + text: 'readable code, automated tests, mandatory code reviews, secure CI/CD.', + }, + { + label: 'Testing and coverage', + text: 'define minimum coverage for critical components; integration, performance and security tests.', + }, + ], + validazioneLabelLegal: 'Validation (legal perimeter)', + validazioneLabelHealth: 'Validation (healthcare perimeter)', + itemsAfter: [ + { + label: 'Risk classification', + text: 'assess impact on health or rights and apply proportionate mitigation measures.', + }, + { + label: 'No substitution of the professional', + text: 'the platform provides support and informational tools; it does not present itself as a substitute for professional advice without explicit professional supervision and endorsement.', + }, + { + label: 'Registers and evidence', + text: 'maintain documentation of clinical tests, risk assessments and regulatory approvals.', + }, + ], + }, + qualitaValidazioneProdotto: [ + { + id: 'legal', + text: 'for features that support choices or activities in the legal domain, validation with legal experts, pilot studies, documentation of limits and warnings, as provided for LexAura or equivalents in Legal Tech.', + }, + { + id: 'health', + text: 'for features that assist clinical decisions or healthcare activities, validation with clinical experts, pilot studies, warnings, as provided for MediAura or equivalents in Health Tech.', + }, + ], + proprieta: { + title: '8. Intellectual property and use of external components', + items: [ + { + kind: 'text', + text: 'Contributions by employees and consultants relating to software, documentation and know-how are owned by the Company, unless otherwise agreed in writing.', + }, + { + kind: 'labeled', + label: 'Open source', + text: 'maintain an SBOM (Software Bill of Materials), verify license compatibility, respect disclosure obligations and patch updates.', + }, + { + kind: 'text', + text: 'Prohibition of unauthorized use of third-party code or intellectual property; management of IP contamination risks.', + }, + ], + }, + ai: { + title: '9. Responsible use of AI/ML and automation', + items: [ + 'Document training datasets, provenance, pre-processing and known limits.', + { + label: 'Bias assessment', + text: 'conduct analyses to identify and mitigate biases that may discriminate or cause harm.', + }, + { + label: 'Human oversight', + text: 'for decisions affecting health, legal proceedings or fundamental rights, provide human oversight and clear notices on system limits.', + }, + { + label: 'Explainability and accountability', + text: 'provide understandable information on how models support decisions and on performance and reliability.', + }, + { + label: 'Post-release monitoring', + text: 'measure production performance and correct drift or unexpected behaviour.', + }, + ], + }, + conflitti: { + title: '10. Conflicts of interest and commercial integrity', + items: [ + 'Mandatory declaration of actual or potential conflicts (investments, relationships with suppliers or customers).', + 'Anti-corruption and anti-bribery policies compliant with national and international laws.', + 'Truthful commercial communications; do not mislead about capabilities, regulatory approvals or results.', + 'Contractual transparency: clear and accessible SLAs, liability limitations and terms of use.', + ], + }, + lineeOperative: { + title: '11. Operating lines: development, release and vulnerability management', + items: [ + { + label: 'Development', + text: 'branch strategy, mandatory code review, merge only with green CI, pre-release checklist (security, privacy, compliance).', + }, + { + label: 'Test environment', + text: 'use of synthetic or anonymized data; access to real data only on a minimal authorized basis, in isolated environments.', + }, + { + label: 'Deployment', + text: 'standardized CI/CD with rollback plan and gradual releases for critical features.', + }, + { + label: 'Vulnerability management', + text: 'public or private reporting channel (bug bounty or dedicated security@ address), acknowledgement within 72 hours, remediation plan with estimated timelines.', + }, + { + label: 'Patch management', + text: 'patch release timelines defined by severity.', + }, + { + label: 'Release documentation', + text: 'changelog, known impacts and operational recommendations.', + }, + ], + }, + governance: { + title: '12. Governance, roles and responsibilities', + items: [ + { label: 'Board / founders', text: 'approve policies, define strategy and resources.' }, + { label: 'CEO', text: 'overall responsibility for compliance and governance.' }, + { label: 'CTO', text: 'technical quality, architecture and development practices.' }, + { + label: 'CISO / security lead', + text: 'operational security, incident response, vulnerability management.', + }, + { + label: 'DPO / privacy lead', + text: 'PDPA and GDPR compliance, DPIA, handling of data subject requests.', + }, + { + label: 'Legal & compliance', + text: 'legal oversight, contracts and regulatory assessments.', + }, + { label: 'HR', text: 'training, code of conduct and disciplinary management.' }, + { + label: 'Team lead / PM', + text: 'apply operating policies and ensure day-to-day compliance.', + }, + { + label: 'Ethics committee (recommended)', + text: 'multidisciplinary group to assess complex cases (clinical or legal impacts, conflicts), with periodic and on-request meetings.', + }, + ], + }, + onboarding: { + title: '13. Onboarding, training and certification', + item1Before: + 'Mandatory onboarding on: information security, privacy (PDPA and GDPR), sensitive data handling, requirements and documentation for each product line (today: ', + item1After: + '; extend the curriculum when the list grows), responsible AI use, secure coding practices.', + itemsRest: [ + 'Mandatory annual training and additional training for critical roles.', + 'Recording and retention of training records.', + ], + }, + segnalazioni: { + title: '14. Reporting, whistleblower protection and investigations', + channelsLabel: 'Channels', + channelsBefore: 'at least one confidential internal channel (e.g.', + channelsAfter: + '), external anonymous platform or third-party service; contact for independent escalation.', + protection: { + label: 'Protection', + text: 'prohibition of retaliation; disciplinary measures for proven retaliation.', + }, + investigations: { + label: 'Investigations', + text: 'conducted impartially, documented and with defined timelines; communication of outcomes to the reporter and interested parties, within the limits of confidentiality.', + }, + }, + violazioni: { + title: '15. Handling of violations and sanctions', + items: [ + 'Actions proportionate to severity: corrective training, reprimand, reassignment, suspension, termination of the contractual relationship, legal action if necessary.', + 'Register of infringements and actions taken; right of defence of the person concerned.', + ], + }, + monitoraggio: { + title: '16. Monitoring, audit and continuous improvement', + items: [ + 'Regular internal and external audits on security, privacy, compliance and quality control.', + { + label: 'KPIs (examples)', + text: 'number of incidents, average remediation time, test coverage percentage, training completion percentage, average response time to reports.', + }, + 'Code review: at least annually or upon regulatory, technological or market changes.', + ], + }, + documentazione: { + title: '17. Mandatory documentation and registers', + intro: 'The Company maintains and updates, among other things:', + items: [ + 'records of processing and DPIAs;', + 'SBOM and component inventory (open source);', + 'access logs and audit trail;', + 'incident and data breach register;', + 'contracts with vendors and sub-processors;', + 'training records and Code adhesion declarations.', + ], + }, + allegati: { + title: '18. Annexes and forms (included)', + items: [ + 'Personal declaration of adhesion to the Code (to be signed at onboarding).', + 'NDA template and minimum clauses for vendors and sub-processors.', + 'Pre-release checklist (security and privacy).', + 'Incident management flowchart and notification template.', + 'Simplified DPIA model and completed example.', + 'Privacy notice model and consent form for users or patients.', + 'SBOM template.', + 'Data retention policy (timelines and justifications).', + 'AI/ML impact assessment template.', + ], + }, + approvazione: { + title: '19. Approval and useful contacts', + items: [ + { + label: 'Approved by', + text: 'competent body / managing director (full name at signature).', + }, + { + label: 'Update owner', + text: 'Legal & compliance, with support from DPO and CISO.', + }, + { + label: 'Review', + text: 'at least annually or upon material changes.', + }, + ], + contacts: [ + { label: 'DPO / privacy lead', email: 'privacy@nexstudio.com' }, + { label: 'Security / incident response', email: 'security@nexstudio.com' }, + { + label: 'Confidential reports', + email: 'ethics@nexstudio.com', + note: 'anonymous', + }, + { label: 'Legal', email: 'legal@nexstudio.com' }, + { label: 'HR', email: 'hr@nexstudio.com' }, + ], + }, + adesione: { + title: 'Final adhesion clause (to be signed at onboarding)', + textBefore: 'I declare that I have read and understood the Code of Ethics of ', + textAfter: + ' and I commit to respecting its principles and procedures. I also commit to reporting, in good faith, any violations of which I become aware.', + }, + notePratiche: { + title: 'Practical notes and recommended next steps', + items: [ + 'Customize the document with the official company name (if different from the operating brand), signatures and local legal references in Bangkok.', + 'Attach the listed templates as separate documents and implement technical channels for reporting and bug bounty.', + 'Prepare a 90-day training plan for onboarding and recurring annual training.', + ], + }, + notePraticheDPIA: [ + 'Perform DPIAs for critical processing for each perimeter (especially high-criticality healthcare or legal processing), documenting the link to the product lines involved.', + 'For the Health Tech / MediAura line or equivalents, verify whether parts of the product fall within the definition of a medical device or software for medical purposes, for registration or approval according to the chosen market and classification.', + ], + }, + th: { + page: { + title: 'ประมวลจริยธรรม — NexStudio', + description: + 'ประมวลจริยธรรมฉบับสมบูรณ์ของ NexStudio: คุณค่า การปฏิบัติตามกฎด้านกฎหมายและสุขภาพ ความเป็นส่วนตัว ความปลอดภัย AI การกำกับดูแล และการรายงาน', + heading: 'ประมวลจริยธรรมฉบับสมบูรณ์', + lead: 'สำหรับ NexStudio — สำนักงานใหญ่: กรุงเทพฯ ประเทศไทย เวอร์ชัน 1.0 มีผลตั้งแต่วันที่ 21 เมษายน 2026 เอกสารภายในและภายนอก: หลักการ หน้าที่ และขั้นตอนปฏิบัติสำหรับผู้ที่ร่วมงานกับบริษัท', + versionLabel: 'เวอร์ชัน', + inForceLabel: 'มีผลตั้งแต่', + inForceDate: '21 เมษายน 2026', + indexTitle: 'สารบัญย่อ', + contactsTitle: 'ติดต่อ', + signatureLabel: 'ลายเซ็น', + dateLabel: 'วันที่', + anonymousPlatformNote: '(หรือลิงก์ไปยังแพลตฟอร์มนิรนามเฉพาะ)', + }, + index: [ + { href: '#premessa', label: 'คำนำ' }, + { href: '#ambito', label: 'ขอบเขตการบังคับใช้' }, + { href: '#valori', label: 'คุณค่าและหลักการพื้นฐาน' }, + { + href: '#conformita', + label: 'การปฏิบัติตามกฎระเบียบ (ตามขอบเขต: แพลตฟอร์ม กฎหมาย สุขภาพ)', + children: [ + { href: '#conformita-piattaforma', label: '4.1 แพลตฟอร์มและ SaaS (แนวนอน)' }, + { href: '#conformita-legal', label: '4.2 ขอบเขตกฎหมาย (LexAura)' }, + { href: '#conformita-sanitario', label: '4.3 ขอบเขตสุขภาพ (MediAura)' }, + ], + }, + { + href: '#tutela-dati', + label: 'การคุ้มครองข้อมูลส่วนบุคคลและข้อมูลอ่อนไหว', + children: [ + { + href: '#tutela-dati-ruoli', + label: '5.1 บทบาท: ผู้ป่วย ลูกค้า ผู้สมัครสมาชิก บริษัท', + }, + ], + }, + { href: '#sicurezza', label: 'ความปลอดภัยของข้อมูลและความยืดหยุ่นเชิงปฏิบัติการ' }, + { + href: '#qualita', + label: 'คุณภาพซอฟต์แวร์ การตรวจสอบทางคลินิก และความเสี่ยงต่อผู้ใช้', + }, + { + href: '#proprieta-intellettuale', + label: 'ทรัพย์สินทางปัญญาและการใช้ส่วนประกอบภายนอก', + }, + { href: '#ai-ml', label: 'การใช้ AI/ML และระบบอัตโนมัติอย่างรับผิดชอบ' }, + { href: '#conflitti', label: 'ผลประโยชน์ทับซ้อนและความซื่อสัตย์ทางการค้า' }, + { + href: '#linee-operative', + label: 'แนวปฏิบัติ: การพัฒนา การปล่อย และการจัดการช่องโหว่', + }, + { href: '#governance', label: 'การกำกับดูแล บทบาท และความรับผิดชอบ' }, + { href: '#onboarding', label: 'การปฐมนิเทศ การฝึกอบรม และการรับรอง' }, + { + href: '#segnalazioni', + label: 'การรายงาน การคุ้มครองผู้แจ้งเบาะแส และการสอบสวน', + }, + { href: '#violazioni', label: 'การจัดการการละเมิดและการลงโทษ' }, + { href: '#monitoraggio', label: 'การติดตาม การตรวจสอบ และการปรับปรุงอย่างต่อเนื่อง' }, + { href: '#documentazione', label: 'เอกสารบังคับและทะเบียน' }, + { href: '#allegati', label: 'ภาคผนวกและแบบฟอร์ม' }, + { href: '#approvazione', label: 'การอนุมัติและช่องทางติดต่อที่เป็นประโยชน์' }, + ], + productLines: [ + { id: 'platform', name: 'แพลตฟอร์มและบริการ SaaS' }, + { id: 'legal', name: 'Legal Tech', productName: 'LexAura' }, + { id: 'health', name: 'Health Tech', productName: 'MediAura' }, + ], + productListJoiner: ' และ ', + premessaTitle: '1. คำนำ', + premessaBefore: + 'ประมวลจริยธรรมนี้กำหนดหลักการ หน้าที่ และกฎการประพฤติที่บุคคลทุกฝ่ายที่เกี่ยวข้องกับ NexStudio (ต่อไปนี้เรียกว่า «บริษัท») ต้องปฏิบัติในการพัฒนา การตลาด และการจัดการโซลูชัน SaaS โดยจัดตามสายงาน (แพลตฟอร์มร่วม ขอบเขตกฎหมาย ขอบเขตสุขภาพ) และในทางปฏิบัติโดยเฉพาะอ้างอิงถึง ', + premessaAfter: + ' หากข้อเสนอขยายหรือพัฒนา สายงานใหม่ที่มีการกำกับดูแลสูงจะต้องอธิบายด้วยโครงเดียวกัน (แพลตฟอร์ม + ขอบเขตโดเมน) ผ่านภาคผนวกหรือการแก้ไขข้อความ โดยไม่ปะปนเกณฑ์ระหว่างแนวตั้ง มีเป้าหมายเพื่อรับประกันการปฏิบัติตามกฎ การคุ้มครองความเป็นส่วนตัว ความปลอดภัย คุณภาพทางเทคนิค การคุ้มครองสิทธิของผู้ใช้ และความรับผิดชอบวิชาชีพ', + ambito: { + title: '2. ขอบเขตการบังคับใช้', + text: 'ใช้กับ: ผู้ก่อตั้ง ผู้บริหาร พนักงาน (เต็มเวลา พาร์ทไทม์) ผู้ร่วมงานภายนอก ที่ปรึกษา ผู้รับเหมา และผู้ให้บริการ ครอบคลุมกิจกรรมทั้งหมด: การวิเคราะห์ การออกแบบ การพัฒนา การทดสอบ การปล่อย การบำรุงรักษา การสนับสนุน การตลาด การขาย และการวิจัย', + }, + valori: { + title: '3. คุณค่าและหลักการพื้นฐาน', + items: [ + 'ความซื่อสัตย์ ความจริงใจ และความโปร่งใส', + 'การเคารพศักดิ์ศรีความเป็นมนุษย์ การมีส่วนร่วม และการไม่เลือกปฏิบัติ', + 'ความรับผิดชอบทางเทคนิค-วิชาชีพ และคุณภาพบริการ', + 'การรักษาความลับและการคุ้มครองข้อมูลส่วนบุคคลและข้อมูลอ่อนไหว', + 'ความปลอดภัยและความยืดหยุ่นเชิงปฏิบัติการ', + 'การปฏิบัติตามกฎหมายและกฎระเบียบ', + 'การปรับปรุงอย่างต่อเนื่องและความรับผิดชอบ', + ], + }, + conformita: { + title: '4. การปฏิบัติตามกฎระเบียบเฉพาะ', + introBefore: + 'การอ้างอิงด้านล่างจัดกลุ่มเป็น: หน้าที่แนวนอนสำหรับข้อเสนอ SaaS ทั้งหมด การอ้างอิงแยกสำหรับขอบเขต Legal Tech / LexAura และ Health Tech / MediAura (แต่ละสายอาจขยายหรือแตกต่างตามผลิตภัณฑ์และตลาด โดยไม่ปะปนกับขอบเขตอื่นอย่างไม่เหมาะสม) สรุปสายผลิตภัณฑ์: ', + introAfter: '.', + afterBlocks: + 'บริษัทดำเนินการ DPIA (Data Protection Impact Assessment) สำหรับการประมวลผลความเสี่ยงสูง และปรึกษาหน่วยงานหรือที่ปรึกษากฎระเบียบเมื่อจำเป็น โดยอ้างอิงสำหรับแต่ละการประมวลผลไปยังขอบเขตที่เกี่ยวข้อง (แพลตฟอร์ม กฎหมาย สุขภาพ)', + }, + conformityBlocks: [ + { + id: 'platform', + anchorId: 'conformita-piattaforma', + title: '4.1 แพลตฟอร์มและข้อเสนอ SaaS (หน้าที่แนวนอน)', + lead: + 'การอ้างอิงร่วมสำหรับกิจกรรมการประมวลผลทั้งหมดและสายการสมัครสมาชิกทั้งหมด โดยไม่ขึ้นกับโดเมนของลูกค้าปลายทาง', + items: [ + 'Thailand Personal Data Protection Act (PDPA)', + 'General Data Protection Regulation (GDPR) เมื่อใช้ได้กับผู้ใช้หรือบริการในสหภาพยุโรป', + ], + }, + { + id: 'legal', + anchorId: 'conformita-legal', + title: '4.2 ขอบเขตกฎหมาย (Legal Tech / LexAura)', + lead: + 'มาตรการและการอ้างอิงสำหรับซอฟต์แวร์และกระแสงานที่ใช้โดยสำนักงานกฎหมายและวิชาชีพที่มีการกำกับ รวมถึงกิจกรรมที่เกี่ยวข้องกับ LexAura หรือการพัฒนาในโดเมนเดียวกัน', + items: [ + 'กฎวิชาชีพและความลับวิชาชีพสำหรับการประกอบวิชาชีพกฎหมาย; การเคารพสิทธิพิเศษวิชาชีพ (เช่น attorney–client privilege) เมื่อใช้ได้; ความซื่อสัตย์และความถูกต้องต่อคู่กรณีและบุคคลที่สาม ภายในขอบเขตกฎหมายและจรรยาบรรณ', + ], + }, + { + id: 'health', + anchorId: 'conformita-sanitario', + title: '4.3 ขอบเขตสุขภาพ (Health Tech / MediAura)', + lead: + 'ข้อมูล ความเสี่ยง และหากมี การจำแนกประเภทตามกฎระเบียบที่เกี่ยวข้องกับ Health Tech และ MediAura (และผลิตภัณฑ์ในขอบเขตเดียวกัน)', + items: [ + 'กฎระเบียบและมาตรฐานสุขภาพในท้องถิ่นหรือระหว่างประเทศที่เกี่ยวข้อง (ข้อกำหนดการจัดการข้อมูลคลินิก มาตรฐาน ISO ที่เกี่ยวข้อง ความต่อเนื่องของการดูแลเมื่อซอฟต์แวร์เกี่ยวข้อง)', + 'ข้อกำหนดสำหรับอุปกรณ์การแพทย์หรือซอฟต์แวร์เพื่อวัตถุประสงค์ทางการแพทย์ (เช่น EU MDR กฎระเบียบท้องถิ่น) หากฟีเจอร์อยู่ในนิยามของอุปกรณ์การแพทย์หรือเทียบเท่าสำหรับตลาดที่เลือก', + 'กฎและแนวปฏิบัติที่ดีเกี่ยวกับความลับและการรักษาความลับในด้านสุขภาพ (เช่น ความสัมพันธ์กับผู้ประกอบวิชาชีพ) และหากใช้ได้: HIPAA (สหรัฐอเมริกา) นอกเหนือจากข้อกำหนดแนวนอน (GDPR, PDPA) สำหรับการโอน', + ], + }, + ], + tutelaDati: { + title: '5. การคุ้มครองข้อมูลส่วนบุคคลและข้อมูลอ่อนไหว', + operationalIntro: + 'ในการดำเนินงานจริง บริษัทและผู้ร่วมงานยึดหลักปฏิบัติต่อไปนี้ (เสริมบทบาทด้านบน):', + principles: [ + { label: 'การลดข้อมูลให้เหลือน้อยที่สุด', text: 'เก็บเฉพาะข้อมูลที่จำเป็นและเกี่ยวข้อง' }, + { + label: 'ฐานทางกฎหมาย', + text: 'บันทึกฐานทางกฎหมายสำหรับการประมวลผลแต่ละครั้ง (ความยินยอม การปฏิบัติตามสัญญา ข้อผูกพันทางกฎหมาย ผลประโยชน์อันชอบธรรมที่ประเมินแล้ว)', + }, + { + label: 'ประกาศและความยินยอม', + text: 'ให้ประกาศที่ชัดเจนและขอความยินยอมเมื่อจำเป็น; จัดการความยินยอมในลักษณะที่ตรวจสอบได้', + }, + { + label: 'การจำแนกประเภท', + text: 'กำหนดหมวดหมู่ (PII ข้อมูลสุขภาพ ข้อมูลกฎหมายที่มีสิทธิพิเศษ) และใช้มาตรการที่แตกต่างกัน', + }, + { + label: 'การเก็บรักษาและการลบ', + text: 'นโยบายการเก็บรักษาที่บันทึกไว้; การทำให้ไม่ระบุตัวตนหรือการลบเมื่อสิ้นสุดวัตถุประสงค์', + }, + { + label: 'การโอนระหว่างประเทศ', + text: 'ประเมินฐานทางกฎหมาย (ข้อสัญญามาตรฐาน การตัดสินใจความเพียงพอ มาตรการทางเทคนิค) สำหรับการโอนนอกประเทศไทย', + }, + { + label: 'สิทธิของเจ้าของข้อมูล', + text: 'ขั้นตอนสำหรับการเข้าถึง การแก้ไข การลบ การจำกัด การโอนย้าย และการคัดค้าน พร้อมระยะเวลาและบันทึกที่จัดทำไว้', + }, + { + label: 'ผู้ประมวลผลช่วง', + text: 'สัญญาที่กำหนดมาตรการความปลอดภัยเทียบเท่า หน้าที่แจ้งเมื่อเกิดการละเมิด (breach) และการห้ามมอบช่วงต่อโดยไม่ได้รับอนุญาต', + }, + ], + }, + tutelaDatiRuoli: { + anchorId: 'tutela-dati-ruoli', + title: '5.1 ผู้ป่วย ลูกค้าของสำนักงาน และการสมัครสมาชิก: บทบาทและการประมวลผล', + intro: + 'ใช่ ต้องอธิบายการแบ่งบทบาท: ประมวลกำหนดสิ่งที่เราคาดหวังจากแต่ละฝ่าย โดยไม่แทนที่ประกาศความเป็นส่วนตัวหรือสัญญา ด้านล่างโดยสรุป ใครประมวลผลข้อมูลผู้ป่วยและลูกค้าเทียบกับสำนักงาน และมีหน้าที่ใด (บริษัท ผู้สมัครสมาชิก เจ้าของข้อมูล)', + rows: [ + { + label: 'NexStudio (ผู้ให้บริการ / ผู้ดำเนินการบริการ)', + text: 'บริษัทประมวลผลข้อมูลส่วนบุคคล และหากมี หมวดหมู่พิเศษ (เช่น สุขภาพ สถานะทางกฎหมาย) เฉพาะเพื่อให้บริการ ปกป้อง และปรับปรุงแพลตฟอร์ม สำหรับการสนับสนุน ความปลอดภัย การเรียกเก็บเงิน การปฏิบัติตามกฎหมาย และหากสัญญากำหนด เพื่อช่วยผู้ควบคุมในการเคารพสิทธิของเจ้าของข้อมูล ห้ามผู้ที่ทำงานในบริษัทใช้ข้อมูลอย่างไม่สอดคล้อง ขายข้อมูลเพื่อวัตถุประสงค์ที่ไม่เกี่ยวกับบริการ หรือเข้าถึงเนื้อหาวิชาชีพเกินกว่าที่จำเป็นทางเทคนิคหรือสำหรับการสนับสนุนที่ได้รับอนุญาต คุณสมบัติทางกฎหมายที่แน่ชัด (เช่น ผู้ประมวลผลตามมาตรา 28 GDPR หรือโครงอื่นภายใต้ PDPA) กำหนดเป็นลายลักษณ์อักษรใน DPA และเอกสารความเป็นส่วนตัว', + }, + { + label: 'ผู้สมัครสมาชิก (สำนักงานกฎหมาย แพทย์ องค์กร ทีมที่ลงทะเบียน)', + text: 'ผู้สมัครสมาชิกโดยทั่วไปเป็นผู้ควบคุมหรือผู้ควบคุมร่วมของการประมวลผลข้อมูลที่ตนใส่หรือให้ใส่ในแพลตฟอร์ม: โดยเฉพาะผู้ป่วยหรือผู้รับการดูแล (Health Tech) และลูกค้า คู่กรณี หรือบุคคลที่สามในแฟ้มหรือคดี (Legal Tech) รวมถึงข้อมูลบุคลากรของตน ต้องมี: ฐานทางกฎหมายและประกาศที่เหมาะสมต่อผู้ป่วย ลูกค้า และผู้รับการดูแล; เคารพหน้าที่จรรยาบรรณ (ความลับ การรักษาความลับ การเก็บรักษาเอกสาร); กำหนดวัตถุประสงค์และระยะเวลา; ให้คำสั่งเป็นลายลักษณ์อักษรแก่ผู้ให้บริการเมื่อต้องแต่งตั้งผู้ประมวลผล; และตอบคำขอเข้าถึง แก้ไข ลบ และคัดค้านของเจ้าของข้อมูลในลำดับแรก โดยร่วมมือกับ NexStudio เมื่อต้องการเครื่องมือทางเทคนิคหรือบันทึก', + }, + { + label: 'ผู้ป่วยและลูกค้า (เจ้าของข้อมูล)', + text: 'ใช้สิทธิความเป็นส่วนตัวเป็นอันดับแรกต่อสำนักงาน องค์กร หรือผู้ประกอบวิชาชีพที่ประมวลผลข้อมูลของตน NexStudio เว้นแต่การใช้สิทธิโดยตรงตามกฎหมายหรือช่องทางเฉพาะ จะส่งต่อหรือสนับสนุนการใช้สิทธิผ่านผู้ควบคุม ตามระยะเวลาและวิธีการของสัญญาและผลิตภัณฑ์', + }, + ], + note: + 'รายละเอียดการดำเนินงาน (หมวดหมู่ ระยะเวลา ตารางการประมวลผล ผู้ประมวลผลช่วง การโอนนอกสหภาพยุโรป ข้อความประกาศสำหรับผู้ป่วยหรือลูกค้าของคู่สัญญา) อยู่ในนโยบายความเป็นส่วนตัว ประกาศคุกกี้ DPA เงื่อนไขการใช้งาน และภาคผนวก ซึ่งอัปเดตได้โดยไม่ต้องเขียนประมวลทั้งฉบับใหม่เมื่อเปลี่ยนเฉพาะภาคผนวกทางกฎหมาย', + }, + sicurezza: { + title: '6. ความปลอดภัยของข้อมูลและความยืดหยุ่นเชิงปฏิบัติการ', + items: [ + { + label: 'Security by design และ privacy by design', + text: 'การบูรณาการความปลอดภัยและความเป็นส่วนตัวในวงจรชีวิตผลิตภัณฑ์', + }, + { + label: 'การควบคุมการเข้าถึง', + text: 'หลักสิทธิ์น้อยที่สุด MFA บังคับสำหรับการเข้าถึงทรัพยากรอ่อนไหว การจัดการตัวตนแบบรวมศูนย์', + }, + { + label: 'การเข้ารหัส', + text: 'การเข้ารหัสขณะพักและขณะส่งด้วยอัลกอริทึมที่ทันสมัย; การจัดการคีย์อย่างปลอดภัย', + }, + { + label: 'การบันทึกและการติดตาม', + text: 'บันทึกที่แก้ไขไม่ได้สำหรับการเข้าถึงและการดำเนินการบนข้อมูลอ่อนไหวและสภาพแวดล้อม production', + }, + { + label: 'Vulnerability management', + text: 'การสแกนอัตโนมัติ การทดสอบเจาะระบบเป็นระยะ กระบวนการแพตช์ และโปรแกรม responsible disclosure หรือ bug bounty', + }, + { + label: 'ความต่อเนื่องทางธุรกิจและ disaster recovery', + text: 'แผนที่ทดสอบเป็นประจำพร้อม RTO/RPO ที่กำหนด', + }, + { + label: 'การจัดการเหตุการณ์', + text: 'playbook ที่บันทึกไว้ (การระบุ การกักกัน การกำจัด การกู้คืน post-mortem) บทบาทและระยะเวลาการแจ้งภายในและภายนอก', + }, + ], + }, + qualita: { + title: '7. คุณภาพซอฟต์แวร์ การตรวจสอบทางคลินิก และความเสี่ยงต่อผู้ใช้', + itemsBefore: [ + { + label: 'มาตรฐานการพัฒนา', + text: 'โค้ดที่อ่านได้ การทดสอบอัตโนมัติ code review บังคับ CI/CD ที่ปลอดภัย', + }, + { + label: 'การทดสอบและความครอบคลุม', + text: 'กำหนดความครอบคลุมขั้นต่ำสำหรับส่วนประกอบวิกฤต; การทดสอบการรวม ประสิทธิภาพ และความปลอดภัย', + }, + ], + validazioneLabelLegal: 'การตรวจสอบ (ขอบเขตกฎหมาย)', + validazioneLabelHealth: 'การตรวจสอบ (ขอบเขตสุขภาพ)', + itemsAfter: [ + { + label: 'การจำแนกความเสี่ยง', + text: 'ประเมินผลกระทบต่อสุขภาพหรือสิทธิ และใช้มาตรการบรรเทาที่เหมาะสม', + }, + { + label: 'ไม่ทดแทนผู้ประกอบวิชาชีพ', + text: 'แพลตฟอร์มให้การสนับสนุนและเครื่องมือข้อมูล; ไม่นำเสนอตนเป็นสิ่งทดแทนความเห็นวิชาชีพโดยไม่มีกำกับและรับรองจากผู้ประกอบวิชาชีพอย่างชัดเจน', + }, + { + label: 'ทะเบียนและหลักฐาน', + text: 'รักษาเอกสารการทดสอบทางคลินิก การประเมินความเสี่ยง และการอนุมัติตามกฎระเบียบ', + }, + ], + }, + qualitaValidazioneProdotto: [ + { + id: 'legal', + text: 'สำหรับฟีเจอร์ที่สนับสนุนการเลือกหรือกิจกรรมในขอบเขตกฎหมาย การตรวจสอบกับผู้เชี่ยวชาญด้านกฎหมาย การศึกษานำร่อง เอกสารข้อจำกัดและคำเตือน ดังที่กำหนดสำหรับ LexAura หรือเทียบเท่าใน Legal Tech', + }, + { + id: 'health', + text: 'สำหรับฟีเจอร์ที่ช่วยการตัดสินใจทางคลินิกหรือกิจกรรมด้านสุขภาพ การตรวจสอบกับผู้เชี่ยวชาญทางคลินิก การศึกษานำร่อง คำเตือน ดังที่กำหนดสำหรับ MediAura หรือเทียบเท่าใน Health Tech', + }, + ], + proprieta: { + title: '8. ทรัพย์สินทางปัญญาและการใช้ส่วนประกอบภายนอก', + items: [ + { + kind: 'text', + text: 'ผลงานของพนักงานและที่ปรึกษาที่เกี่ยวข้องกับซอฟต์แวร์ เอกสาร และ know-how เป็นของบริษัท เว้นแต่มีข้อตกลงเป็นลายลักษณ์อักษรเป็นอย่างอื่น', + }, + { + kind: 'labeled', + label: 'Open source', + text: 'รักษา SBOM (Software Bill of Materials) ตรวจสอบความเข้ากันได้ของใบอนุญาต เคารพหน้าที่เปิดเผยและการอัปเดตแพตช์', + }, + { + kind: 'text', + text: 'ห้ามใช้โค้ดหรือทรัพย์สินทางปัญญาของบุคคลที่สามโดยไม่ได้รับอนุญาต; การจัดการความเสี่ยงการปนเปื้อน IP', + }, + ], + }, + ai: { + title: '9. การใช้ AI/ML และระบบอัตโนมัติอย่างรับผิดชอบ', + items: [ + 'บันทึกชุดข้อมูลฝึก แหล่งที่มา การเตรียมข้อมูลล่วงหน้า และข้อจำกัดที่ทราบ', + { + label: 'Bias assessment', + text: 'วิเคราะห์เพื่อระบุและบรรเทาอคติที่อาจเลือกปฏิบัติหรือก่อให้เกิดอันตราย', + }, + { + label: 'การกำกับโดยมนุษย์', + text: 'สำหรับการตัดสินใจที่ส่งผลต่อสุขภาพ กระบวนการทางกฎหมาย หรือสิทธิขั้นพื้นฐาน ให้มีการกำกับโดยมนุษย์และคำเตือนที่ชัดเจนเกี่ยวกับข้อจำกัดของระบบ', + }, + { + label: 'ความสามารถอธิบายและความรับผิดชอบ', + text: 'ให้ข้อมูลที่เข้าใจได้ว่าโมเดลสนับสนุนการตัดสินใจอย่างไร และเกี่ยวกับประสิทธิภาพและความน่าเชื่อถือ', + }, + { + label: 'การติดตามหลังปล่อย', + text: 'วัดประสิทธิภาพใน production และแก้ไข drift หรือพฤติกรรมที่ไม่คาดคิด', + }, + ], + }, + conflitti: { + title: '10. ผลประโยชน์ทับซ้อนและความซื่อสัตย์ทางการค้า', + items: [ + 'การเปิดเผยบังคับเกี่ยวกับผลประโยชน์ทับซ้อนจริงหรือที่อาจเกิดขึ้น (การลงทุน ความสัมพันธ์กับผู้ให้บริการหรือลูกค้า)', + 'นโยบายต่อต้านการทุจริตและสินบนที่สอดคล้องกับกฎหมายในประเทศและระหว่างประเทศ', + 'การสื่อสารทางการค้าที่จริงใจ; ไม่ทำให้เข้าใจผิดเกี่ยวกับความสามารถ การอนุมัติตามกฎระเบียบ หรือผลลัพธ์', + 'ความโปร่งใสตามสัญญา: SLA ข้อจำกัดความรับผิด และเงื่อนไขการใช้งานที่ชัดเจนและเข้าถึงได้', + ], + }, + lineeOperative: { + title: '11. แนวปฏิบัติ: การพัฒนา การปล่อย และการจัดการช่องโหว่', + items: [ + { + label: 'การพัฒนา', + text: 'กลยุทธ์ branch code review บังคับ merge เฉพาะเมื่อ CI ผ่าน เช็กลิสต์ก่อนปล่อย (ความปลอดภัย ความเป็นส่วนตัว การปฏิบัติตามกฎ)', + }, + { + label: 'สภาพแวดล้อมทดสอบ', + text: 'ใช้ข้อมูลสังเคราะห์หรือที่ไม่ระบุตัวตน; เข้าถึงข้อมูลจริงเฉพาะเมื่อจำเป็นขั้นต่ำและได้รับอนุญาต ในสภาพแวดล้อมแยก', + }, + { + label: 'Deployment', + text: 'CI/CD มาตรฐานพร้อมแผน rollback และการปล่อยแบบค่อยเป็นค่อยไปสำหรับฟีเจอร์วิกฤต', + }, + { + label: 'การจัดการช่องโหว่', + text: 'ช่องทางสาธารณะหรือส่วนตัวสำหรับการรายงาน (bug bounty หรือที่อยู่ security@ เฉพาะ) ยืนยันการรับภายใน 72 ชั่วโมง แผน remediation พร้อมระยะเวลาโดยประมาณ', + }, + { + label: 'Patch management', + text: 'ระยะเวลาปล่อยแพตช์กำหนดตามความรุนแรง', + }, + { + label: 'เอกสารการปล่อย', + text: 'changelog ผลกระทบที่ทราบ และข้อแนะนำเชิงปฏิบัติการ', + }, + ], + }, + governance: { + title: '12. การกำกับดูแล บทบาท และความรับผิดชอบ', + items: [ + { label: 'Board / ผู้ก่อตั้ง', text: 'อนุมัตินโยบาย กำหนดกลยุทธ์และทรัพยากร' }, + { label: 'CEO', text: 'ความรับผิดชอบโดยรวมด้านการปฏิบัติตามกฎและการกำกับดูแล' }, + { label: 'CTO', text: 'คุณภาพทางเทคนิค สถาปัตยกรรม และแนวปฏิบัติการพัฒนา' }, + { + label: 'CISO / ผู้รับผิดชอบความปลอดภัย', + text: 'ความปลอดภัยเชิงปฏิบัติการ การตอบสนองเหตุการณ์ การจัดการช่องโหว่', + }, + { + label: 'DPO / ผู้ติดต่อความเป็นส่วนตัว', + text: 'การปฏิบัติตาม PDPA และ GDPR DPIA การจัดการคำขอของเจ้าของข้อมูล', + }, + { + label: 'Legal & compliance', + text: 'การกำกับทางกฎหมาย สัญญา และการประเมินตามกฎระเบียบ', + }, + { label: 'HR', text: 'การฝึกอบรม จรรยาบรรณ และการจัดการทางวินัย' }, + { + label: 'Team lead / PM', + text: 'ใช้นโยบายปฏิบัติการและรับประกันการปฏิบัติตามกฎประจำวัน', + }, + { + label: 'คณะกรรมการจริยธรรม (แนะนำ)', + text: 'กลุ่มสหสาขาวิชาเพื่อประเมินกรณีซับซ้อน (ผลกระทบทางคลินิกหรือกฎหมาย ผลประโยชน์ทับซ้อน) ด้วยการประชุมเป็นระยะและตามคำขอ', + }, + ], + }, + onboarding: { + title: '13. การปฐมนิเทศ การฝึกอบรม และการรับรอง', + item1Before: + 'การปฐมนิเทศบังคับเกี่ยวกับ: ความปลอดภัยสารสนเทศ ความเป็นส่วนตัว (PDPA และ GDPR) การจัดการข้อมูลอ่อนไหว ข้อกำหนดและเอกสารของแต่ละสายผลิตภัณฑ์ (ปัจจุบัน: ', + item1After: + '; ขยายหลักสูตรเมื่อรายการเพิ่มขึ้น) การใช้ AI อย่างรับผิดชอบ แนวปฏิบัติการเขียนโค้ดอย่างปลอดภัย', + itemsRest: [ + 'การฝึกอบรมประจำปีบังคับและการฝึกอบรมเพิ่มเติมสำหรับบทบาทวิกฤต', + 'การบันทึกและการเก็บรักษาบันทึกการฝึกอบรม', + ], + }, + segnalazioni: { + title: '14. การรายงาน การคุ้มครองผู้แจ้งเบาะแส และการสอบสวน', + channelsLabel: 'ช่องทาง', + channelsBefore: 'อย่างน้อยหนึ่งช่องทางภายในที่เป็นความลับ (เช่น', + channelsAfter: + ') แพลตฟอร์มนิรนามภายนอกหรือบริการบุคคลที่สาม; ช่องทาง escalate อิสระ', + protection: { + label: 'การคุ้มครอง', + text: 'ห้ามการตอบโต้; มาตรการทางวินัยสำหรับการตอบโต้ที่พิสูจน์ได้', + }, + investigations: { + label: 'การสอบสวน', + text: 'ดำเนินการอย่างเป็นกลาง มีเอกสาร และมีกำหนดเวลา; แจ้งผลแก่ผู้รายงานและฝ่ายที่เกี่ยวข้อง ภายในขอบเขตความลับ', + }, + }, + violazioni: { + title: '15. การจัดการการละเมิดและการลงโทษ', + items: [ + 'การดำเนินการตามสัดส่วนความรุนแรง: การฝึกอบรมแก้ไข การตักเตือน การมอบหมายใหม่ การระงับ การสิ้นสุดความสัมพันธ์ตามสัญญา การดำเนินคดีหากจำเป็น', + 'ทะเบียนการละเมิดและการดำเนินการที่ทำ; สิทธิในการป้องกันตัวของผู้เกี่ยวข้อง', + ], + }, + monitoraggio: { + title: '16. การติดตาม การตรวจสอบ และการปรับปรุงอย่างต่อเนื่อง', + items: [ + 'การตรวจสอบภายในและภายนอกเป็นประจำด้านความปลอดภัย ความเป็นส่วนตัว การปฏิบัติตามกฎ และการควบคุมคุณภาพ', + { + label: 'KPI (ตัวอย่าง)', + text: 'จำนวนเหตุการณ์ เวลาแก้ไขเฉลี่ย เปอร์เซ็นต์ความครอบคลุมการทดสอบ เปอร์เซ็นต์การฝึกอบรมที่เสร็จ เวลาตอบสนองเฉลี่ยต่อการรายงาน', + }, + 'การทบทวนประมวล: อย่างน้อยปีละครั้ง หรือเมื่อมีการเปลี่ยนแปลงด้านกฎระเบียบ เทคโนโลยี หรือตลาด', + ], + }, + documentazione: { + title: '17. เอกสารบังคับและทะเบียน', + intro: 'บริษัทรักษาและอัปเดต อาทิ:', + items: [ + 'ทะเบียนการประมวลผลและ DPIA;', + 'SBOM และรายการส่วนประกอบ (open source);', + 'บันทึกการเข้าถึงและ audit trail;', + 'ทะเบียนเหตุการณ์และการละเมิดข้อมูล;', + 'สัญญากับผู้ให้บริการและผู้ประมวลผลช่วง;', + 'บันทึกการฝึกอบรมและการประกาศยอมรับประมวล', + ], + }, + allegati: { + title: '18. ภาคผนวกและแบบฟอร์ม (รวมอยู่)', + items: [ + 'ประกาศยอมรับประมวลส่วนบุคคล (ลงนามตอนปฐมนิเทศ)', + 'เทมเพลต NDA และข้อสัญญาน้อยสุดสำหรับผู้ให้บริการและผู้ประมวลผลช่วง', + 'เช็กลิสต์ก่อนปล่อย (security และ privacy)', + 'แผนภูมิการจัดการเหตุการณ์และเทมเพลตการแจ้ง', + 'แบบ DPIA แบบย่อและตัวอย่างที่กรอกแล้ว', + 'แบบประกาศความเป็นส่วนตัวและแบบความยินยอมสำหรับผู้ใช้หรือผู้ป่วย', + 'เทมเพลต SBOM', + 'นโยบายการเก็บรักษาข้อมูล (ระยะเวลาและเหตุผล)', + 'เทมเพลตการประเมินผลกระทบ AI/ML', + ], + }, + approvazione: { + title: '19. การอนุมัติและช่องทางติดต่อที่เป็นประโยชน์', + items: [ + { + label: 'อนุมัติโดย', + text: 'หน่วยงานที่มีอำนาจ / กรรมการผู้จัดการ (ชื่อ-นามสกุลตอนลงนาม)', + }, + { + label: 'ผู้รับผิดชอบการอัปเดต', + text: 'Legal & compliance โดยสนับสนุนจาก DPO และ CISO', + }, + { + label: 'การทบทวน', + text: 'อย่างน้อยปีละครั้ง หรือเมื่อมีการเปลี่ยนแปลงสำคัญ', + }, + ], + contacts: [ + { label: 'DPO / ผู้ติดต่อความเป็นส่วนตัว', email: 'privacy@nexstudio.com' }, + { label: 'Security / incident response', email: 'security@nexstudio.com' }, + { + label: 'การรายงานที่เป็นความลับ', + email: 'ethics@nexstudio.com', + note: 'anonymous', + }, + { label: 'Legal', email: 'legal@nexstudio.com' }, + { label: 'HR', email: 'hr@nexstudio.com' }, + ], + }, + adesione: { + title: 'ข้อยอมรับสุดท้าย (ลงนามตอนปฐมนิเทศ)', + textBefore: 'ข้าพเจ้าขอประกาศว่าได้อ่านและเข้าใจประมวลจริยธรรมของ ', + textAfter: + ' และสัญญาว่าจะเคารพหลักการและขั้นตอนของประมวล ข้าพเจ้ายังสัญญาว่าจะรายงานโดยสุจริต ซึ่งการละเมิดใดๆ ที่ข้าพเจ้าอาจทราบ', + }, + notePratiche: { + title: 'บันทึกเชิงปฏิบัติและขั้นตอนถัดไปที่แนะนำ', + items: [ + 'ปรับแต่งเอกสารด้วยชื่อบริษัทอย่างเป็นทางการ (หากต่างจากแบรนด์ปฏิบัติการ) ลายเซ็น และการอ้างอิงทางกฎหมายท้องถิ่นในกรุงเทพฯ', + 'แนบเทมเพลตที่ระบุเป็นเอกสารแยก และจัดทำช่องทางเทคนิคสำหรับการรายงานและ bug bounty', + 'จัดทำแผนการฝึกอบรม 90 วันสำหรับการปฐมนิเทศและการฝึกอบรมประจำปี', + ], + }, + notePraticheDPIA: [ + 'ดำเนินการ DPIA สำหรับการประมวลผลวิกฤตในแต่ละขอบเขต (โดยเฉพาะการประมวลผลด้านสุขภาพหรือกฎหมายที่มีความวิกฤตสูง) โดยบันทึกความเชื่อมโยงกับสายผลิตภัณฑ์ที่เกี่ยวข้อง', + 'สำหรับสาย Health Tech / MediAura หรือเทียบเท่า ตรวจสอบว่าส่วนใดของผลิตภัณฑ์อยู่ในนิยามของอุปกรณ์การแพทย์หรือซอฟต์แวร์เพื่อวัตถุประสงค์ทางการแพทย์ เพื่อการขึ้นทะเบียนหรืออนุมัติตามตลาดและการจำแนกที่เลือก', + ], + }, +}; + +function productListPhrase(locale: SupportedLocale): string { + const data = codiceEticoByLocale[locale]; + const lines = data.productLines.filter( + (p): p is Extract => p.id !== 'platform', ); return lines - .map((p) => (p.id !== 'platform' && 'productName' in p ? `${p.productName} (${p.name})` : p.name)) - .join(' e '); + .map((p) => `${p.productName} (${p.name})`) + .join(data.productListJoiner); } -/** Testo unico per §1, coerente con `productLines` */ -export function getCodiceEticoPremessa(): string { - const elenco = getCodiceEticoProductListPhrase(); - return ( - 'Questo Codice Etico stabilisce i principi, i doveri e le regole di comportamento che tutti i ' + - 'soggetti coinvolti in NexStudio (di seguito «Società») devono osservare nello ' + - 'sviluppo, nella commercializzazione e nella gestione di soluzioni SaaS, con riferimento organizzato per linee (piattaforma comune, ambito legale, ambito sanitario) e, in concreto, in particolare a ' + - elenco + - ". Se l'offerta si arricchirà o diverrà, le nuove linee a elevata regolamentazione andranno descritte con lo stesso schema (piattaforma + perimetro di dominio), tramite allegati o revisione del testo, senza mescolare criteri tra verticalità. " + - 'Mira a garantire conformità normativa, tutela della privacy, sicurezza, ' + - 'qualità tecnica, protezione dei diritti degli utenti e responsabilità professionale.' - ); +export function getCodiceEticoProductListPhrase( + locale: SupportedLocale = 'it', +): string { + return productListPhrase(locale); } -/** Esempio: validazione in §7, separata per perimetro; estendere l'array con nuove righe. */ -export const qualitaValidazioneProdotto: readonly { id: string; text: string }[] = [ - { - id: 'legal', - text: 'per funzionalità che supportano scelte o attività in ambito legale, validazione con esperti legali, studi pilota, documentazione di limiti e avvertenze, così come previsto per LexAura o equivalenti in Legal Tech.', - }, - { - id: 'health', - text: 'per funzionalità che assistono decisioni cliniche o attività sanitarie, validazione con esperti clinici, studi pilota, avvertenze, così come previsto per MediAura o equivalenti in Health Tech.', - }, -]; +export function getCodiceEticoPremessa(locale: SupportedLocale = 'it'): string { + const data = codiceEticoByLocale[locale]; + return data.premessaBefore + productListPhrase(locale) + data.premessaAfter; +} -/** Voci in “Note pratiche” che dipendono dalla stessa separazione dominio. */ -export const notePraticheDPIA: readonly string[] = [ - "Eseguire DPIA per trattamenti critici per ciascun perimetro (in particolare trattamenti sanitari o legali a elevata criticità) documentando il nesso con le linee prodotto coinvolte.", - "Per la linea Health Tech / MediAura o equivalenti, verificare se parti del prodotto rientrano nella definizione di dispositivo medico o software a scopo medico, ai fini di registrazione o approvazione secondo il mercato e la classificazione scelta.", -]; +export const getCodiceEtico = (locale: SupportedLocale) => { + const data = codiceEticoByLocale[locale]; + return { + ...data, + productListPhrase: productListPhrase(locale), + premessa: getCodiceEticoPremessa(locale), + }; +}; -/** - * §5.1 — separazione netta tra fornitore SaaS, sottoscrittori (medici, avvocati, strutture) - * e interessati (pazienti, clienti delle parti). Il testo legale completo resta in - * privacy policy, DPA e informative verso pazienti/clienti; qui solo principi e condotta. - */ -export const codiceEticoTutelaDatiRuoli = { - anchorId: 'tutela-dati-ruoli', - title: '5.1 Pazienti, clienti degli studi e abbonamento: ruoli e trattamento', - intro: - "Sì, va spiegata la divisione di ruoli: il Codice fissa cosa ci aspettiamo da ciascuna parte, senza sostituire l’informativa privacy né i contratti. Sotto, in sintesi, chi tratta i dati dei pazienti e dei clienti rispetto agli studi e con quali doveri (Società, sottoscrittori, interessati).", - rows: [ - { - label: 'NexStudio (fornitore / operatore del servizio)', - text: - "La Società tratta dati personali e, ove presenti, categorie particolari (es. salute, situazione giuridica) solo per fornire, proteggere e migliorare le piattaforme, per supporto, sicurezza, fatturazione, adempimenti di legge e, se contrattualmente previsto, per assistere il titolare nell’onorare i diritti degli interessati. Divieto, per chi lavora in Società, di usi incompatibili, di rivendere i dati a scopi estranei al servizio, e di accedere al contenuto professionale oltre quanto necessario tecnicamente o per la gestione del supporto autorizzata. Le qualifiche giuridiche esatte (es. responsabile del trattamento, art. 28 GDPR, o altro schema sotto PDPA) sono definite per iscritto in DPA e documenti privacy.", - }, - { - label: 'Sottoscrittori in abbonamento (studi legali, medici, strutture, team iscritti)', - text: - "I sottoscrittori sono, di regola, titolari o co-titolari del trattamento sui dati che inseriscono o fanno inserire nella piattaforma: in particolare pazienti o assistiti (Health Tech) e clienti, controparti o terzi coinvolti in fascicoli o pratiche (Legal Tech), oltre ai dati del proprio personale. Devono: avere base giuridica e informative adeguate verso i propri pazienti, clienti e assistiti, rispettare obblighi deontologici (segreto, riservatezza, tenuta degli atti), mappare finalità e tempi, dare istruzioni documentate al fornitore ove serva la nomina di responsabile, e rispondere in prima istanza alle richieste di accesso, rettifica, cancellazione e opposizione degli interessati, collaborando con NexStudio quando servono strumenti tecnici o log.", - }, - { - label: 'Pazienti e clienti (interessati)', - text: - "Esercitano i diritti privacy in primis verso lo studio, la struttura o il professionista che tratti i loro dati. NexStudio, salvo esercizio diretto previsto per legge o canale specifico, inoltra o supporta l’esercizio attraverso il titolare, nei tempi e modi del contratto e del prodotto.", - }, - ], - note: - "I dettagli operativi (categorie, tempi, tabella del trattamento, sub-responsabili, trasferimenti extra-UE, testi informativa rivolti a pazienti o clienti delle parti) stanno in Privacy policy, informativa cookie, DPA, condizioni d’uso e allegati, aggiornabili senza riformulare l’intero Codice quando cambia solo l’allegato legale.", +/** Retro-compatibilità: fallback italiano. */ +export const codiceEtico = { + productLines: codiceEticoByLocale.it.productLines, } as const; + +export const codiceEticoConformityBlocks = + codiceEticoByLocale.it.conformityBlocks; +export const qualitaValidazioneProdotto = + codiceEticoByLocale.it.qualitaValidazioneProdotto; +export const notePraticheDPIA = codiceEticoByLocale.it.notePraticheDPIA; +export const codiceEticoTutelaDatiRuoli = + codiceEticoByLocale.it.tutelaDatiRuoli; diff --git a/src/data/cookie-consent.ts b/src/data/cookie-consent.ts index c7a0e8d..f96a5c1 100644 --- a/src/data/cookie-consent.ts +++ b/src/data/cookie-consent.ts @@ -2,6 +2,8 @@ * Consenso cookie — NexStudio CMP (dimostrativo / produzione light). * Allineare `policyVersion` quando cambiano categorie o testi legali rilevanti. */ +import type { SupportedLocale } from './home/navigation'; + export const cookieConsentMeta = { storageKey: 'nexstudio.cookieConsent', policyVersion: '1.0', @@ -13,33 +15,153 @@ export type CookieCategoryId = | 'analytics' | 'marketing'; -export const cookieCategories = [ - { - id: 'necessary' as const, - label: 'Strettamente necessari', - description: - 'Memorizzazione delle preferenze di consenso, sicurezza e funzioni indispensabili al sito. Non possono essere disattivati dal pannello.', - required: true, +const cookieCategoriesByLocale = { + it: [ + { + id: 'necessary' as const, + label: 'Strettamente necessari', + description: + 'Memorizzazione delle preferenze di consenso, sicurezza e funzioni indispensabili al sito. Non possono essere disattivati dal pannello.', + required: true, + }, + { + id: 'preferences' as const, + label: 'Preferenze e funzionalità', + description: + 'Ricordare impostazioni opzionali (es. lingua, tema) se introdotte in futuro.', + required: false, + }, + { + id: 'analytics' as const, + label: 'Misurazione e statistica', + description: + 'Cookie o SDK per capire come viene usato il sito (es. analytics), solo se attivati dal codice dopo consenso.', + required: false, + }, + { + id: 'marketing' as const, + label: 'Marketing e profilazione leggera', + description: + 'Strumenti pubblicitari, remarketing o pixel social, solo se collegati e dopo consenso esplicito.', + required: false, + }, + ], + en: [ + { + id: 'necessary' as const, + label: 'Strictly necessary', + description: + 'Storage of consent preferences, security, and essential site functions. These cannot be disabled from the panel.', + required: true, + }, + { + id: 'preferences' as const, + label: 'Preferences and functionality', + description: + 'Remember optional settings (e.g. language, theme) if introduced in the future.', + required: false, + }, + { + id: 'analytics' as const, + label: 'Measurement and statistics', + description: + 'Cookies or SDKs to understand how the site is used (e.g. analytics), only if activated by code after consent.', + required: false, + }, + { + id: 'marketing' as const, + label: 'Marketing and light profiling', + description: + 'Advertising tools, remarketing, or social pixels, only if connected and after explicit consent.', + required: false, + }, + ], + th: [ + { + id: 'necessary' as const, + label: 'จำเป็นอย่างยิ่ง', + description: + 'จัดเก็บการตั้งค่าความยินยอม ความปลอดภัย และฟังก์ชันที่จำเป็นต่อเว็บไซต์ ไม่สามารถปิดได้จากแผงควบคุม', + required: true, + }, + { + id: 'preferences' as const, + label: 'การตั้งค่าและฟังก์ชัน', + description: + 'จดจำการตั้งค่าเพิ่มเติม (เช่น ภาษา ธีม) หากมีการเพิ่มในอนาคต', + required: false, + }, + { + id: 'analytics' as const, + label: 'การวัดผลและสถิติ', + description: + 'คุกกี้หรือ SDK เพื่อทำความเข้าใจการใช้งานเว็บไซต์ (เช่น analytics) จะเปิดใช้หลังได้รับความยินยอมเท่านั้น', + required: false, + }, + { + id: 'marketing' as const, + label: 'การตลาดและการทำโปรไฟล์แบบเบา', + description: + 'เครื่องมือโฆษณา remarketing หรือพิกเซลโซเชียล เฉพาะเมื่อเชื่อมต่อแล้วและหลังได้รับความยินยอมอย่างชัดเจน', + required: false, + }, + ], +} as const; + +const cookieConsentUiByLocale = { + it: { + bannerTitle: 'Utilizziamo cookie e memorizzazione locale', + bannerDescBefore: + 'Seleziona le categorie che preferisci. I necessari restano attivi per registrare la tua scelta. Dettagli nella', + bannerPolicyLinkLabel: 'informativa cookie', + rejectLabel: 'Rifiuta non essenziali', + customizeLabel: 'Personalizza', + acceptLabel: 'Accetta tutto', + dialogTitle: 'Preferenze cookie', + dialogIntroBefore: 'Versione informativa v', + dialogIntroAfter: + '. Puoi modificare le scelte in qualsiasi momento dal footer.', + alwaysOnLabel: 'Sempre attivi', + cancelLabel: 'Chiudi', + saveLabel: 'Salva preferenze', }, - { - id: 'preferences' as const, - label: 'Preferenze e funzionalità', - description: - 'Ricordare impostazioni opzionali (es. lingua, tema) se introdotte in futuro.', - required: false, + en: { + bannerTitle: 'We use cookies and local storage', + bannerDescBefore: + 'Choose the categories you prefer. Necessary cookies stay active to record your choice. Details in the', + bannerPolicyLinkLabel: 'cookie policy', + rejectLabel: 'Reject non-essential', + customizeLabel: 'Customize', + acceptLabel: 'Accept all', + dialogTitle: 'Cookie preferences', + dialogIntroBefore: 'Policy version v', + dialogIntroAfter: '. You can change your choices anytime from the footer.', + alwaysOnLabel: 'Always on', + cancelLabel: 'Close', + saveLabel: 'Save preferences', }, - { - id: 'analytics' as const, - label: 'Misurazione e statistica', - description: - 'Cookie o SDK per capire come viene usato il sito (es. analytics), solo se attivati dal codice dopo consenso.', - required: false, + th: { + bannerTitle: 'เราใช้คุกกี้และการจัดเก็บในเครื่อง', + bannerDescBefore: + 'เลือกหมวดหมู่ที่คุณต้องการ คุกกี้ที่จำเป็นยังคงเปิดอยู่เพื่อบันทึกทางเลือกของคุณ รายละเอียดอยู่ใน', + bannerPolicyLinkLabel: 'นโยบายคุกกี้', + rejectLabel: 'ปฏิเสธที่ไม่จำเป็น', + customizeLabel: 'ปรับแต่ง', + acceptLabel: 'ยอมรับทั้งหมด', + dialogTitle: 'การตั้งค่าคุกกี้', + dialogIntroBefore: 'เวอร์ชันนโยบาย v', + dialogIntroAfter: ' คุณสามารถเปลี่ยนตัวเลือกได้ตลอดเวลาจากส่วนท้ายเว็บไซต์', + alwaysOnLabel: 'เปิดเสมอ', + cancelLabel: 'ปิด', + saveLabel: 'บันทึกการตั้งค่า', }, - { - id: 'marketing' as const, - label: 'Marketing e profilazione leggera', - description: - 'Strumenti pubblicitari, remarketing o pixel social, solo se collegati e dopo consenso esplicito.', - required: false, - }, -] as const; +} as const; + +export const getCookieCategories = (locale: SupportedLocale) => + cookieCategoriesByLocale[locale]; + +export const getCookieConsentUi = (locale: SupportedLocale) => + cookieConsentUiByLocale[locale]; + +/** Retro-compatibilità: fallback italiano. */ +export const cookieCategories = cookieCategoriesByLocale.it; diff --git a/src/data/cookies.ts b/src/data/cookies.ts new file mode 100644 index 0000000..f476332 --- /dev/null +++ b/src/data/cookies.ts @@ -0,0 +1,829 @@ +/** + * Cookie Policy del portale NexStudio. + * Centralizza i contenuti di /cookies per revisioni legali e localizzazione IT/EN/TH. + */ +import type { SupportedLocale } from './home/navigation'; + +export type CookiesRichPart = + | { t: 'text'; v: string } + | { t: 'link'; href: string; label: string; external?: boolean } + | { t: 'em'; v: string } + | { t: 'strong'; v: string }; + +export type CookiesDefinition = { + term: string; + definition: string; +}; + +export type CookiesSubsection = { + title: string; + purposeLabel?: string; + purpose?: string; + legalBasisLabel?: string; + legalBasis?: string; +}; + +export type CookiesBullet = + | string + | { strong: string; after?: string } + | { before: string; strong: string; after?: string }; + +export type CookiesSection = { + id: string; + title: string; + paragraphs?: readonly string[]; + richParagraphs?: readonly (readonly CookiesRichPart[])[]; + definitions?: readonly CookiesDefinition[]; + subsections?: readonly CookiesSubsection[]; + bullets?: readonly CookiesBullet[]; + paragraphsAfterBullets?: readonly (string | readonly CookiesRichPart[])[]; + table?: { + headers: readonly string[]; + emptyNote: string; + }; +}; + +type CookiesLocaleBundle = { + document: { version: string; inVigoreDal: string }; + riferimenti: readonly { label: string; href: string }[]; + sections: readonly CookiesSection[]; + page: { + title: string; + description: string; + heading: string; + lead: string; + versionLabel: string; + inForceFromLabel: string; + consentVersionLabel: string; + relatedDocsLabel: string; + indexLabel: string; + }; +}; + +const cookiesByLocale: Record = { + it: { + document: { + version: '1.1', + inVigoreDal: '[DATA]', + }, + riferimenti: [ + { label: 'Informativa privacy', href: '/privacy' }, + { label: "Condizioni d'uso", href: '/terms' }, + { label: 'Diritti GDPR', href: '/gdpr' }, + ], + sections: [ + { + id: 'premessa', + title: '1. Premessa', + richParagraphs: [ + [ + { + t: 'text', + v: 'Questa Cookie Policy descrive le tipologie di cookie e tecnologie simili utilizzate sul sito web di NexStudio S.r.l. (di seguito «NexStudio», «noi»), con sede legale in Italia, [INDIRIZZO_COMPLETO], e spiega come gestire le preferenze. Per il trattamento dei dati personali e per i diritti degli interessati si rimanda all’', + }, + { t: 'link', href: '/privacy', label: 'Informativa privacy' }, + { t: 'text', v: '.' }, + ], + [ + { + t: 'text', + v: 'Per le cookie policy dei prodotti SaaS LexAura e MediAura, consultare le rispettive pagine sui portali dedicati.', + }, + ], + ], + }, + { + id: 'definizioni', + title: '2. Definizioni', + definitions: [ + { + term: 'Cookie', + definition: + 'piccolo file di testo inviato dal sito al browser e memorizzato sul dispositivo, re-inviato al sito alle visite successive.', + }, + { + term: 'Cookie di prima parte', + definition: 'impostati dal dominio del sito che l’utente visita.', + }, + { + term: 'Cookie di terze parti', + definition: + 'impostati da domini diversi (fornitori esterni, embed, CDN, strumenti di misura).', + }, + { + term: 'Tecnologie simili', + definition: + 'web beacon, pixel, local storage, e in generale identificatori lato client.', + }, + ], + }, + { + id: 'finalita', + title: '3. Finalità dei cookie e categorie', + subsections: [ + { + title: '3.1 Cookie strettamente necessari (essenziali)', + purposeLabel: 'Finalità', + purpose: + 'navigazione, sicurezza, gestione sessione, memorizzazione delle preferenze di consenso.', + legalBasisLabel: 'Base giuridica', + legalBasis: + 'legittimo interesse del titolare (Art. 6.1.f GDPR) a garantire il funzionamento del servizio richiesto dall’utente.', + }, + { + title: '3.2 Cookie di preferenza / funzionali', + purposeLabel: 'Finalità', + purpose: 'lingua, regione, tema o altre impostazioni di interfaccia.', + legalBasisLabel: 'Base giuridica', + legalBasis: 'consenso (Art. 6.1.a GDPR).', + }, + { + title: '3.3 Cookie di performance / analytics', + purposeLabel: 'Finalità', + purpose: 'statistiche aggregate su visite e percorsi per migliorare il sito.', + legalBasisLabel: 'Base giuridica', + legalBasis: 'consenso (Art. 6.1.a GDPR).', + }, + { + title: '3.4 Cookie per advertising e targeting', + purposeLabel: 'Finalità', + purpose: 'pubblicità mirata, remarketing, misura delle campagne.', + legalBasisLabel: 'Base giuridica', + legalBasis: 'consenso esplicito.', + }, + { + title: '3.5 Cookie di terze parti e integrazioni social', + purposeLabel: 'Finalità', + purpose: + 'video incorporati, pulsanti social, mappe, chat di terze parti. Il trattamento da parte di terzi è regolato dalle rispettive policy.', + }, + ], + }, + { + id: 'elenco', + title: '4. Elenco dei cookie utilizzati', + paragraphs: [ + 'Elenco in appendice tecnica (da mantenere aggiornato con scansione periodica).', + ], + table: { + headers: ['Nome', 'Provider', 'Categoria', 'Durata', 'Tipo', 'Base giuridica'], + emptyNote: 'Da compilare dopo scansione del sito in staging e produzione.', + }, + }, + { + id: 'base-giuridica', + title: '5. Base giuridica', + bullets: [ + 'Cookie tecnici essenziali: legittimo interesse del titolare (Art. 6.1.f GDPR).', + 'Cookie analitici e di marketing: consenso libero, informato e revocabile (Art. 6.1.a GDPR).', + ], + }, + { + id: 'consenso', + title: '6. Modalità di raccolta del consenso e registro', + paragraphs: [ + 'Il sito utilizza una CMP first-party. Al primo accesso viene mostrato un banner con:', + ], + bullets: [ + { strong: 'Rifiuta non essenziali' }, + { strong: 'Personalizza', after: ' (apertura pannello categorie)' }, + { strong: 'Accetta tutto' }, + ], + paragraphsAfterBullets: [ + [ + { t: 'text', v: 'La prova della scelta è memorizzata nel browser in ' }, + { t: 'em', v: 'local storage' }, + { t: 'text', v: '.' }, + ], + ], + }, + { + id: 'revoca', + title: '7. Gestione e revoca del consenso', + bullets: [ + { + before: 'Tramite il banner o il pannello ', + strong: 'Personalizza', + after: ' al primo accesso.', + }, + { + before: 'In qualsiasi momento tramite ', + strong: 'Impostazioni cookie', + after: ' nel footer del sito.', + }, + 'Cancellando i dati locali del sito dalle impostazioni del browser.', + ], + }, + { + id: 'browser', + title: '8. Disabilitazione via browser e impatto', + paragraphs: [ + 'È possibile bloccare o cancellare i cookie dalle impostazioni del browser (Chrome, Firefox, Safari, Edge e altri).', + ], + }, + { + id: 'terze-parti', + title: '9. Cookie di terze parti e responsabilità', + paragraphs: [ + 'Il sito può integrare strumenti di terze parti (analytics, CDN, social). Le terze parti possono impostare cookie propri e trattare dati secondo le loro policy.', + ], + }, + { + id: 'retention', + title: '10. Conservazione e criteri di retention', + paragraphs: [ + 'Le durate dei singoli cookie seguono le tabelle pubblicate e le policy dei fornitori. Cookie di consenso: 365 giorni, rinnovabili. Log di sicurezza: massimo 30 giorni.', + ], + }, + { + id: 'trasferimenti', + title: '11. Trasferimenti internazionali', + paragraphs: [ + 'Alcuni fornitori possono trattare dati in Paesi terzi (es. Stati Uniti). Ove applicabile si adottano garanzie come clausole contrattuali standard, decisioni di adeguatezza o altre basi previste dalla legge.', + ], + }, + { + id: 'minori', + title: '12. Minori età', + paragraphs: ['Il sito non è rivolto alla raccolta intenzionale di dati di minori.'], + }, + { + id: 'sicurezza', + title: '13. Misure di sicurezza', + paragraphs: [ + 'Si applicano misure tecniche e organizzative appropriate: trasmissione su TLS, accesso limitato ai log, principio di minimizzazione.', + ], + }, + { + id: 'advertising', + title: '14. Consenso per scopi pubblicitari e profiling', + paragraphs: [ + 'Profilazione e pubblicità comportano consenso esplicito e tracciabilità della scelta.', + ], + }, + { + id: 'effetti', + title: '15. Effetti di rifiuto o accettazione', + paragraphs: [ + 'Accettando le categorie opzionali si abilitano preferenze avanzate, analytics e funzioni di marketing. Rifiutando i non essenziali il sito resta navigabile.', + ], + }, + { + id: 'modifiche', + title: '16. Modifiche alla Cookie Policy', + paragraphs: [ + 'La Policy può essere aggiornata quando cambiano cookie, fornitori o norme. Sarà indicata la data di revisione.', + ], + }, + { + id: 'diritti', + title: '17. Diritti degli interessati e contatti', + richParagraphs: [ + [ + { + t: 'text', + v: 'Diritti: accesso, rettifica, cancellazione, limitazione, portabilità, opposizione e revoca del consenso. Per esercitarli: ', + }, + { t: 'link', href: 'mailto:privacy@nexstudio.com', label: 'privacy@nexstudio.com' }, + { + t: 'text', + v: ' e tramite il form su nexstudio.ai. Autorità di controllo: Garante per la protezione dei dati personali (', + }, + { + t: 'link', + href: 'https://www.garanteprivacy.it', + label: 'www.garanteprivacy.it', + external: true, + }, + { t: 'text', v: ').' }, + ], + ], + }, + ], + page: { + title: 'Cookie Policy — NexStudio', + description: + 'Cookie Policy NexStudio S.r.l.: categorie, base giuridica, consenso, terze parti, diritti e contatti. Sede legale in Italia.', + heading: 'Cookie Policy', + lead: + 'Titolare del trattamento: NexStudio S.r.l., con sede legale in Italia, [INDIRIZZO_COMPLETO].', + versionLabel: 'Versione', + inForceFromLabel: 'In vigore dal', + consentVersionLabel: 'Versione tecnica consenso', + relatedDocsLabel: 'Documenti connessi', + indexLabel: 'Indice', + }, + }, + en: { + document: { + version: '1.1', + inVigoreDal: '[DATA]', + }, + riferimenti: [ + { label: 'Privacy notice', href: '/privacy' }, + { label: 'Terms of use', href: '/terms' }, + { label: 'GDPR rights', href: '/gdpr' }, + ], + sections: [ + { + id: 'premessa', + title: '1. Introduction', + richParagraphs: [ + [ + { + t: 'text', + v: 'This Cookie Policy describes the types of cookies and similar technologies used on the website of NexStudio S.r.l. (hereinafter “NexStudio”, “we”), with registered office in Italy, [INDIRIZZO_COMPLETO], and explains how to manage preferences. For personal data processing and data subject rights, please refer to the ', + }, + { t: 'link', href: '/privacy', label: 'Privacy notice' }, + { t: 'text', v: '.' }, + ], + [ + { + t: 'text', + v: 'For the cookie policies of the LexAura and MediAura SaaS products, please consult the dedicated pages on the respective portals.', + }, + ], + ], + }, + { + id: 'definizioni', + title: '2. Definitions', + definitions: [ + { + term: 'Cookie', + definition: + 'a small text file sent by the site to the browser and stored on the device, then sent back to the site on subsequent visits.', + }, + { + term: 'First-party cookie', + definition: 'set by the domain of the site the user is visiting.', + }, + { + term: 'Third-party cookie', + definition: + 'set by different domains (external providers, embeds, CDNs, measurement tools).', + }, + { + term: 'Similar technologies', + definition: + 'web beacons, pixels, local storage, and client-side identifiers in general.', + }, + ], + }, + { + id: 'finalita', + title: '3. Cookie purposes and categories', + subsections: [ + { + title: '3.1 Strictly necessary (essential) cookies', + purposeLabel: 'Purpose', + purpose: + 'navigation, security, session management, storage of consent preferences.', + legalBasisLabel: 'Legal basis', + legalBasis: + 'legitimate interest of the controller (Art. 6.1.f GDPR) in ensuring the operation of the service requested by the user.', + }, + { + title: '3.2 Preference / functional cookies', + purposeLabel: 'Purpose', + purpose: 'language, region, theme, or other interface settings.', + legalBasisLabel: 'Legal basis', + legalBasis: 'consent (Art. 6.1.a GDPR).', + }, + { + title: '3.3 Performance / analytics cookies', + purposeLabel: 'Purpose', + purpose: 'aggregate statistics on visits and journeys to improve the site.', + legalBasisLabel: 'Legal basis', + legalBasis: 'consent (Art. 6.1.a GDPR).', + }, + { + title: '3.4 Advertising and targeting cookies', + purposeLabel: 'Purpose', + purpose: 'targeted advertising, remarketing, campaign measurement.', + legalBasisLabel: 'Legal basis', + legalBasis: 'explicit consent.', + }, + { + title: '3.5 Third-party cookies and social integrations', + purposeLabel: 'Purpose', + purpose: + 'embedded videos, social buttons, maps, third-party chat. Processing by third parties is governed by their respective policies.', + }, + ], + }, + { + id: 'elenco', + title: '4. List of cookies used', + paragraphs: [ + 'Technical appendix list (to be kept up to date with periodic scanning).', + ], + table: { + headers: ['Name', 'Provider', 'Category', 'Duration', 'Type', 'Legal basis'], + emptyNote: 'To be completed after scanning the site in staging and production.', + }, + }, + { + id: 'base-giuridica', + title: '5. Legal basis', + bullets: [ + 'Essential technical cookies: legitimate interest of the controller (Art. 6.1.f GDPR).', + 'Analytics and marketing cookies: free, informed, and revocable consent (Art. 6.1.a GDPR).', + ], + }, + { + id: 'consenso', + title: '6. Consent collection method and record', + paragraphs: [ + 'The site uses a first-party CMP. On first visit a banner is shown with:', + ], + bullets: [ + { strong: 'Reject non-essential' }, + { strong: 'Customize', after: ' (opens category panel)' }, + { strong: 'Accept all' }, + ], + paragraphsAfterBullets: [ + [ + { t: 'text', v: 'Proof of the choice is stored in the browser in ' }, + { t: 'em', v: 'local storage' }, + { t: 'text', v: '.' }, + ], + ], + }, + { + id: 'revoca', + title: '7. Managing and withdrawing consent', + bullets: [ + { + before: 'Via the banner or the ', + strong: 'Customize', + after: ' panel on first visit.', + }, + { + before: 'At any time via ', + strong: 'Cookie settings', + after: ' in the site footer.', + }, + 'By clearing the site’s local data from browser settings.', + ], + }, + { + id: 'browser', + title: '8. Browser disabling and impact', + paragraphs: [ + 'You can block or delete cookies from browser settings (Chrome, Firefox, Safari, Edge, and others).', + ], + }, + { + id: 'terze-parti', + title: '9. Third-party cookies and responsibility', + paragraphs: [ + 'The site may integrate third-party tools (analytics, CDN, social). Third parties may set their own cookies and process data under their policies.', + ], + }, + { + id: 'retention', + title: '10. Retention and retention criteria', + paragraphs: [ + 'Individual cookie durations follow the published tables and provider policies. Consent cookies: 365 days, renewable. Security logs: maximum 30 days.', + ], + }, + { + id: 'trasferimenti', + title: '11. International transfers', + paragraphs: [ + 'Some providers may process data in third countries (e.g. the United States). Where applicable, safeguards such as standard contractual clauses, adequacy decisions, or other bases provided by law are adopted.', + ], + }, + { + id: 'minori', + title: '12. Minors', + paragraphs: [ + 'The site is not directed at the intentional collection of minors’ data.', + ], + }, + { + id: 'sicurezza', + title: '13. Security measures', + paragraphs: [ + 'Appropriate technical and organisational measures apply: TLS transmission, limited log access, minimisation principle.', + ], + }, + { + id: 'advertising', + title: '14. Consent for advertising and profiling', + paragraphs: [ + 'Profiling and advertising require explicit consent and traceability of the choice.', + ], + }, + { + id: 'effetti', + title: '15. Effects of refusal or acceptance', + paragraphs: [ + 'Accepting optional categories enables advanced preferences, analytics, and marketing features. Rejecting non-essential cookies keeps the site navigable.', + ], + }, + { + id: 'modifiche', + title: '16. Changes to the Cookie Policy', + paragraphs: [ + 'The Policy may be updated when cookies, providers, or rules change. The revision date will be indicated.', + ], + }, + { + id: 'diritti', + title: '17. Data subject rights and contacts', + richParagraphs: [ + [ + { + t: 'text', + v: 'Rights: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. To exercise them: ', + }, + { t: 'link', href: 'mailto:privacy@nexstudio.com', label: 'privacy@nexstudio.com' }, + { + t: 'text', + v: ' and via the form on nexstudio.ai. Supervisory authority: Garante per la protezione dei dati personali (', + }, + { + t: 'link', + href: 'https://www.garanteprivacy.it', + label: 'www.garanteprivacy.it', + external: true, + }, + { t: 'text', v: ').' }, + ], + ], + }, + ], + page: { + title: 'Cookie Policy — NexStudio', + description: + 'NexStudio S.r.l. Cookie Policy: categories, legal basis, consent, third parties, rights, and contacts. Registered office in Italy.', + heading: 'Cookie Policy', + lead: + 'Data controller: NexStudio S.r.l., with registered office in Italy, [INDIRIZZO_COMPLETO].', + versionLabel: 'Version', + inForceFromLabel: 'In force from', + consentVersionLabel: 'Technical consent version', + relatedDocsLabel: 'Related documents', + indexLabel: 'Index', + }, + }, + th: { + document: { + version: '1.1', + inVigoreDal: '[DATA]', + }, + riferimenti: [ + { label: 'ประกาศความเป็นส่วนตัว', href: '/privacy' }, + { label: 'เงื่อนไขการใช้งาน', href: '/terms' }, + { label: 'สิทธิ GDPR', href: '/gdpr' }, + ], + sections: [ + { + id: 'premessa', + title: '1. บทนำ', + richParagraphs: [ + [ + { + t: 'text', + v: 'นโยบายคุกกี้นี้อธิบายประเภทของคุกกี้และเทคโนโลยีที่คล้ายกันซึ่งใช้บนเว็บไซต์ของ NexStudio S.r.l. (ต่อไปนี้เรียกว่า «NexStudio» หรือ «เรา») สำนักงานจดทะเบียนในอิตาลี [INDIRIZZO_COMPLETO] และอธิบายวิธีจัดการการตั้งค่า สำหรับการประมวลผลข้อมูลส่วนบุคคลและสิทธิของเจ้าของข้อมูล โปรดดูที่ ', + }, + { t: 'link', href: '/privacy', label: 'ประกาศความเป็นส่วนตัว' }, + { t: 'text', v: '.' }, + ], + [ + { + t: 'text', + v: 'สำหรับนโยบายคุกกี้ของผลิตภัณฑ์ SaaS LexAura และ MediAura โปรดดูหน้าที่เกี่ยวข้องบนพอร์ทัลเฉพาะ', + }, + ], + ], + }, + { + id: 'definizioni', + title: '2. คำจำกัดความ', + definitions: [ + { + term: 'คุกกี้', + definition: + 'ไฟล์ข้อความขนาดเล็กที่เว็บไซต์ส่งไปยังเบราว์เซอร์และเก็บไว้บนอุปกรณ์ แล้วส่งกลับไปยังเว็บไซต์ในการเข้าชมครั้งถัดไป', + }, + { + term: 'คุกกี้ฝั่งเว็บไซต์ (first-party)', + definition: 'ตั้งโดยโดเมนของเว็บไซต์ที่ผู้ใช้เข้าชม', + }, + { + term: 'คุกกี้ของบุคคลที่สาม', + definition: + 'ตั้งโดยโดเมนอื่น (ผู้ให้บริการภายนอก สื่อฝัง CDN เครื่องมือวัดผล)', + }, + { + term: 'เทคโนโลยีที่คล้ายกัน', + definition: + 'web beacon, พิกเซล, local storage และตัวระบุฝั่งไคลเอนต์โดยทั่วไป', + }, + ], + }, + { + id: 'finalita', + title: '3. วัตถุประสงค์และหมวดหมู่ของคุกกี้', + subsections: [ + { + title: '3.1 คุกกี้ที่จำเป็นอย่างเคร่งครัด (สำคัญ)', + purposeLabel: 'วัตถุประสงค์', + purpose: + 'การนำทาง ความปลอดภัย การจัดการเซสชัน และการจัดเก็บการตั้งค่าความยินยอม', + legalBasisLabel: 'ฐานทางกฎหมาย', + legalBasis: + 'ประโยชน์โดยชอบด้วยกฎหมายของผู้ควบคุม (มาตรา 6.1.f GDPR) เพื่อให้บริการที่ผู้ใช้ร้องขอทำงานได้', + }, + { + title: '3.2 คุกกี้การตั้งค่า / ฟังก์ชัน', + purposeLabel: 'วัตถุประสงค์', + purpose: 'ภาษา ภูมิภาค ธีม หรือการตั้งค่าอินเทอร์เฟซอื่น ๆ', + legalBasisLabel: 'ฐานทางกฎหมาย', + legalBasis: 'ความยินยอม (มาตรา 6.1.a GDPR)', + }, + { + title: '3.3 คุกกี้ประสิทธิภาพ / การวิเคราะห์', + purposeLabel: 'วัตถุประสงค์', + purpose: 'สถิติรวมเกี่ยวกับการเข้าชมและเส้นทางเพื่อปรับปรุงเว็บไซต์', + legalBasisLabel: 'ฐานทางกฎหมาย', + legalBasis: 'ความยินยอม (มาตรา 6.1.a GDPR)', + }, + { + title: '3.4 คุกกี้โฆษณาและการกำหนดเป้าหมาย', + purposeLabel: 'วัตถุประสงค์', + purpose: 'โฆษณาที่ตรงเป้าหมาย การ remarketing และการวัดผลแคมเปญ', + legalBasisLabel: 'ฐานทางกฎหมาย', + legalBasis: 'ความยินยอมอย่างชัดแจ้ง', + }, + { + title: '3.5 คุกกี้ของบุคคลที่สามและการผสานโซเชียล', + purposeLabel: 'วัตถุประสงค์', + purpose: + 'วิดีโอฝัง ปุ่มโซเชียล แผนที่ แชทของบุคคลที่สาม การประมวลผลโดยบุคคลที่สามอยู่ภายใต้นโยบายของตน', + }, + ], + }, + { + id: 'elenco', + title: '4. รายการคุกกี้ที่ใช้', + paragraphs: [ + 'รายการในภาคผนวกทางเทคนิค (ต้องอัปเดตด้วยการสแกนเป็นระยะ)', + ], + table: { + headers: ['ชื่อ', 'ผู้ให้บริการ', 'หมวดหมู่', 'ระยะเวลา', 'ประเภท', 'ฐานทางกฎหมาย'], + emptyNote: 'ต้องกรอกหลังสแกนเว็บไซต์ใน staging และ production', + }, + }, + { + id: 'base-giuridica', + title: '5. ฐานทางกฎหมาย', + bullets: [ + 'คุกกี้ทางเทคนิคที่จำเป็น: ประโยชน์โดยชอบด้วยกฎหมายของผู้ควบคุม (มาตรา 6.1.f GDPR)', + 'คุกกี้วิเคราะห์และการตลาด: ความยินยอมที่อิสระ มีข้อมูล และเพิกถอนได้ (มาตรา 6.1.a GDPR)', + ], + }, + { + id: 'consenso', + title: '6. วิธีการเก็บความยินยอมและการบันทึก', + paragraphs: [ + 'เว็บไซต์ใช้ CMP ของฝั่งเว็บไซต์เอง ในการเข้าชมครั้งแรกจะแสดงแบนเนอร์พร้อม:', + ], + bullets: [ + { strong: 'ปฏิเสธที่ไม่จำเป็น' }, + { strong: 'ปรับแต่ง', after: ' (เปิดแผงหมวดหมู่)' }, + { strong: 'ยอมรับทั้งหมด' }, + ], + paragraphsAfterBullets: [ + [ + { t: 'text', v: 'หลักฐานการเลือกถูกเก็บไว้ในเบราว์เซอร์ใน ' }, + { t: 'em', v: 'local storage' }, + { t: 'text', v: '.' }, + ], + ], + }, + { + id: 'revoca', + title: '7. การจัดการและการเพิกถอนความยินยอม', + bullets: [ + { + before: 'ผ่านแบนเนอร์หรือแผง ', + strong: 'ปรับแต่ง', + after: ' ในการเข้าชมครั้งแรก', + }, + { + before: 'ได้ตลอดเวลาผ่าน ', + strong: 'การตั้งค่าคุกกี้', + after: ' ในส่วนท้ายของเว็บไซต์', + }, + 'โดยลบข้อมูลในเครื่องของเว็บไซต์จากการตั้งค่าเบราว์เซอร์', + ], + }, + { + id: 'browser', + title: '8. การปิดใช้งานผ่านเบราว์เซอร์และผลกระทบ', + paragraphs: [ + 'สามารถบล็อกหรือลบคุกกี้จากการตั้งค่าเบราว์เซอร์ได้ (Chrome, Firefox, Safari, Edge และอื่น ๆ)', + ], + }, + { + id: 'terze-parti', + title: '9. คุกกี้ของบุคคลที่สามและความรับผิดชอบ', + paragraphs: [ + 'เว็บไซต์อาจผสานเครื่องมือของบุคคลที่สาม (analytics, CDN, โซเชียล) บุคคลที่สามอาจตั้งคุกกี้ของตนเองและประมวลผลข้อมูลตามนโยบายของตน', + ], + }, + { + id: 'retention', + title: '10. การเก็บรักษาและเกณฑ์ retention', + paragraphs: [ + 'ระยะเวลาของคุกกี้แต่ละตัวเป็นไปตามตารางที่เผยแพร่และนโยบายของผู้ให้บริการ คุกกี้ความยินยอม: 365 วัน ต่ออายุได้ ล็อกความปลอดภัย: สูงสุด 30 วัน', + ], + }, + { + id: 'trasferimenti', + title: '11. การโอนข้อมูลระหว่างประเทศ', + paragraphs: [ + 'ผู้ให้บริการบางรายอาจประมวลผลข้อมูลในประเทศที่สาม (เช่น สหรัฐอเมริกา) เมื่อใช้ได้ จะใช้การรับประกัน เช่น ข้อสัญญามาตรฐาน การตัดสินใจว่าเพียงพอ หรือฐานอื่นตามกฎหมาย', + ], + }, + { + id: 'minori', + title: '12. ผู้เยาว์', + paragraphs: [ + 'เว็บไซต์ไม่ได้มุ่งเป้าไปที่การเก็บข้อมูลของผู้เยาว์โดยเจตนา', + ], + }, + { + id: 'sicurezza', + title: '13. มาตรการความปลอดภัย', + paragraphs: [ + 'ใช้มาตรการทางเทคนิคและองค์กรที่เหมาะสม: การส่งผ่าน TLS การเข้าถึงล็อกอย่างจำกัด หลักการลดข้อมูลให้เหลือน้อยที่สุด', + ], + }, + { + id: 'advertising', + title: '14. ความยินยอมเพื่อโฆษณาและการทำโปรไฟล์', + paragraphs: [ + 'การทำโปรไฟล์และโฆษณาต้องมีความยินยอมอย่างชัดแจ้งและความสามารถในการติดตามการเลือก', + ], + }, + { + id: 'effetti', + title: '15. ผลของการปฏิเสธหรือการยอมรับ', + paragraphs: [ + 'การยอมรับหมวดหมู่ที่ไม่บังคับจะเปิดใช้การตั้งค่าขั้นสูง analytics และฟังก์ชันการตลาด การปฏิเสธคุกกี้ที่ไม่จำเป็นยังคงทำให้เว็บไซต์ใช้งานได้', + ], + }, + { + id: 'modifiche', + title: '16. การเปลี่ยนแปลงนโยบายคุกกี้', + paragraphs: [ + 'นโยบายอาจได้รับการอัปเดตเมื่อคุกกี้ ผู้ให้บริการ หรือกฎระเบียบเปลี่ยน จะระบุวันที่แก้ไข', + ], + }, + { + id: 'diritti', + title: '17. สิทธิของเจ้าของข้อมูลและการติดต่อ', + richParagraphs: [ + [ + { + t: 'text', + v: 'สิทธิ: เข้าถึง แก้ไข ลบ จำกัด โอนย้าย คัดค้าน และเพิกถอนความยินยอม เพื่อใช้สิทธิ: ', + }, + { t: 'link', href: 'mailto:privacy@nexstudio.com', label: 'privacy@nexstudio.com' }, + { + t: 'text', + v: ' และผ่านแบบฟอร์มบน nexstudio.ai หน่วยงานกำกับดูแล: Garante per la protezione dei dati personali (', + }, + { + t: 'link', + href: 'https://www.garanteprivacy.it', + label: 'www.garanteprivacy.it', + external: true, + }, + { t: 'text', v: ')' }, + ], + ], + }, + ], + page: { + title: 'นโยบายคุกกี้ — NexStudio', + description: + 'นโยบายคุกกี้ของ NexStudio S.r.l.: หมวดหมู่ ฐานทางกฎหมาย ความยินยอม บุคคลที่สาม สิทธิ และการติดต่อ สำนักงานจดทะเบียนในอิตาลี', + heading: 'นโยบายคุกกี้', + lead: + 'ผู้ควบคุมข้อมูล: NexStudio S.r.l. สำนักงานจดทะเบียนในอิตาลี [INDIRIZZO_COMPLETO]', + versionLabel: 'เวอร์ชัน', + inForceFromLabel: 'มีผลตั้งแต่', + consentVersionLabel: 'เวอร์ชันทางเทคนิคของความยินยอม', + relatedDocsLabel: 'เอกสารที่เกี่ยวข้อง', + indexLabel: 'สารบัญ', + }, + }, +}; + +export const getCookies = (locale: SupportedLocale) => cookiesByLocale[locale]; diff --git a/src/data/dove-siamo.ts b/src/data/dove-siamo.ts new file mode 100644 index 0000000..6ffa724 --- /dev/null +++ b/src/data/dove-siamo.ts @@ -0,0 +1,95 @@ +/** + * Pagina Dove siamo / Where we are / ที่ตั้ง — contenuti localizzati. + */ +import type { SupportedLocale } from './home/navigation'; + +export type DoveSiamoSection = { + title: string; + paragraphs: readonly string[]; + /** When true, render "A — B" with both sides bold. */ + locationLine?: boolean; +} + +type DoveSiamoLocaleBundle = { + page: { + title: string; + description: string; + heading: string; + lead: string; + }; + sections: readonly DoveSiamoSection[]; +}; + +const doveSiamoByLocale: Record = { + it: { + page: { + title: 'Dove siamo — NexStudio', + description: + 'Sede operativa a Bangkok, Thailandia; fusi orari e lingue per lavorare con clienti in Europa e altre regioni.', + heading: 'Dove siamo', + lead: + 'NexStudio ha base a Bangkok, in Thailandia. Sotto, come organizziamo fusi orari e lingue rispetto a clienti in Europa e oltre.', + }, + sections: [ + { + title: 'Sede', + paragraphs: ['Thailandia — Bangkok'], + locationLine: true, + }, + { + title: 'Fusi orari e lingue', + paragraphs: [ + 'Il sito e il supporto via web possono essere gestiti in italiano, inglese, tedesco, francese, spagnolo e tailandese, con orari da concordare in base al team e al fuso rispetto ai clienti in Europa e altre regioni.', + ], + }, + ], + }, + en: { + page: { + title: 'Where we are — NexStudio', + description: + 'Operational base in Bangkok, Thailand; time zones and languages for working with clients in Europe and other regions.', + heading: 'Where we are', + lead: + 'NexStudio is based in Bangkok, Thailand. Below, how we organize time zones and languages relative to clients in Europe and beyond.', + }, + sections: [ + { + title: 'Location', + paragraphs: ['Thailand — Bangkok'], + locationLine: true, + }, + { + title: 'Time zones and languages', + paragraphs: [ + 'The site and web support can be handled in Italian, English, German, French, Spanish, and Thai, with hours to be agreed based on the team and time zone relative to clients in Europe and other regions.', + ], + }, + ], + }, + th: { + page: { + title: 'ที่ตั้ง — NexStudio', + description: + 'ฐานปฏิบัติการที่กรุงเทพฯ ประเทศไทย เขตเวลาและภาษาสำหรับการทำงานกับลูกค้าในยุโรปและภูมิภาคอื่น', + heading: 'ที่ตั้ง', + lead: + 'NexStudio มีฐานที่กรุงเทพฯ ประเทศไทย ด้านล่างคือวิธีที่เราจัดเขตเวลาและภาษาเมื่อเทียบกับลูกค้าในยุโรปและที่อื่น', + }, + sections: [ + { + title: 'สำนักงาน', + paragraphs: ['ประเทศไทย — กรุงเทพฯ'], + locationLine: true, + }, + { + title: 'เขตเวลาและภาษา', + paragraphs: [ + 'เว็บไซต์และการสนับสนุนผ่านเว็บสามารถจัดการเป็นภาษาอิตาลี อังกฤษ เยอรมัน ฝรั่งเศส สเปน และไทย โดยตกลงเวลาตามทีมและเขตเวลาเทียบกับลูกค้าในยุโรปและภูมิภาคอื่น', + ], + }, + ], + }, +}; + +export const getDoveSiamo = (locale: SupportedLocale) => doveSiamoByLocale[locale]; diff --git a/src/data/gdpr.ts b/src/data/gdpr.ts index aebaa4e..64b51b4 100644 --- a/src/data/gdpr.ts +++ b/src/data/gdpr.ts @@ -2,22 +2,7 @@ * Pagina GDPR: diritti degli interessati e modalità operative. * Documento di supporto alla privacy policy quadro del portale NexStudio. */ -export const gdprDocument = { - version: '1.1', - inVigoreDal: '[DATA]', - ultimoAggiornamento: '[DATA]', -} as const; - -export const gdprCrossReferences = { - lead: - "Per LexAura e MediAura, i dettagli operativi del singolo prodotto sono indicati nelle rispettive informative privacy pubblicate sui portali SaaS dedicati.", -} as const; - -export const gdprRiferimenti: readonly { label: string; href: string }[] = [ - { label: 'Informativa privacy', href: '/privacy' }, - { label: 'Cookie policy', href: '/cookies' }, - { label: "Condizioni d'uso", href: '/terms' }, -] as const; +import type { SupportedLocale } from './home/navigation'; export type GdprSection = { id: string; @@ -28,75 +13,316 @@ export type GdprSection = { paragraphsAfterBullets?: readonly string[]; }; -export const gdprSections: readonly GdprSection[] = [ - { - id: 'quadro', - title: '1. Quadro normativo e ambito', - paragraphs: [ - "Il Regolamento (UE) 2016/679 (GDPR) tutela i diritti degli interessati e disciplina il trattamento dei dati personali. Questa pagina spiega come esercitare tali diritti verso NexStudio nel contesto del portale corporate e dei servizi collegati.", - ], +const gdprByLocale = { + it: { + document: { + version: '1.1', + inVigoreDal: '[DATA]', + ultimoAggiornamento: '[DATA]', + }, + crossReferences: { + lead: + 'Per LexAura e MediAura, i dettagli operativi del singolo prodotto sono indicati nelle rispettive informative privacy pubblicate sui portali SaaS dedicati.', + }, + riferimenti: [ + { label: 'Informativa privacy', href: '/privacy' }, + { label: 'Cookie policy', href: '/cookies' }, + { label: "Condizioni d'uso", href: '/terms' }, + ] as const, + sections: [ + { + id: 'quadro', + title: '1. Quadro normativo e ambito', + paragraphs: [ + 'Il Regolamento (UE) 2016/679 (GDPR) tutela i diritti degli interessati e disciplina il trattamento dei dati personali. Questa pagina spiega come esercitare tali diritti verso NexStudio nel contesto del portale corporate e dei servizi collegati.', + ], + }, + { + id: 'diritti', + title: '2. Diritti riconosciuti agli interessati', + paragraphs: [ + "Nei limiti previsti dalla normativa applicabile, l'interessato può esercitare i seguenti diritti:", + ], + bullets: [ + 'Accesso ai dati personali e ottenimento di copia in formato intelligibile;', + 'Rettifica dei dati inesatti e integrazione dei dati incompleti;', + "Cancellazione dei dati (diritto all'oblio), quando ne ricorrono i presupposti;", + 'Limitazione del trattamento in presenza delle condizioni previste dal GDPR;', + 'Portabilità dei dati trattati con mezzi automatizzati sulla base di consenso o contratto;', + "Opposizione al trattamento fondato su legittimo interesse, inclusa l'opposizione a comunicazioni marketing;", + 'Revoca del consenso in qualsiasi momento, senza pregiudicare la liceità del trattamento precedente;', + "Reclamo all'autorità di controllo competente.", + ], + }, + { + id: 'chi-contattare', + title: '3. Chi contattare per esercitare i diritti', + paragraphs: [], + bullets: [ + 'Email: privacy@nexstudio.com', + 'Form: nexstudio.ai/contatti', + 'Per trattamenti nei tenant SaaS (LexAura/MediAura): rivolgersi prima al cliente titolare (studio legale, struttura sanitaria). NexStudio supporta il cliente titolare secondo DPA e accordi contrattuali.', + ], + paragraphsAfterBullets: [ + 'Autorità di controllo competente: Garante per la protezione dei dati personali (www.garanteprivacy.it) per i trattamenti soggetti al GDPR.', + ], + }, + { + id: 'identificazione', + title: "4. Verifica dell'identità e gestione della richiesta", + paragraphs: [ + "Per tutelare riservatezza e sicurezza, NexStudio può richiedere informazioni minime aggiuntive necessarie a verificare l'identità del richiedente. Le richieste sono gestite con procedure tracciate e prese in carico nei tempi previsti dal GDPR; in caso di richieste complesse o multiple, i termini possono essere prorogati nei limiti consentiti dalla legge, con comunicazione motivata.", + ], + }, + { + id: 'limitazioni', + title: '5. Casi di limitazione o rigetto', + paragraphs: [ + "L'esercizio dei diritti può essere limitato o non accolto quando sussistono obblighi legali prevalenti, esigenze di difesa in giudizio, tutela dei diritti di terzi o altre eccezioni previste dalla normativa. In tali casi NexStudio fornisce un riscontro motivato e indica i rimedi disponibili, incluso il diritto di proporre reclamo all'autorità competente.", + ], + }, + { + id: 'trasferimenti', + title: '6. Trasferimenti internazionali e garanzie', + paragraphs: [ + 'Qualora il trattamento comporti trasferimenti extra SEE/UE, NexStudio adotta le misure richieste dalla normativa (es. clausole contrattuali standard e misure supplementari). I dati risiedono primariamente in UE via infrastruttura Cloudflare.', + ], + }, + { + id: 'documenti-prodotto', + title: '7. Coordinamento con le privacy dei SaaS', + paragraphs: [ + 'Le privacy policy dei portali SaaS LexAura e MediAura dettagliano, per ciascun prodotto, flussi dati, tempi di conservazione, ruoli privacy e canali dedicati. In caso di differenze tra documenti, prevalgono i documenti specifici del servizio e gli accordi contrattuali applicabili.', + 'Per consultare le privacy dei prodotti:', + ], + bullets: [ + 'LexAura: vedere il portale dedicato', + 'MediAura: mediaura.doctor/privacy', + ], + }, + ] as const satisfies readonly GdprSection[], + page: { + title: 'GDPR — NexStudio', + description: + 'Pagina GDPR NexStudio S.r.l.: diritti degli interessati, modalità operative, ruoli tra portale corporate e SaaS LexAura/MediAura, coordinamento con privacy dedicate.', + heading: 'GDPR e diritti degli interessati', + lead: + "Diritti degli interessati e modalità di esercizio ai sensi del Regolamento (UE) 2016/679, in coerenza con l'informativa privacy quadro di NexStudio S.r.l. (Italia, [INDIRIZZO_COMPLETO]). Per LexAura e MediAura, i dettagli operativi del singolo prodotto sono indicati nelle rispettive informative privacy pubblicate sui portali SaaS dedicati.", + versionLabel: 'Versione', + inForceFromLabel: 'In vigore dal', + lastUpdateLabel: 'Ultimo aggiornamento', + relatedDocsLabel: 'Documenti connessi', + indexLabel: 'Indice', + }, }, - { - id: 'diritti', - title: '2. Diritti riconosciuti agli interessati', - paragraphs: [ - "Nei limiti previsti dalla normativa applicabile, l'interessato può esercitare i seguenti diritti:", - ], - bullets: [ - 'Accesso ai dati personali e ottenimento di copia in formato intelligibile;', - 'Rettifica dei dati inesatti e integrazione dei dati incompleti;', - 'Cancellazione dei dati (diritto all\'oblio), quando ne ricorrono i presupposti;', - 'Limitazione del trattamento in presenza delle condizioni previste dal GDPR;', - 'Portabilità dei dati trattati con mezzi automatizzati sulla base di consenso o contratto;', - "Opposizione al trattamento fondato su legittimo interesse, inclusa l'opposizione a comunicazioni marketing;", - 'Revoca del consenso in qualsiasi momento, senza pregiudicare la liceità del trattamento precedente;', - "Reclamo all'autorità di controllo competente.", - ], + en: { + document: { + version: '1.1', + inVigoreDal: '[DATA]', + ultimoAggiornamento: '[DATA]', + }, + crossReferences: { + lead: + 'For LexAura and MediAura, product-specific operational details are set out in the privacy notices published on the dedicated SaaS portals.', + }, + riferimenti: [ + { label: 'Privacy notice', href: '/privacy' }, + { label: 'Cookie policy', href: '/cookies' }, + { label: 'Terms of use', href: '/terms' }, + ] as const, + sections: [ + { + id: 'quadro', + title: '1. Regulatory framework and scope', + paragraphs: [ + 'Regulation (EU) 2016/679 (GDPR) protects data subjects’ rights and governs the processing of personal data. This page explains how to exercise those rights vis-à-vis NexStudio in the context of the corporate portal and related services.', + ], + }, + { + id: 'diritti', + title: '2. Rights granted to data subjects', + paragraphs: [ + 'Within the limits provided by applicable law, the data subject may exercise the following rights:', + ], + bullets: [ + 'Access to personal data and obtaining a copy in an intelligible format;', + 'Rectification of inaccurate data and completion of incomplete data;', + 'Erasure of data (right to be forgotten), where the relevant conditions are met;', + 'Restriction of processing where the conditions set out in the GDPR apply;', + 'Data portability for data processed by automated means on the basis of consent or contract;', + 'Objection to processing based on legitimate interest, including objection to marketing communications;', + 'Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal;', + 'Complaint to the competent supervisory authority.', + ], + }, + { + id: 'chi-contattare', + title: '3. Who to contact to exercise rights', + paragraphs: [], + bullets: [ + 'Email: privacy@nexstudio.com', + 'Form: nexstudio.ai/contatti', + 'For processing in SaaS tenants (LexAura/MediAura): contact the customer controller first (law firm, healthcare organization). NexStudio supports the customer controller under the DPA and contractual agreements.', + ], + paragraphsAfterBullets: [ + 'Competent supervisory authority: Italian Data Protection Authority — Garante per la protezione dei dati personali (www.garanteprivacy.it) — for processing subject to the GDPR.', + ], + }, + { + id: 'identificazione', + title: '4. Identity verification and request handling', + paragraphs: [ + 'To protect confidentiality and security, NexStudio may request the minimum additional information needed to verify the requester’s identity. Requests are handled under tracked procedures and acknowledged within the time limits set by the GDPR; for complex or multiple requests, the deadlines may be extended within the limits permitted by law, with a reasoned notice.', + ], + }, + { + id: 'limitazioni', + title: '5. Cases of limitation or refusal', + paragraphs: [ + 'The exercise of rights may be limited or refused where overriding legal obligations, needs of defense in legal proceedings, protection of third-party rights, or other exceptions provided by law apply. In such cases NexStudio provides a reasoned response and indicates the available remedies, including the right to lodge a complaint with the competent authority.', + ], + }, + { + id: 'trasferimenti', + title: '6. International transfers and safeguards', + paragraphs: [ + 'Where processing involves transfers outside the EEA/EU, NexStudio adopts the measures required by law (e.g. standard contractual clauses and supplementary measures). Data primarily resides in the EU via Cloudflare infrastructure.', + ], + }, + { + id: 'documenti-prodotto', + title: '7. Coordination with SaaS privacy notices', + paragraphs: [ + 'The privacy policies of the LexAura and MediAura SaaS portals detail, for each product, data flows, retention periods, privacy roles, and dedicated channels. In case of differences between documents, the service-specific documents and applicable contractual agreements prevail.', + 'To consult product privacy notices:', + ], + bullets: [ + 'LexAura: see the dedicated portal', + 'MediAura: mediaura.doctor/privacy', + ], + }, + ] as const satisfies readonly GdprSection[], + page: { + title: 'GDPR — NexStudio', + description: + 'NexStudio S.r.l. GDPR page: data subject rights, operational procedures, roles between the corporate portal and LexAura/MediAura SaaS, coordination with dedicated privacy notices.', + heading: 'GDPR and data subject rights', + lead: + 'Data subject rights and how to exercise them under Regulation (EU) 2016/679, consistent with the framework privacy notice of NexStudio S.r.l. (Italy, [INDIRIZZO_COMPLETO]). For LexAura and MediAura, product-specific operational details are set out in the privacy notices published on the dedicated SaaS portals.', + versionLabel: 'Version', + inForceFromLabel: 'In force from', + lastUpdateLabel: 'Last updated', + relatedDocsLabel: 'Related documents', + indexLabel: 'Contents', + }, }, - { - id: 'chi-contattare', - title: '3. Chi contattare per esercitare i diritti', - paragraphs: [], - bullets: [ - 'Email: privacy@nexstudio.com', - 'Form: nexstudio.ai/contatti', - 'Per trattamenti nei tenant SaaS (LexAura/MediAura): rivolgersi prima al cliente titolare (studio legale, struttura sanitaria). NexStudio supporta il cliente titolare secondo DPA e accordi contrattuali.', - ], - paragraphsAfterBullets: [ - "Autorità di controllo competente: Garante per la protezione dei dati personali (www.garanteprivacy.it) per i trattamenti soggetti al GDPR.", - ], + th: { + document: { + version: '1.1', + inVigoreDal: '[DATA]', + ultimoAggiornamento: '[DATA]', + }, + crossReferences: { + lead: + 'สำหรับ LexAura และ MediAura รายละเอียดการดำเนินงานเฉพาะผลิตภัณฑ์ระบุไว้ในประกาศความเป็นส่วนตัวที่เผยแพร่บนพอร์ทัล SaaS ที่เกี่ยวข้อง', + }, + riferimenti: [ + { label: 'ประกาศความเป็นส่วนตัว', href: '/privacy' }, + { label: 'นโยบายคุกกี้', href: '/cookies' }, + { label: 'เงื่อนไขการใช้งาน', href: '/terms' }, + ] as const, + sections: [ + { + id: 'quadro', + title: '1. กรอบกฎหมายและขอบเขต', + paragraphs: [ + 'ระเบียบ (EU) 2016/679 (GDPR) คุ้มครองสิทธิของเจ้าของข้อมูลและกำกับดูแลการประมวลผลข้อมูลส่วนบุคคล หน้านี้ชี้แจงวิธีการใช้สิทธิดังกล่าวกับ NexStudio ในบริบทของพอร์ทัลองค์กรและบริการที่เกี่ยวข้อง', + ], + }, + { + id: 'diritti', + title: '2. สิทธิที่เจ้าของข้อมูลได้รับ', + paragraphs: [ + 'ภายในขอบเขตที่กฎหมายที่ใช้บังคับกำหนด เจ้าของข้อมูลอาจใช้สิทธิต่อไปนี้:', + ], + bullets: [ + 'เข้าถึงข้อมูลส่วนบุคคลและขอสำเนาในรูปแบบที่เข้าใจได้;', + 'แก้ไขข้อมูลที่ไม่ถูกต้องและเติมเต็มข้อมูลที่ไม่ครบถ้วน;', + 'ลบข้อมูล (สิทธิที่จะถูกลืม) เมื่อเข้าเงื่อนไข;', + 'จำกัดการประมวลผลเมื่อเข้าเงื่อนไขตาม GDPR;', + 'โอนย้ายข้อมูลที่ประมวลผลด้วยวิธีอัตโนมัติบนพื้นฐานของความยินยอมหรือสัญญา;', + 'คัดค้านการประมวลผลบนพื้นฐานของประโยชน์โดยชอบด้วยกฎหมาย รวมถึงคัดค้านการสื่อสารการตลาด;', + 'ถอนความยินยอมได้ทุกเมื่อ โดยไม่กระทบความชอบด้วยกฎหมายของการประมวลผลก่อนการถอน;', + 'ร้องเรียนต่อหน่วยงานกำกับดูแลที่มีอำนาจ.', + ], + }, + { + id: 'chi-contattare', + title: '3. ติดต่อใครเพื่อใช้สิทธิ', + paragraphs: [], + bullets: [ + 'อีเมล: privacy@nexstudio.com', + 'แบบฟอร์ม: nexstudio.ai/contatti', + 'สำหรับการประมวลผลในเทแนนท์ SaaS (LexAura/MediAura): ติดต่อลูกค้าซึ่งเป็นผู้ควบคุมข้อมูลก่อน (สำนักงานกฎหมาย องค์กรด้านสุขภาพ) NexStudio สนับสนุนลูกค้าผู้ควบคุมตาม DPA และข้อตกลงตามสัญญา', + ], + paragraphsAfterBullets: [ + 'หน่วยงานกำกับดูแลที่มีอำนาจ: Garante per la protezione dei dati personali (www.garanteprivacy.it) สำหรับการประมวลผลที่อยู่ภายใต้ GDPR', + ], + }, + { + id: 'identificazione', + title: '4. การยืนยันตัวตนและการจัดการคำขอ', + paragraphs: [ + 'เพื่อคุ้มครองความลับและความปลอดภัย NexStudio อาจขอข้อมูลเพิ่มเติมเท่าที่จำเป็นขั้นต่ำเพื่อยืนยันตัวตนของผู้ร้องขอ คำขอจะได้รับการจัดการด้วยกระบวนการที่ติดตามได้และรับเรื่องภายในระยะเวลาตาม GDPR หากคำขอซับซ้อนหรือมีหลายคำขอ อาจขยายระยะเวลาได้ภายในขอบเขตที่กฎหมายอนุญาต พร้อมแจ้งเหตุผล', + ], + }, + { + id: 'limitazioni', + title: '5. กรณีจำกัดหรือปฏิเสธ', + paragraphs: [ + 'การใช้สิทธิอาจถูกจำกัดหรือไม่ได้รับการตอบรับ เมื่อมีข้อผูกพันทางกฎหมายที่เหนือกว่า ความจำเป็นในการป้องกันคดี ความคุ้มครองสิทธิของบุคคลที่สาม หรือข้อยกเว้นอื่นตามกฎหมาย ในกรณีดังกล่าว NexStudio จะให้คำตอบพร้อมเหตุผลและระบุการเยียวยาที่มี รวมถึงสิทธิร้องเรียนต่อหน่วยงานที่มีอำนาจ', + ], + }, + { + id: 'trasferimenti', + title: '6. การโอนข้อมูลระหว่างประเทศและการคุ้มครอง', + paragraphs: [ + 'หากการประมวลผลเกี่ยวข้องกับการโอนนอก EEA/EU NexStudio จะใช้มาตรการที่กฎหมายกำหนด (เช่น ข้อสัญญามาตรฐานและมาตรการเสริม) ข้อมูลส่วนใหญ่อยู่ในสหภาพยุโรปผ่านโครงสร้างพื้นฐาน Cloudflare', + ], + }, + { + id: 'documenti-prodotto', + title: '7. การประสานกับประกาศความเป็นส่วนตัวของ SaaS', + paragraphs: [ + 'นโยบายความเป็นส่วนตัวของพอร์ทัล SaaS LexAura และ MediAura ระบุรายละเอียดสำหรับแต่ละผลิตภัณฑ์เกี่ยวกับกระแสข้อมูล ระยะเวลาเก็บรักษา บทบาทความเป็นส่วนตัว และช่องทางเฉพาะ หากเอกสารต่างกัน ให้ยึดเอกสารเฉพาะบริการและข้อตกลงตามสัญญาที่ใช้บังคับ', + 'เพื่อดูประกาศความเป็นส่วนตัวของผลิตภัณฑ์:', + ], + bullets: [ + 'LexAura: ดูที่พอร์ทัลเฉพาะ', + 'MediAura: mediaura.doctor/privacy', + ], + }, + ] as const satisfies readonly GdprSection[], + page: { + title: 'GDPR — NexStudio', + description: + 'หน้า GDPR ของ NexStudio S.r.l.: สิทธิของเจ้าของข้อมูล วิธีการดำเนินงาน บทบาทระหว่างพอร์ทัลองค์กรและ SaaS LexAura/MediAura และการประสานกับประกาศความเป็นส่วนตัวเฉพาะ', + heading: 'GDPR และสิทธิของเจ้าของข้อมูล', + lead: + 'สิทธิของเจ้าของข้อมูลและวิธีการใช้สิทธิตามระเบียบ (EU) 2016/679 ให้สอดคล้องกับประกาศความเป็นส่วนตัวกรอบของ NexStudio S.r.l. (อิตาลี, [INDIRIZZO_COMPLETO]) สำหรับ LexAura และ MediAura รายละเอียดการดำเนินงานเฉพาะผลิตภัณฑ์ระบุไว้ในประกาศความเป็นส่วนตัวที่เผยแพร่บนพอร์ทัล SaaS ที่เกี่ยวข้อง', + versionLabel: 'เวอร์ชัน', + inForceFromLabel: 'มีผลตั้งแต่', + lastUpdateLabel: 'อัปเดตล่าสุด', + relatedDocsLabel: 'เอกสารที่เกี่ยวข้อง', + indexLabel: 'สารบัญ', + }, }, - { - id: 'identificazione', - title: "4. Verifica dell'identità e gestione della richiesta", - paragraphs: [ - "Per tutelare riservatezza e sicurezza, NexStudio può richiedere informazioni minime aggiuntive necessarie a verificare l'identità del richiedente. Le richieste sono gestite con procedure tracciate e prese in carico nei tempi previsti dal GDPR; in caso di richieste complesse o multiple, i termini possono essere prorogati nei limiti consentiti dalla legge, con comunicazione motivata.", - ], - }, - { - id: 'limitazioni', - title: '5. Casi di limitazione o rigetto', - paragraphs: [ - "L'esercizio dei diritti può essere limitato o non accolto quando sussistono obblighi legali prevalenti, esigenze di difesa in giudizio, tutela dei diritti di terzi o altre eccezioni previste dalla normativa. In tali casi NexStudio fornisce un riscontro motivato e indica i rimedi disponibili, incluso il diritto di proporre reclamo all'autorità competente.", - ], - }, - { - id: 'trasferimenti', - title: '6. Trasferimenti internazionali e garanzie', - paragraphs: [ - "Qualora il trattamento comporti trasferimenti extra SEE/UE, NexStudio adotta le misure richieste dalla normativa (es. clausole contrattuali standard e misure supplementari). I dati risiedono primariamente in UE via infrastruttura Cloudflare.", - ], - }, - { - id: 'documenti-prodotto', - title: '7. Coordinamento con le privacy dei SaaS', - paragraphs: [ - "Le privacy policy dei portali SaaS LexAura e MediAura dettagliano, per ciascun prodotto, flussi dati, tempi di conservazione, ruoli privacy e canali dedicati. In caso di differenze tra documenti, prevalgono i documenti specifici del servizio e gli accordi contrattuali applicabili.", - 'Per consultare le privacy dei prodotti:', - ], - bullets: [ - 'LexAura: vedere il portale dedicato', - 'MediAura: mediaura.doctor/privacy', - ], - }, -] as const; +} as const; + +export const getGdpr = (locale: SupportedLocale) => gdprByLocale[locale]; + +/** Retro-compatibilità: fallback italiano. */ +export const gdprDocument = gdprByLocale.it.document; +export const gdprCrossReferences = gdprByLocale.it.crossReferences; +export const gdprRiferimenti = gdprByLocale.it.riferimenti; +export const gdprSections = gdprByLocale.it.sections; diff --git a/src/data/home/chat.ts b/src/data/home/chat.ts index 1c93fb4..33e0a28 100644 --- a/src/data/home/chat.ts +++ b/src/data/home/chat.ts @@ -7,44 +7,20 @@ * con flusso token via email lasciare `false` e usare `successMessage`. */ -/** Destinazione della chat dopo identificazione / click su «Entra» */ -const entryUrl = '/#contatti'; +import type { SupportedLocale } from './navigation'; + +/** Destinazione della chat dopo identificazione / click su «Entra» (path IT). */ +const entryPath = '/#contatti'; // Esempio WhatsApp: `https://wa.me/TUO_NUMERO?text=` + encodeURIComponent('Ciao NexStudio...'); -export const chat = { - entryUrl, +const chatShared = { /** Nuova scheda solo per link esterni (wa.me, widget, ecc.) */ - openInNewTab: entryUrl.startsWith('http'), - linkTitle: - 'Accesso alla chat NexStudio: stato canale, email di verifica e assistenza in più lingue.', - - /** - * Cosa vede l’utente **prima** di inserire email: chi risponde (umano / bot / entrambi). - * Aggiorna i testi in base agli orari effettivi del team. - */ - availability: { - badge: 'Operatore umano in orario · chatbot sempre attivo', - body: - 'In orario lavorativo un operatore NexStudio può intervenire in chat; all’ingresso il chatbot può raccogliere il contesto iniziale e smistare la richiesta. Fuori orario la conversazione può proseguire con il solo chatbot fino al rientro del team. Lo stato effettivo è indicato qui sopra prima di procedere.', - }, - + openInNewTab: entryPath.startsWith('http'), prechat: { - title: 'Prima della chat', - intro: - 'Per evitare attese inutili chiediamo l’indirizzo email a cui inviarti un link o un codice monouso per aprire la sessione in modo sicuro. Dopo la verifica potrai usare la chat dal canale che ti indicheremo.', - nameLabel: 'Nome (facoltativo)', - emailLabel: 'Email', - submitLabel: 'Richiedi accesso alla chat', - /** Visibile dopo l’invio riuscito: utile se il link nella mail punta allo stesso `entryUrl` */ - enterChatLabel: 'Ho ricevuto il messaggio — apri la chat', - closeLabel: 'Chiudi', - successMessage: - 'Controlla la posta in arrivo: ti abbiamo inviato le istruzioni (link o codice) per entrare in chat. Se non vedi nulla, controlla anche lo spam.', /** Formspree dedicato alla richiesta accesso chat — vuoto = prova `mailto` */ actionUrl: '', /** Se `actionUrl` è vuoto */ mailto: '', - notifySubject: 'Richiesta accesso chat — sito NexStudio', successRedirect: '', fieldName: 'name', fieldEmail: 'email', @@ -55,3 +31,96 @@ export const chat = { openChatAfterSubmit: false, }, } as const; + +const entryUrlFor = (locale: SupportedLocale) => { + if (entryPath.startsWith('http') || locale === 'it') return entryPath; + if (entryPath.startsWith('/#')) return `/${locale}${entryPath}`; + if (entryPath.startsWith('/')) return `/${locale}${entryPath}`; + return entryPath; +}; + +const chatCopyByLocale = { + it: { + linkTitle: + 'Accesso alla chat NexStudio: stato canale, email di verifica e assistenza in più lingue.', + availability: { + badge: 'Operatore umano in orario · chatbot sempre attivo', + body: + 'In orario lavorativo un operatore NexStudio può intervenire in chat; all’ingresso il chatbot può raccogliere il contesto iniziale e smistare la richiesta. Fuori orario la conversazione può proseguire con il solo chatbot fino al rientro del team. Lo stato effettivo è indicato qui sopra prima di procedere.', + }, + prechat: { + title: 'Prima della chat', + intro: + 'Per evitare attese inutili chiediamo l’indirizzo email a cui inviarti un link o un codice monouso per aprire la sessione in modo sicuro. Dopo la verifica potrai usare la chat dal canale che ti indicheremo.', + nameLabel: 'Nome (facoltativo)', + emailLabel: 'Email', + submitLabel: 'Richiedi accesso alla chat', + enterChatLabel: 'Ho ricevuto il messaggio — apri la chat', + closeLabel: 'Chiudi', + successMessage: + 'Controlla la posta in arrivo: ti abbiamo inviato le istruzioni (link o codice) per entrare in chat. Se non vedi nulla, controlla anche lo spam.', + notifySubject: 'Richiesta accesso chat — sito NexStudio', + }, + }, + en: { + linkTitle: + 'NexStudio chat access: channel status, verification email, and multilingual support.', + availability: { + badge: 'Human operator during hours · chatbot always on', + body: + 'During business hours a NexStudio operator can join the chat; at entry the chatbot can gather initial context and route the request. Outside hours the conversation may continue with the chatbot alone until the team is back. The live status is shown above before you proceed.', + }, + prechat: { + title: 'Before chat', + intro: + 'To avoid unnecessary waiting we ask for the email address where we can send a one-time link or code to open the session securely. After verification you can use chat on the channel we indicate.', + nameLabel: 'Name (optional)', + emailLabel: 'Email', + submitLabel: 'Request chat access', + enterChatLabel: 'I received the message — open chat', + closeLabel: 'Close', + successMessage: + 'Check your inbox: we sent instructions (link or code) to enter the chat. If you see nothing, also check spam.', + notifySubject: 'Chat access request — NexStudio website', + }, + }, + th: { + linkTitle: + 'เข้าใช้งานแชท NexStudio: สถานะช่องทาง อีเมลยืนยัน และการช่วยเหลือหลายภาษา', + availability: { + badge: 'มีเจ้าหน้าที่ในเวลาทำการ · แชทบอตพร้อมตลอดเวลา', + body: + 'ในเวลาทำการ เจ้าหน้าที่ NexStudio สามารถเข้าร่วมแชทได้ และตอนเริ่มต้นแชทบอตอาจเก็บบริบทเบื้องต้นแล้วส่งต่อคำขอ นอกเวลาทำการ การสนทนาอาจดำเนินต่อด้วยแชทบอตจนกว่าทีมจะกลับมา สถานะจริงจะแสดงด้านบนก่อนดำเนินการต่อ', + }, + prechat: { + title: 'ก่อนเริ่มแชท', + intro: + 'เพื่อลดการรอที่ไม่จำเป็น เราขอที่อยู่อีเมลสำหรับส่งลิงก์หรือรหัสแบบใช้ครั้งเดียวเพื่อเปิดเซสชันอย่างปลอดภัย หลังยืนยันแล้ว คุณจะใช้แชทผ่านช่องทางที่เราระบุได้', + nameLabel: 'ชื่อ (ไม่บังคับ)', + emailLabel: 'อีเมล', + submitLabel: 'ขอเข้าใช้งานแชท', + enterChatLabel: 'ได้รับข้อความแล้ว — เปิดแชท', + closeLabel: 'ปิด', + successMessage: + 'โปรดตรวจสอบกล่องจดหมาย: เราได้ส่งคำแนะนำ (ลิงก์หรือรหัส) สำหรับเข้าแชทแล้ว หากไม่พบ ให้ตรวจสแปมด้วย', + notifySubject: 'คำขอเข้าใช้งานแชท — เว็บไซต์ NexStudio', + }, + }, +} as const; + +export const getChat = (locale: SupportedLocale) => { + const copy = chatCopyByLocale[locale]; + return { + ...chatShared, + entryUrl: entryUrlFor(locale), + linkTitle: copy.linkTitle, + availability: copy.availability, + prechat: { + ...chatShared.prechat, + ...copy.prechat, + }, + }; +}; + +/** Retro-compatibilità: fallback italiano. */ +export const chat = getChat('it'); diff --git a/src/data/home/index.ts b/src/data/home/index.ts index 778375f..40566cf 100644 --- a/src/data/home/index.ts +++ b/src/data/home/index.ts @@ -5,16 +5,19 @@ export { siteMeta } from './site-meta'; export { getSiteMeta } from './site-meta'; export { chat } from './chat'; +export { getChat } from './chat'; export { navigation } from './navigation'; export { getNavigation } from './navigation'; export { hero } from './hero'; export { getHero } from './hero'; export { stats } from './stats'; +export { getStats } from './stats'; export { services } from './services'; export { getServices } from './services'; export { stackSection } from './stack'; export { getStackSection } from './stack'; export { productsSection } from './products'; +export { getProductsSection } from './products'; export { faq } from './faq'; export { getFaq } from './faq'; export { cta } from './cta'; diff --git a/src/data/home/products.ts b/src/data/home/products.ts index 03ee218..47e4e75 100644 --- a/src/data/home/products.ts +++ b/src/data/home/products.ts @@ -1,55 +1,173 @@ +import type { SupportedLocale } from './navigation'; + /** Sezione prodotti — LexAura (Legal Tech), MediAura (Health Tech) */ -export const productsSection = { - eyebrow: 'Prodotti', - title: 'LexAura e MediAura', - lead: - 'Due piattaforme SaaS verticali per professionisti del diritto e della sanità: AI integrata dove precisione e conformità sono fondamentali.', - items: [ - { - id: 'lexaura', - name: 'LexAura', - badge: 'Legal Tech', - tagline: 'Il supporto analitico per l’eccellenza legale.', - focus: 'Gestione dati, memorie e contrattualistica.', - body: - 'LexAura è la piattaforma SaaS di NexStudio dedicata ai professionisti del diritto. Sviluppata per ottimizzare la gestione di carichi informativi elevati, LexAura utilizza l’Intelligenza Artificiale per l’incrocio dinamico di leggi, sentenze e normative, garantendo una base analitica solida e tempestiva.', - highlights: [ - { - title: 'Sintesi normativa', - text: 'Analisi accelerata dei precedenti, delle fonti e dei contesti.', - }, - { - title: 'Drafting assistito', - text: 'Supporto alla stesura di memorie difensive e contratti complessi.', - }, - { - title: 'Workflow integration', - text: 'Automazione dei processi documentali per lo studio legale moderno.', - }, - ] as const, - }, - { - id: 'mediaura', - name: 'MediAura', - badge: 'Health Tech', - tagline: 'L’automazione intelligente al servizio della medicina.', - focus: 'Flussi di lavoro, comandi vocali, scalabilità.', - body: - 'MediAura è il sistema SaaS progettato da NexStudio per abbattere il carico burocratico in ambito sanitario. Dallo studio professionale alla struttura ospedaliera, il software coordina i flussi operativi attraverso un alto grado di automazione e interazione naturale.', - highlights: [ - { - title: 'Voice-first interface', - text: 'Gestione dei flussi e della refertazione tramite comandi vocali avanzati.', - }, - { - title: 'Scalabilità operativa', - text: 'Un’architettura che si adatta alle dimensioni della struttura, dal singolo medico alla gestione di reparti complessi.', - }, - { - title: 'Ottimizzazione del flusso', - text: 'Automazione delle attività di routine per restituire centralità al rapporto medico-paziente.', - }, - ] as const, - }, - ] as const, +const productsByLocale = { + it: { + eyebrow: 'Prodotti', + title: 'LexAura e MediAura', + lead: + 'Due piattaforme SaaS verticali per professionisti del diritto e della sanità: AI integrata dove precisione e conformità sono fondamentali.', + items: [ + { + id: 'lexaura', + name: 'LexAura', + badge: 'Legal Tech', + tagline: 'Il supporto analitico per l’eccellenza legale.', + focus: 'Gestione dati, memorie e contrattualistica.', + body: + 'LexAura è la piattaforma SaaS di NexStudio dedicata ai professionisti del diritto. Sviluppata per ottimizzare la gestione di carichi informativi elevati, LexAura utilizza l’Intelligenza Artificiale per l’incrocio dinamico di leggi, sentenze e normative, garantendo una base analitica solida e tempestiva.', + highlights: [ + { + title: 'Sintesi normativa', + text: 'Analisi accelerata dei precedenti, delle fonti e dei contesti.', + }, + { + title: 'Drafting assistito', + text: 'Supporto alla stesura di memorie difensive e contratti complessi.', + }, + { + title: 'Workflow integration', + text: 'Automazione dei processi documentali per lo studio legale moderno.', + }, + ] as const, + }, + { + id: 'mediaura', + name: 'MediAura', + badge: 'Health Tech', + tagline: 'L’automazione intelligente al servizio della medicina.', + focus: 'Flussi di lavoro, comandi vocali, scalabilità.', + body: + 'MediAura è il sistema SaaS progettato da NexStudio per abbattere il carico burocratico in ambito sanitario. Dallo studio professionale alla struttura ospedaliera, il software coordina i flussi operativi attraverso un alto grado di automazione e interazione naturale.', + highlights: [ + { + title: 'Voice-first interface', + text: 'Gestione dei flussi e della refertazione tramite comandi vocali avanzati.', + }, + { + title: 'Scalabilità operativa', + text: 'Un’architettura che si adatta alle dimensioni della struttura, dal singolo medico alla gestione di reparti complessi.', + }, + { + title: 'Ottimizzazione del flusso', + text: 'Automazione delle attività di routine per restituire centralità al rapporto medico-paziente.', + }, + ] as const, + }, + ] as const, + }, + en: { + eyebrow: 'Products', + title: 'LexAura and MediAura', + lead: + 'Two vertical SaaS platforms for legal and healthcare professionals: AI integrated where precision and compliance are essential.', + items: [ + { + id: 'lexaura', + name: 'LexAura', + badge: 'Legal Tech', + tagline: 'Analytical support for legal excellence.', + focus: 'Data management, briefs, and contracts.', + body: + 'LexAura is NexStudio’s SaaS platform for legal professionals. Built to optimize high information workloads, LexAura uses Artificial Intelligence for dynamic cross-referencing of laws, judgments, and regulations, delivering a solid and timely analytical foundation.', + highlights: [ + { + title: 'Regulatory synthesis', + text: 'Accelerated analysis of precedents, sources, and contexts.', + }, + { + title: 'Assisted drafting', + text: 'Support for drafting defense briefs and complex contracts.', + }, + { + title: 'Workflow integration', + text: 'Document process automation for the modern law firm.', + }, + ] as const, + }, + { + id: 'mediaura', + name: 'MediAura', + badge: 'Health Tech', + tagline: 'Intelligent automation in service of medicine.', + focus: 'Workflows, voice commands, scalability.', + body: + 'MediAura is the SaaS system designed by NexStudio to reduce bureaucratic load in healthcare. From private practice to hospital settings, the software coordinates operational flows through high automation and natural interaction.', + highlights: [ + { + title: 'Voice-first interface', + text: 'Manage workflows and reporting through advanced voice commands.', + }, + { + title: 'Operational scalability', + text: 'An architecture that adapts from a single physician to complex multi-department organizations.', + }, + { + title: 'Flow optimization', + text: 'Automation of routine tasks to put the doctor–patient relationship back at the center.', + }, + ] as const, + }, + ] as const, + }, + th: { + eyebrow: 'ผลิตภัณฑ์', + title: 'LexAura และ MediAura', + lead: + 'แพลตฟอร์ม SaaS เฉพาะทางสองระบบสำหรับมืออาชีพด้านกฎหมายและสุขภาพ: ผสาน AI ในจุดที่ต้องการความแม่นยำและการปฏิบัติตามข้อกำกับ', + items: [ + { + id: 'lexaura', + name: 'LexAura', + badge: 'Legal Tech', + tagline: 'เครื่องมือวิเคราะห์เพื่อความเป็นเลิศทางกฎหมาย', + focus: 'การจัดการข้อมูล คำแถลง และสัญญา', + body: + 'LexAura คือแพลตฟอร์ม SaaS ของ NexStudio สำหรับมืออาชีพด้านกฎหมาย พัฒนาเพื่อจัดการปริมาณข้อมูลจำนวนมาก โดยใช้ปัญญาประดิษฐ์ในการเชื่อมโยงกฎหมาย คำพิพากษา และข้อกำกับอย่างไดนามิก เพื่อฐานวิเคราะห์ที่แข็งแรงและทันเวลา', + highlights: [ + { + title: 'การสรุปเชิงกฎหมาย', + text: 'วิเคราะห์บรรทัดฐาน แหล่งข้อมูล และบริบทได้รวดเร็วขึ้น', + }, + { + title: 'การร่างเอกสารแบบมีผู้ช่วย', + text: 'สนับสนุนการร่างคำแถลงและสัญญาที่ซับซ้อน', + }, + { + title: 'การผสานเวิร์กโฟลว์', + text: 'ระบบงานเอกสารอัตโนมัติสำหรับสำนักงานกฎหมายสมัยใหม่', + }, + ] as const, + }, + { + id: 'mediaura', + name: 'MediAura', + badge: 'Health Tech', + tagline: 'ระบบอัตโนมัติอัจฉริยะเพื่อการแพทย์', + focus: 'เวิร์กโฟลว์ คำสั่งเสียง ความสามารถในการขยาย', + body: + 'MediAura คือระบบ SaaS ที่ NexStudio ออกแบบเพื่อลดภาระงานธุรการในภาคสุขภาพ ตั้งแต่คลินิกส่วนตัวถึงโรงพยาบาล ซอฟต์แวร์ช่วยประสานงานปฏิบัติการด้วยระบบอัตโนมัติสูงและการโต้ตอบที่เป็นธรรมชาติ', + highlights: [ + { + title: 'อินเทอร์เฟซแบบ Voice-first', + text: 'จัดการเวิร์กโฟลว์และรายงานผลผ่านคำสั่งเสียงขั้นสูง', + }, + { + title: 'ขยายได้ตามการดำเนินงาน', + text: 'สถาปัตยกรรมที่ปรับได้ตั้งแต่วิทยาแพทย์คนเดียวถึงแผนกที่ซับซ้อน', + }, + { + title: 'เพิ่มประสิทธิภาพเวิร์กโฟลว์', + text: 'ทำให้งานประจำอัตโนมัติ เพื่อคืนความสำคัญให้ความสัมพันธ์แพทย์–ผู้ป่วย', + }, + ] as const, + }, + ] as const, + }, } as const; + +export const getProductsSection = (locale: SupportedLocale) => + productsByLocale[locale]; + +/** Retro-compatibilità: fallback italiano. */ +export const productsSection = productsByLocale.it; diff --git a/src/data/home/stats.ts b/src/data/home/stats.ts index 6634572..e5da2e4 100644 --- a/src/data/home/stats.ts +++ b/src/data/home/stats.ts @@ -1,20 +1,67 @@ +import type { SupportedLocale } from './navigation'; + /** Fascia metriche — merge performance Edge + AI + compliance settoriale (Legal/Health) */ -export const stats = { - items: [ - { - value: '< 30ms', - caption: - 'Latenza globale: elaborazione istantanea dei dati sull’architettura Cloudflare Edge, per risposte in tempo reale dove servono clinica e forense.', - }, - { - value: '99.9%', - caption: - 'Affidabilità dell’analisi predittiva e diagnostica con modelli LLM di ultima generazione; automazione intelligente dei workflow complessi e integrazione con un ecosistema curato di SaaS verticali certificati per professionisti.', - }, - { - value: '100%', - caption: - 'GDPR e HIPAA compliant: gestione di documenti medici e legali a norma; protezione Zero-Trust e crittografia end-to-end su dati sensibili.', - }, - ] as const, +const statsByLocale = { + it: { + items: [ + { + value: '< 30ms', + caption: + 'Latenza globale: elaborazione istantanea dei dati sull’architettura Cloudflare Edge, per risposte in tempo reale dove servono clinica e forense.', + }, + { + value: '99.9%', + caption: + 'Affidabilità dell’analisi predittiva e diagnostica con modelli LLM di ultima generazione; automazione intelligente dei workflow complessi e integrazione con un ecosistema curato di SaaS verticali certificati per professionisti.', + }, + { + value: '100%', + caption: + 'GDPR e HIPAA compliant: gestione di documenti medici e legali a norma; protezione Zero-Trust e crittografia end-to-end su dati sensibili.', + }, + ] as const, + }, + en: { + items: [ + { + value: '< 30ms', + caption: + 'Global latency: instant data processing on Cloudflare Edge architecture, delivering real-time responses for clinical and forensic use cases.', + }, + { + value: '99.9%', + caption: + 'Predictive and diagnostic analysis reliability with state-of-the-art LLM models; intelligent automation of complex workflows and integration with a curated ecosystem of certified vertical SaaS for professionals.', + }, + { + value: '100%', + caption: + 'GDPR and HIPAA compliant: handling of medical and legal documents in compliance; Zero-Trust protection and end-to-end encryption for sensitive data.', + }, + ] as const, + }, + th: { + items: [ + { + value: '< 30ms', + caption: + 'ความหน่วงระดับโลก: การประมวลผลข้อมูลทันใจบนสถาปัตยกรรม Cloudflare Edge เพื่อการตอบสนองเรียลไทม์ในงานคลินิกและนิติเวช', + }, + { + value: '99.9%', + caption: + 'ความน่าเชื่อถือในการวิเคราะห์เชิงพยากรณ์และวินิจฉัยด้วยโมเดล LLM ล่าสุด; ระบบอัตโนมัติอัจฉริยะสำหรับเวิร์กโฟลว์ซับซ้อนพร้อมระบบนิเวศ SaaS เฉพาะทางที่ผ่านการรับรองสำหรับมืออาชีพ', + }, + { + value: '100%', + caption: + 'สอดคล้องกับ GDPR และ HIPAA: การจัดการเอกสารทางการแพทย์และกฎหมายตามข้อกำหนด; การป้องกันแบบ Zero-Trust และการเข้ารหัส end-to-end สำหรับข้อมูลอ่อนไหว', + }, + ] as const, + }, } as const; + +export const getStats = (locale: SupportedLocale) => statsByLocale[locale]; + +/** Retro-compatibilità: fallback italiano. */ +export const stats = statsByLocale.it; diff --git a/src/data/modello-organizzativo.ts b/src/data/modello-organizzativo.ts index b2cd73f..c6ff31c 100644 --- a/src/data/modello-organizzativo.ts +++ b/src/data/modello-organizzativo.ts @@ -2,179 +2,872 @@ * Modello organizzativo — contenuti in dati, così si aggiornano ruoli e processi * senza toccare il layout della pagina. */ -export const modelloOrganizzativo = { - introBox: - 'NexStudio opera da Bangkok. I numeri tra parentesi nelle voci sotto sono orientativi (early stage): formalizzate nomine e deleghe e aggiornate a ogni crescita di team.', - perimetro: - "Documento su ruoli, ritmi di governo e controlli «lean» per la Società, con LexAura (Legal Tech) e MediAura (Health Tech) come linee prodotto. Non sostituisce modelli 231, statuti o pareri legali: allineatelo a entità giuridica, consiglio e consulenti.", +import type { SupportedLocale } from './home/navigation'; + +export type ModelloRuolo = { label: string; text: string }; +export type ModelloGovernance = { nome: string; partecipanti: string; nota: string }; +export type ModelloKpi = { area: string; testo: string }; +export type ModelloPiano30 = { quando: string; testo: string }; +export type ModelloOutsourcing = { titolo: string; testo: string }; +export type ModelloFlusso = { titolo: string; testo: string }; +export type ModelloRaciRow = { + role: string; + r?: boolean; + a?: boolean; + c?: boolean; + i?: boolean; +}; +export type ModelloRaciMatrix = { + id: string; + title: string; + note?: string; + noteLinkHref?: string; + noteLinkLabel?: string; + rows: readonly ModelloRaciRow[]; +}; + +const modelloOrganizzativoByLocale = { + it: { + page: { + title: 'Modello organizzativo — NexStudio', + description: + 'Modello organizzativo NexStudio: governance, ruoli, RACI, controlli lean, KPI, piano 30 giorni — per le linee LexAura (Legal Tech) e MediAura (Health Tech).', + heading: 'Modello organizzativo', + lead: + 'Ruoli, ritmi di governo, processi e controlli «lean» in una software house con SaaS a elevata regolamentazione. Complementare al codice etico. Non sostituisce statuti, modelli di compliance societari (es. 231) né pareri legali: andate in parallelo con struttura reale e consulenti.', + indexTitle: 'Indice', + roleCol: 'Ruolo', + raciLegendBefore: 'Legenda:', + raciLegend: + 'R = Responsible, A = Accountable, C = Consulted, I = Informed.', + ruoliIntroBefore: + 'Elenco sintetico delle funzioni e delle attese di impegno. Per allineare il dominio prodotto (Legal Tech, Health Tech) a ruoli e consiglieri, fate riferimento anche a', + codiceEticoLabel: 'codice etico', + codiceEticoHref: '/codice-etico', + ruoliIntroAfter: + 'e, per i trattamenti di dati, a privacy policy e DPA.', + sectionTitles: { + ruoli: '1. Ruoli e perimetro', + governance: '2. Governance essenziale', + responsabilita: '3. Principali responsabilità (sintesi)', + raci: '4. RACI sintetico per processi critici', + flussi: '5. Flussi decisionali rapidi', + controlli: '6. Controlli minimi obbligatori (lean)', + kpi: '7. KPI essenziali', + documentazione: '8. Documentazione minima da mantenere', + piano30: '9. Primo piano operativo (30 giorni)', + outsourcing: '10. Outsourcing consigliato (per restare snelli)', + note: '11. Note pratiche e raccomandazioni', + }, + index: [ + { href: '#ruoli', label: 'Ruoli e perimetro' }, + { href: '#governance', label: 'Governance essenziale' }, + { href: '#responsabilita', label: 'Principali responsabilità (sintesi)' }, + { href: '#raci', label: 'RACI per processi critici' }, + { href: '#flussi', label: 'Flussi decisionali rapidi' }, + { href: '#controlli', label: 'Controlli minimi obbligatori (lean)' }, + { href: '#kpi', label: 'KPI essenziali' }, + { href: '#documentazione', label: 'Documentazione minima da mantenere' }, + { href: '#piano-30', label: 'Primo piano operativo (30 giorni)' }, + { href: '#outsourcing', label: 'Outsourcing consigliato' }, + { href: '#note', label: 'Note pratiche e raccomandazioni' }, + ], + }, + introBox: + 'NexStudio opera da Bangkok. I numeri tra parentesi nelle voci sotto sono orientativi (early stage): formalizzate nomine e deleghe e aggiornate a ogni crescita di team.', + perimetro: + 'Documento su ruoli, ritmi di governo e controlli «lean» per la Società, con LexAura (Legal Tech) e MediAura (Health Tech) come linee prodotto. Non sostituisce modelli 231, statuti o pareri legali: allineatelo a entità giuridica, consiglio e consulenti.', + ruoli: [ + { + label: 'Founder / CEO (1)', + text: 'strategia, approvazione delle policy, contatti con board e investitori, accountability complessiva verso legge e contratti.', + }, + { + label: 'CTO / Head of Product (1)', + text: 'architettura, roadmap, quality gate di prodotto, responsabilità tecnica end-to-end.', + }, + { + label: 'Lead Engineer (1–2)', + text: 'sviluppo, code review, CI/CD, qualità del codice in reparto.', + }, + { + label: 'DevOps / Platform (1, oppure outsourcing)', + text: 'deploy, KMS, backup e disaster recovery, governo ambiente di produzione.', + }, + { + label: 'Security & Privacy Lead (1, ibrido o contractor)', + text: 'sicurezza operativa, vulnerabilità, allineamento con DPO e rilasci sensibili.', + }, + { + label: 'DPO / Privacy responsible (frazionale o outsourcing)', + text: 'DPIA, diritti degli interessati, coerenza informativa e register dei trattamenti.', + }, + { + label: 'Legal & compliance (frazionale o esterno)', + text: 'contratti, NDA, normative di settore pertinenza Legal Tech e Health Tech.', + }, + { + label: 'Product / domain advisor (part-time o consulente)', + text: 'convalida funzionalità ad impatto su decisioni mediche o legali, avvertenze d’uso.', + }, + { + label: 'Customer success / support (1)', + text: 'onboarding, richieste, escalation verso tecnica e governance.', + }, + { + label: 'Operations / HR (1, part-time)', + text: 'onboarding personale, formazione, canali segnalazioni e whistleblowing interno.', + }, + { + label: 'Finance (1, part-time o outsourcing)', + text: 'contabilità, incassi, policy fornitori.', + }, + ] as const satisfies readonly ModelloRuolo[], + governance: [ + { + nome: 'Weekly tactical', + partecipanti: 'Founder, CTO, Security/privacy, customer success', + nota: 'priorità, incidenti aperti, rilasci critici.', + }, + { + nome: 'Product sync (bisettimanale)', + partecipanti: 'CTO, lead engineer, domain advisor', + nota: 'backlog, release, checkpoint compliance di prodotto (per linea ove serva).', + }, + { + nome: 'Compliance check (mensile)', + partecipanti: 'CEO, legal, DPO, security', + nota: 'DPIA, vendor ad alto rischio, sintesi incidenti e correzioni.', + }, + { + nome: 'Review trimestrale', + partecipanti: 'board o founders', + nota: 'strategia, budget, rischi e capacity.', + }, + ] as const satisfies readonly ModelloGovernance[], + responsabilitaSintesi: [ + 'Codice etico e policy: owner legal & compliance; approvazione CEO.', + 'Sicurezza operativa e incident response: owner security lead; esecuzione tecnica CTO.', + 'Privacy, trattamenti sensibili, DPIA: owner DPO; supporto legal.', + 'Rilasci in produzione: accountable CTO; responsible lead engineer; consulted security, DPO, domain advisor.', + 'Fornitori e sub-processori: owner operations e legal; due diligence security e DPO.', + 'Richieste interessati (DSR): owner DPO; operatività customer success ove applicabile.', + 'Segnalazioni e whistleblowing: owner operations/HR; supporto investigativo legal.', + ] as const, + controlliLean: [ + 'IAM con MFA per accesso a produzione e a segreti.', + 'CI/CD con SAST e scansione dipendenze in pipeline.', + 'SBOM per ogni release.', + 'TLS in transito; cifratura a riposo per dati sensibili.', + 'Backup giornalieri; test DR trimestrale con ripristino documentato.', + 'Log e alerting su anomalie (SIEM o servizio gestito).', + "Checklist pre-release security/privacy con traccia d'approvazione.", + ] as const, + kpi: [ + { area: 'Security', testo: 'patch critiche entro SLA; MTTD e MTTR su incidenti.' }, + { + area: 'Privacy', + testo: + 'tempo risposta DSR; DPIA aperte vs completate per perimetro (Legale, Sanitario, piattaforma).', + }, + { + area: 'Product', + testo: 'lead time deploy; copertura test sui moduli critici (per linea prodotto).', + }, + { + area: 'Operations', + testo: 'uptime su SLA; tempo risposta support; segnalazioni chiuse nel periodo.', + }, + ] as const satisfies readonly ModelloKpi[], + documentazione: [ + 'Codice etico, adesioni in registro.', + 'Informativa privacy, DPA, condizioni d’uso.', + 'DPIA per trattamenti critici (riferire per perimetro, come nel codice etico).', + 'Trust/security brief per clienti e audit (1–2 pagine).', + 'Playbook incident response (versione eseguibile).', + 'SBOM e registro fornitori e sub-processori.', + 'Checklist pre-release e log approvazioni.', + ] as const, + piano30: [ + { + quando: 'Giorni 0–3', + testo: 'nomine scritte su security, DPO e legal frazionali, con deleghe.', + }, + { + quando: 'Giorni 4–10', + testo: 'checklist pre-release in pipeline; MFA e policy IAM al minimo sopra.', + }, + { + quando: 'Giorni 11–17', + testo: + 'avviare o aggiornare una DPIA sul trattamento più critico (es. perimetro MediAura o LexAura); due diligence fornitori ad alto rischio.', + }, + { + quando: 'Giorni 18–24', + testo: + 'Trust center di base: link a codice etico, canali DPO/security, materiali privacy/DPA se disponibili.', + }, + { + quando: 'Giorni 25–30', + testo: + 'esercitazione su incident; test rollback e backup; formazione security/privacy obbligatoria iniziale.', + }, + ] as const satisfies readonly ModelloPiano30[], + outsourcing: [ + { + titolo: 'Security ops / SOC', + testo: 'log, alerting, penetration test periodici.', + }, + { + titolo: 'DPO e legal', + testo: + 'consulenti con PDPA, GDPR e contesto medico-legale dei mercati in cui servite i clienti.', + }, + { + titolo: 'DevOps / platform', + testo: 'servizi cloud gestiti (KMS, database gestiti) per ridurre toil interno.', + }, + ] as const satisfies readonly ModelloOutsourcing[], + note: [ + 'Separazione dei compiti: chi approva in produzione non è l’unico a concedere accessi amministrativi.', + 'Automatizzare controlli ripetitivi (SAST, SBOM, scan dipendenze).', + 'Documentare su ticketing accettazione rischio e decisioni per audit e post-mortem.', + 'Per LexAura e MediAura: convalida esterna su funzionalità ad alto rischio di dominio.', + 'Revisione trimestrale del modello; aggiornare le voci in questo documento e le deleghe scritte.', + ] as const, + flussiDecisionali: [ + { + titolo: 'Decisione tecnica ordinaria', + testo: + 'lead engineer → CTO (ticket con nota se impatta rischi privacy/sicurezza o contrattuali).', + }, + { + titolo: 'Rilascio con impatto privacy o sicurezza', + testo: + 'via libera di security lead e DPO, target 48 ore lavorative salvo deroga motivata scritta.', + }, + { + titolo: 'Incident P0 (es. data breach probabile o confermato)', + testo: + 'security notifica entro 4h CEO, DPO e legal; board se impatto su clienti, regolatori o classi di dati sensibili elevato.', + }, + ] as const satisfies readonly ModelloFlusso[], + raci: [ + { + id: 'raci-release', + title: 'Rilascio in produzione', + rows: [ + { role: 'Lead engineer', r: true }, + { role: 'CTO', a: true }, + { role: 'Security lead, DPO, product advisor', c: true }, + { role: 'CEO, customer success', i: true }, + ], + }, + { + id: 'raci-incident', + title: 'Incident response (violazione dei dati o incidente P0)', + rows: [ + { role: 'Security lead', r: true }, + { role: 'CEO', a: true }, + { role: 'DPO, legal, CTO', c: true }, + { role: 'Clienti interessati, board (se impatto elevato)', i: true }, + ], + }, + { + id: 'raci-vendor', + title: 'Onboarding vendor (sub-processore)', + rows: [ + { role: 'Operations', r: true }, + { role: 'Legal', a: true }, + { role: 'Security lead, DPO', c: true }, + { role: 'CTO, finance', i: true }, + ], + }, + { + id: 'raci-dpia', + title: 'DPIA (per perimetro: LexAura, MediAura, piattaforma)', + note: 'La matrice RACI non sostituisce il criterio legale (chi è titolare, chi responsabile) definito in contratti e in', + noteLinkHref: '/codice-etico#tutela-dati-ruoli', + noteLinkLabel: '§5.1 del codice etico', + noteAfter: '. Qui: chi coordina l’esercizio interno della valutazione d’impatto.', + rows: [ + { role: 'DPO', r: true }, + { role: 'Legal', a: true }, + { role: 'Product advisor, CTO, security lead', c: true }, + { role: 'CEO', i: true }, + ], + }, + ] as const satisfies readonly (ModelloRaciMatrix & { noteAfter?: string })[], + }, + en: { + page: { + title: 'Organizational model — NexStudio', + description: + 'NexStudio organizational model: governance, roles, RACI, lean controls, KPIs, 30-day plan — for LexAura (Legal Tech) and MediAura (Health Tech) product lines.', + heading: 'Organizational model', + lead: + 'Roles, governance cadences, processes and lean controls in a software house delivering highly regulated SaaS. Complementary to the code of ethics. It does not replace bylaws, corporate compliance models (e.g. Italian Legislative Decree 231) or legal opinions: run it in parallel with your real structure and advisors.', + indexTitle: 'Index', + roleCol: 'Role', + raciLegendBefore: 'Legend:', + raciLegend: + 'R = Responsible, A = Accountable, C = Consulted, I = Informed.', + ruoliIntroBefore: + 'A concise list of functions and expected commitment. To align the product domain (Legal Tech, Health Tech) with roles and advisors, also refer to the', + codiceEticoLabel: 'code of ethics', + codiceEticoHref: '/codice-etico', + ruoliIntroAfter: + 'and, for data processing, to the privacy policy and DPA.', + sectionTitles: { + ruoli: '1. Roles and scope', + governance: '2. Essential governance', + responsabilita: '3. Key responsibilities (summary)', + raci: '4. Condensed RACI for critical processes', + flussi: '5. Fast decision flows', + controlli: '6. Mandatory minimum controls (lean)', + kpi: '7. Essential KPIs', + documentazione: '8. Minimum documentation to maintain', + piano30: '9. First operating plan (30 days)', + outsourcing: '10. Recommended outsourcing (to stay lean)', + note: '11. Practical notes and recommendations', + }, + index: [ + { href: '#ruoli', label: 'Roles and scope' }, + { href: '#governance', label: 'Essential governance' }, + { href: '#responsabilita', label: 'Key responsibilities (summary)' }, + { href: '#raci', label: 'RACI for critical processes' }, + { href: '#flussi', label: 'Fast decision flows' }, + { href: '#controlli', label: 'Mandatory minimum controls (lean)' }, + { href: '#kpi', label: 'Essential KPIs' }, + { href: '#documentazione', label: 'Minimum documentation to maintain' }, + { href: '#piano-30', label: 'First operating plan (30 days)' }, + { href: '#outsourcing', label: 'Recommended outsourcing' }, + { href: '#note', label: 'Practical notes and recommendations' }, + ], + }, + introBox: + 'NexStudio operates from Bangkok. Numbers in parentheses below are indicative (early stage): formalize appointments and delegations and update them as the team grows.', + perimetro: + 'Document on roles, governance cadences and lean controls for the Company, with LexAura (Legal Tech) and MediAura (Health Tech) as product lines. It does not replace Legislative Decree 231 models, bylaws or legal opinions: align it with the legal entity, board and advisors.', + ruoli: [ + { + label: 'Founder / CEO (1)', + text: 'strategy, policy approval, board and investor relations, overall accountability toward law and contracts.', + }, + { + label: 'CTO / Head of Product (1)', + text: 'architecture, roadmap, product quality gates, end-to-end technical responsibility.', + }, + { + label: 'Lead Engineer (1–2)', + text: 'development, code review, CI/CD, code quality within the team.', + }, + { + label: 'DevOps / Platform (1, or outsourcing)', + text: 'deploy, KMS, backup and disaster recovery, production environment governance.', + }, + { + label: 'Security & Privacy Lead (1, hybrid or contractor)', + text: 'operational security, vulnerabilities, alignment with DPO and sensitive releases.', + }, + { + label: 'DPO / Privacy responsible (fractional or outsourcing)', + text: 'DPIA, data subject rights, notice consistency and records of processing.', + }, + { + label: 'Legal & compliance (fractional or external)', + text: 'contracts, NDAs, sector regulations relevant to Legal Tech and Health Tech.', + }, + { + label: 'Product / domain advisor (part-time or consultant)', + text: 'validation of features impacting medical or legal decisions, usage warnings.', + }, + { + label: 'Customer success / support (1)', + text: 'onboarding, requests, escalation to engineering and governance.', + }, + { + label: 'Operations / HR (1, part-time)', + text: 'staff onboarding, training, internal reporting and whistleblowing channels.', + }, + { + label: 'Finance (1, part-time or outsourcing)', + text: 'accounting, collections, vendor policies.', + }, + ] as const satisfies readonly ModelloRuolo[], + governance: [ + { + nome: 'Weekly tactical', + partecipanti: 'Founder, CTO, Security/privacy, customer success', + nota: 'priorities, open incidents, critical releases.', + }, + { + nome: 'Product sync (biweekly)', + partecipanti: 'CTO, lead engineer, domain advisor', + nota: 'backlog, release, product compliance checkpoint (per line where needed).', + }, + { + nome: 'Compliance check (monthly)', + partecipanti: 'CEO, legal, DPO, security', + nota: 'DPIA, high-risk vendors, incident and remediation summary.', + }, + { + nome: 'Quarterly review', + partecipanti: 'board or founders', + nota: 'strategy, budget, risks and capacity.', + }, + ] as const satisfies readonly ModelloGovernance[], + responsabilitaSintesi: [ + 'Code of ethics and policies: owned by legal & compliance; approved by CEO.', + 'Operational security and incident response: owned by security lead; technical execution by CTO.', + 'Privacy, sensitive processing, DPIA: owned by DPO; legal support.', + 'Production releases: accountable CTO; responsible lead engineer; consulted security, DPO, domain advisor.', + 'Vendors and sub-processors: owned by operations and legal; due diligence by security and DPO.', + 'Data subject requests (DSR): owned by DPO; customer success operations where applicable.', + 'Reports and whistleblowing: owned by operations/HR; investigative support by legal.', + ] as const, + controlliLean: [ + 'IAM with MFA for production and secrets access.', + 'CI/CD with SAST and dependency scanning in the pipeline.', + 'SBOM for every release.', + 'TLS in transit; encryption at rest for sensitive data.', + 'Daily backups; quarterly DR test with documented restore.', + 'Logging and alerting on anomalies (SIEM or managed service).', + 'Pre-release security/privacy checklist with approval trail.', + ] as const, + kpi: [ + { area: 'Security', testo: 'critical patches within SLA; MTTD and MTTR on incidents.' }, + { + area: 'Privacy', + testo: + 'DSR response time; open vs completed DPIAs by perimeter (Legal, Health, platform).', + }, + { + area: 'Product', + testo: 'deploy lead time; test coverage on critical modules (per product line).', + }, + { + area: 'Operations', + testo: 'uptime vs SLA; support response time; reports closed in the period.', + }, + ] as const satisfies readonly ModelloKpi[], + documentazione: [ + 'Code of ethics, adhesions in the register.', + 'Privacy notice, DPA, terms of use.', + 'DPIA for critical processing (reference by perimeter, as in the code of ethics).', + 'Trust/security brief for customers and audits (1–2 pages).', + 'Incident response playbook (executable version).', + 'SBOM and register of vendors and sub-processors.', + 'Pre-release checklist and approval log.', + ] as const, + piano30: [ + { + quando: 'Days 0–3', + testo: 'written appointments for security, DPO and fractional legal, with delegations.', + }, + { + quando: 'Days 4–10', + testo: 'pre-release checklist in the pipeline; MFA and IAM policy at the minimum above.', + }, + { + quando: 'Days 11–17', + testo: + 'start or update a DPIA on the most critical processing (e.g. MediAura or LexAura perimeter); due diligence on high-risk vendors.', + }, + { + quando: 'Days 18–24', + testo: + 'basic trust center: links to code of ethics, DPO/security channels, privacy/DPA materials if available.', + }, + { + quando: 'Days 25–30', + testo: + 'incident drill; rollback and backup test; initial mandatory security/privacy training.', + }, + ] as const satisfies readonly ModelloPiano30[], + outsourcing: [ + { + titolo: 'Security ops / SOC', + testo: 'logging, alerting, periodic penetration tests.', + }, + { + titolo: 'DPO and legal', + testo: + 'advisors with PDPA, GDPR and the medico-legal context of the markets you serve.', + }, + { + titolo: 'DevOps / platform', + testo: 'managed cloud services (KMS, managed databases) to reduce internal toil.', + }, + ] as const satisfies readonly ModelloOutsourcing[], + note: [ + 'Separation of duties: whoever approves production is not the only one granting admin access.', + 'Automate repetitive controls (SAST, SBOM, dependency scans).', + 'Document risk acceptance and decisions in ticketing for audit and post-mortems.', + 'For LexAura and MediAura: external validation on high-risk domain features.', + 'Quarterly review of the model; update the entries in this document and written delegations.', + ] as const, + flussiDecisionali: [ + { + titolo: 'Ordinary technical decision', + testo: + 'lead engineer → CTO (ticket with a note if it affects privacy/security or contractual risks).', + }, + { + titolo: 'Release with privacy or security impact', + testo: + 'go-ahead from security lead and DPO, target 48 business hours unless a reasoned written waiver.', + }, + { + titolo: 'P0 incident (e.g. probable or confirmed data breach)', + testo: + 'security notifies CEO, DPO and legal within 4h; board if impact on customers, regulators or sensitive data classes is high.', + }, + ] as const satisfies readonly ModelloFlusso[], + raci: [ + { + id: 'raci-release', + title: 'Production release', + rows: [ + { role: 'Lead engineer', r: true }, + { role: 'CTO', a: true }, + { role: 'Security lead, DPO, product advisor', c: true }, + { role: 'CEO, customer success', i: true }, + ], + }, + { + id: 'raci-incident', + title: 'Incident response (data breach or P0 incident)', + rows: [ + { role: 'Security lead', r: true }, + { role: 'CEO', a: true }, + { role: 'DPO, legal, CTO', c: true }, + { role: 'Affected customers, board (if high impact)', i: true }, + ], + }, + { + id: 'raci-vendor', + title: 'Vendor onboarding (sub-processor)', + rows: [ + { role: 'Operations', r: true }, + { role: 'Legal', a: true }, + { role: 'Security lead, DPO', c: true }, + { role: 'CTO, finance', i: true }, + ], + }, + { + id: 'raci-dpia', + title: 'DPIA (by perimeter: LexAura, MediAura, platform)', + note: 'The RACI matrix does not replace the legal criterion (who is controller, who is processor) defined in contracts and in', + noteLinkHref: '/codice-etico#tutela-dati-ruoli', + noteLinkLabel: '§5.1 of the code of ethics', + noteAfter: '. Here: who coordinates the internal impact assessment exercise.', + rows: [ + { role: 'DPO', r: true }, + { role: 'Legal', a: true }, + { role: 'Product advisor, CTO, security lead', c: true }, + { role: 'CEO', i: true }, + ], + }, + ] as const satisfies readonly (ModelloRaciMatrix & { noteAfter?: string })[], + }, + th: { + page: { + title: 'โมเดลองค์กร — NexStudio', + description: + 'โมเดลองค์กร NexStudio: การกำกับดูแล บทบาท RACI การควบคุมแบบ lean KPI แผน 30 วัน — สำหรับสายผลิตภัณฑ์ LexAura (Legal Tech) และ MediAura (Health Tech)', + heading: 'โมเดลองค์กร', + lead: + 'บทบาท จังหวะการกำกับดูแล กระบวนการ และการควบคุมแบบ lean ในซอฟต์แวร์เฮาส์ที่ส่งมอบ SaaS ที่มีการกำกับดูแลสูง เป็นส่วนเสริมของประมวลจริยธรรม ไม่แทนที่ข้อบังคับบริษัท โมเดลการปฏิบัติตามกฎของบริษัท (เช่น พ.ร.บ. 231 ของอิตาลี) หรือความเห็นทางกฎหมาย: ใช้ควบคู่กับโครงสร้างจริงและที่ปรึกษา', + indexTitle: 'สารบัญ', + roleCol: 'บทบาท', + raciLegendBefore: 'คำอธิบาย:', + raciLegend: + 'R = Responsible, A = Accountable, C = Consulted, I = Informed', + ruoliIntroBefore: + 'รายการสรุปหน้าที่และความคาดหวังด้านภาระงาน เพื่อจัดแนวโดเมนผลิตภัณฑ์ (Legal Tech, Health Tech) กับบทบาทและที่ปรึกษา โปรดอ้างอิงถึง', + codiceEticoLabel: 'ประมวลจริยธรรม', + codiceEticoHref: '/codice-etico', + ruoliIntroAfter: + 'และสำหรับการประมวลผลข้อมูล โปรดดูนโยบายความเป็นส่วนตัวและ DPA', + sectionTitles: { + ruoli: '1. บทบาทและขอบเขต', + governance: '2. การกำกับดูแลที่จำเป็น', + responsabilita: '3. ความรับผิดชอบหลัก (สรุป)', + raci: '4. RACI ย่อสำหรับกระบวนการวิกฤต', + flussi: '5. กระแสการตัดสินใจอย่างรวดเร็ว', + controlli: '6. การควบคุมขั้นต่ำที่บังคับ (lean)', + kpi: '7. KPI ที่จำเป็น', + documentazione: '8. เอกสารขั้นต่ำที่ต้องรักษา', + piano30: '9. แผนปฏิบัติการแรก (30 วัน)', + outsourcing: '10. การจ้างภายนอกที่แนะนำ (เพื่อให้กระชับ)', + note: '11. บันทึกเชิงปฏิบัติและข้อแนะนำ', + }, + index: [ + { href: '#ruoli', label: 'บทบาทและขอบเขต' }, + { href: '#governance', label: 'การกำกับดูแลที่จำเป็น' }, + { href: '#responsabilita', label: 'ความรับผิดชอบหลัก (สรุป)' }, + { href: '#raci', label: 'RACI สำหรับกระบวนการวิกฤต' }, + { href: '#flussi', label: 'กระแสการตัดสินใจอย่างรวดเร็ว' }, + { href: '#controlli', label: 'การควบคุมขั้นต่ำที่บังคับ (lean)' }, + { href: '#kpi', label: 'KPI ที่จำเป็น' }, + { href: '#documentazione', label: 'เอกสารขั้นต่ำที่ต้องรักษา' }, + { href: '#piano-30', label: 'แผนปฏิบัติการแรก (30 วัน)' }, + { href: '#outsourcing', label: 'การจ้างภายนอกที่แนะนำ' }, + { href: '#note', label: 'บันทึกเชิงปฏิบัติและข้อแนะนำ' }, + ], + }, + introBox: + 'NexStudio ดำเนินการจากกรุงเทพฯ ตัวเลขในวงเล็บด้านล่างเป็นแนวทาง (early stage): ให้แต่งตั้งและมอบอำนาจเป็นลายลักษณ์อักษร และอัปเดตทุกครั้งที่ทีมเติบโต', + perimetro: + 'เอกสารเกี่ยวกับบทบาท จังหวะการกำกับดูแล และการควบคุมแบบ lean ของบริษัท โดยมี LexAura (Legal Tech) และ MediAura (Health Tech) เป็นสายผลิตภัณฑ์ ไม่แทนที่โมเดลตาม พ.ร.บ. 231 ข้อบังคับ หรือความเห็นทางกฎหมาย: ให้สอดคล้องกับนิติบุคคล คณะกรรมการ และที่ปรึกษา', + ruoli: [ + { + label: 'Founder / CEO (1)', + text: 'กลยุทธ์ การอนุมัตินโยบาย การติดต่อกับบอร์ดและนักลงทุน ความรับผิดชอบโดยรวมต่อกฎหมายและสัญญา', + }, + { + label: 'CTO / Head of Product (1)', + text: 'สถาปัตยกรรม โรดแมป quality gate ของผลิตภัณฑ์ ความรับผิดชอบทางเทคนิคแบบ end-to-end', + }, + { + label: 'Lead Engineer (1–2)', + text: 'การพัฒนา code review CI/CD คุณภาพโค้ดในทีม', + }, + { + label: 'DevOps / Platform (1 หรือ outsourcing)', + text: 'deploy KMS สำรองข้อมูลและ disaster recovery การกำกับสภาพแวดล้อม production', + }, + { + label: 'Security & Privacy Lead (1 แบบผสมหรือ contractor)', + text: 'ความปลอดภัยเชิงปฏิบัติการ ช่องโหว่ การจัดแนวกับ DPO และการปล่อยรุ่นที่ละเอียดอ่อน', + }, + { + label: 'DPO / Privacy responsible (fractional หรือ outsourcing)', + text: 'DPIA สิทธิของเจ้าของข้อมูล ความสอดคล้องของประกาศ และทะเบียนการประมวลผล', + }, + { + label: 'Legal & compliance (fractional หรือภายนอก)', + text: 'สัญญา NDA กฎระเบียบภาคส่วนที่เกี่ยวข้องกับ Legal Tech และ Health Tech', + }, + { + label: 'Product / domain advisor (พาร์ทไทม์หรือที่ปรึกษา)', + text: 'ตรวจสอบฟีเจอร์ที่มีผลกระทบต่อการตัดสินใจทางการแพทย์หรือกฎหมาย คำเตือนการใช้งาน', + }, + { + label: 'Customer success / support (1)', + text: 'onboarding คำขอ การ escalate ไปยังฝ่ายเทคนิคและการกำกับดูแล', + }, + { + label: 'Operations / HR (1 พาร์ทไทม์)', + text: 'onboarding พนักงาน การฝึกอบรม ช่องทางรายงานและ whistleblowing ภายใน', + }, + { + label: 'Finance (1 พาร์ทไทม์หรือ outsourcing)', + text: 'บัญชี การเรียกเก็บ นโยบายผู้ให้บริการ', + }, + ] as const satisfies readonly ModelloRuolo[], + governance: [ + { + nome: 'Weekly tactical', + partecipanti: 'Founder, CTO, Security/privacy, customer success', + nota: 'ลำดับความสำคัญ เหตุการณ์ที่เปิดอยู่ การปล่อยรุ่นวิกฤต', + }, + { + nome: 'Product sync (ทุกสองสัปดาห์)', + partecipanti: 'CTO, lead engineer, domain advisor', + nota: 'backlog การปล่อยรุ่น จุดตรวจการปฏิบัติตามกฎของผลิตภัณฑ์ (ตามสายเมื่อจำเป็น)', + }, + { + nome: 'Compliance check (รายเดือน)', + partecipanti: 'CEO, legal, DPO, security', + nota: 'DPIA ผู้ขายความเสี่ยงสูง สรุปเหตุการณ์และการแก้ไข', + }, + { + nome: 'การทบทวนรายไตรมาส', + partecipanti: 'บอร์ดหรือ founders', + nota: 'กลยุทธ์ งบประมาณ ความเสี่ยง และความจุ', + }, + ] as const satisfies readonly ModelloGovernance[], + responsabilitaSintesi: [ + 'ประมวลจริยธรรมและนโยบาย: เจ้าของคือ legal & compliance; อนุมัติโดย CEO', + 'ความปลอดภัยเชิงปฏิบัติการและ incident response: เจ้าของคือ security lead; การดำเนินการทางเทคนิคโดย CTO', + 'ความเป็นส่วนตัว การประมวลผลที่ละเอียดอ่อน DPIA: เจ้าของคือ DPO; สนับสนุนโดย legal', + 'การปล่อยสู่ production: accountable คือ CTO; responsible คือ lead engineer; consulted คือ security, DPO, domain advisor', + 'ผู้ให้บริการและผู้ประมวลผลช่วง: เจ้าของคือ operations และ legal; due diligence โดย security และ DPO', + 'คำขอของเจ้าของข้อมูล (DSR): เจ้าของคือ DPO; การดำเนินงานโดย customer success เมื่อเกี่ยวข้อง', + 'การรายงานและ whistleblowing: เจ้าของคือ operations/HR; สนับสนุนการสอบสวนโดย legal', + ] as const, + controlliLean: [ + 'IAM พร้อม MFA สำหรับการเข้าถึง production และความลับ', + 'CI/CD พร้อม SAST และการสแกน dependency ใน pipeline', + 'SBOM สำหรับทุกการปล่อยรุ่น', + 'TLS ขณะส่งข้อมูล; การเข้ารหัสขณะพักสำหรับข้อมูลอ่อนไหว', + 'สำรองข้อมูลรายวัน; ทดสอบ DR รายไตรมาสพร้อมการกู้คืนที่บันทึกไว้', + 'บันทึกและแจ้งเตือนเมื่อพบความผิดปกติ (SIEM หรือบริการจัดการ)', + 'เช็กลิสต์ security/privacy ก่อนปล่อยพร้อมเส้นทางอนุมัติ', + ] as const, + kpi: [ + { area: 'Security', testo: 'แพตช์วิกฤตภายใน SLA; MTTD และ MTTR ของเหตุการณ์' }, + { + area: 'Privacy', + testo: + 'เวลาตอบสนอง DSR; DPIA ที่เปิดอยู่เทียบกับที่เสร็จแล้วตามขอบเขต (กฎหมาย สุขภาพ แพลตฟอร์ม)', + }, + { + area: 'Product', + testo: 'lead time การ deploy; ความครอบคลุมการทดสอบบนโมดูลวิกฤต (ตามสายผลิตภัณฑ์)', + }, + { + area: 'Operations', + testo: 'uptime ตาม SLA; เวลาตอบสนอง support; รายงานที่ปิดในช่วงเวลา', + }, + ] as const satisfies readonly ModelloKpi[], + documentazione: [ + 'ประมวลจริยธรรม การยอมรับในทะเบียน', + 'ประกาศความเป็นส่วนตัว DPA เงื่อนไขการใช้งาน', + 'DPIA สำหรับการประมวลผลวิกฤต (อ้างอิงตามขอบเขต ดังในประมวลจริยธรรม)', + 'สรุป trust/security สำหรับลูกค้าและการตรวจสอบ (1–2 หน้า)', + 'Playbook การตอบสนองเหตุการณ์ (เวอร์ชันที่ใช้งานได้)', + 'SBOM และทะเบียนผู้ให้บริการและผู้ประมวลผลช่วง', + 'เช็กลิสต์ก่อนปล่อยและบันทึกการอนุมัติ', + ] as const, + piano30: [ + { + quando: 'วัน 0–3', + testo: 'แต่งตั้งเป็นลายลักษณ์อักษรสำหรับ security, DPO และ legal แบบ fractional พร้อมการมอบอำนาจ', + }, + { + quando: 'วัน 4–10', + testo: 'เช็กลิสต์ก่อนปล่อยใน pipeline; MFA และนโยบาย IAM ตามขั้นต่ำด้านบน', + }, + { + quando: 'วัน 11–17', + testo: + 'เริ่มหรืออัปเดต DPIA บนการประมวลผลที่วิกฤตที่สุด (เช่น ขอบเขต MediAura หรือ LexAura); due diligence ผู้ขายความเสี่ยงสูง', + }, + { + quando: 'วัน 18–24', + testo: + 'trust center พื้นฐาน: ลิงก์ไปยังประมวลจริยธรรม ช่องทาง DPO/security เอกสาร privacy/DPA หากมี', + }, + { + quando: 'วัน 25–30', + testo: + 'ซ้อมเหตุการณ์; ทดสอบ rollback และสำรองข้อมูล; การฝึกอบรม security/privacy เบื้องต้นที่บังคับ', + }, + ] as const satisfies readonly ModelloPiano30[], + outsourcing: [ + { + titolo: 'Security ops / SOC', + testo: 'บันทึก การแจ้งเตือน การทดสอบเจาะระบบเป็นระยะ', + }, + { + titolo: 'DPO และ legal', + testo: + 'ที่ปรึกษาที่มีความรู้ PDPA GDPR และบริบททางการแพทย์-กฎหมายของตลาดที่คุณให้บริการลูกค้า', + }, + { + titolo: 'DevOps / platform', + testo: 'บริการคลาวด์แบบจัดการ (KMS ฐานข้อมูลแบบจัดการ) เพื่อลดภาระภายใน', + }, + ] as const satisfies readonly ModelloOutsourcing[], + note: [ + 'การแยกหน้าที่: ผู้ที่อนุมัติ production ไม่ใช่ผู้เดียวที่ให้สิทธิ์ผู้ดูแลระบบ', + 'ทำให้การควบคุมซ้ำๆ เป็นอัตโนมัติ (SAST, SBOM, สแกน dependency)', + 'บันทึกการยอมรับความเสี่ยงและการตัดสินใจในระบบตั๋วเพื่อการตรวจสอบและ post-mortem', + 'สำหรับ LexAura และ MediAura: การตรวจสอบภายนอกบนฟีเจอร์โดเมนความเสี่ยงสูง', + 'ทบทวนโมเดลรายไตรมาส; อัปเดตรายการในเอกสารนี้และการมอบอำนาจเป็นลายลักษณ์อักษร', + ] as const, + flussiDecisionali: [ + { + titolo: 'การตัดสินใจทางเทคนิคทั่วไป', + testo: + 'lead engineer → CTO (ตั๋วพร้อมหมายเหตุหากกระทบความเสี่ยง privacy/ความปลอดภัย หรือตามสัญญา)', + }, + { + titolo: 'การปล่อยที่มีผลกระทบต่อความเป็นส่วนตัวหรือความปลอดภัย', + testo: + 'การอนุมัติจาก security lead และ DPO เป้าหมาย 48 ชั่วโมงทำการ เว้นแต่มีการยกเว้นเป็นลายลักษณ์อักษรพร้อมเหตุผล', + }, + { + titolo: 'เหตุการณ์ P0 (เช่น การละเมิดข้อมูลที่น่าจะเป็นหรือยืนยันแล้ว)', + testo: + 'security แจ้ง CEO, DPO และ legal ภายใน 4 ชม.; บอร์ดหากผลกระทบต่อลูกค้า หน่วยงานกำกับ หรือประเภทข้อมูลอ่อนไหวสูง', + }, + ] as const satisfies readonly ModelloFlusso[], + raci: [ + { + id: 'raci-release', + title: 'การปล่อยสู่ production', + rows: [ + { role: 'Lead engineer', r: true }, + { role: 'CTO', a: true }, + { role: 'Security lead, DPO, product advisor', c: true }, + { role: 'CEO, customer success', i: true }, + ], + }, + { + id: 'raci-incident', + title: 'Incident response (การละเมิดข้อมูลหรือเหตุการณ์ P0)', + rows: [ + { role: 'Security lead', r: true }, + { role: 'CEO', a: true }, + { role: 'DPO, legal, CTO', c: true }, + { role: 'ลูกค้าที่เกี่ยวข้อง บอร์ด (หากผลกระทบสูง)', i: true }, + ], + }, + { + id: 'raci-vendor', + title: 'Onboarding ผู้ขาย (ผู้ประมวลผลช่วง)', + rows: [ + { role: 'Operations', r: true }, + { role: 'Legal', a: true }, + { role: 'Security lead, DPO', c: true }, + { role: 'CTO, finance', i: true }, + ], + }, + { + id: 'raci-dpia', + title: 'DPIA (ตามขอบเขต: LexAura, MediAura, แพลตฟอร์ม)', + note: 'เมทริกซ์ RACI ไม่แทนที่เกณฑ์ทางกฎหมาย (ใครเป็นผู้ควบคุม ใครเป็นผู้ประมวลผล) ที่กำหนดในสัญญาและใน', + noteLinkHref: '/codice-etico#tutela-dati-ruoli', + noteLinkLabel: '§5.1 ของประมวลจริยธรรม', + noteAfter: ' ที่นี่: ใครประสานงานการประเมินผลกระทบภายใน', + rows: [ + { role: 'DPO', r: true }, + { role: 'Legal', a: true }, + { role: 'Product advisor, CTO, security lead', c: true }, + { role: 'CEO', i: true }, + ], + }, + ] as const satisfies readonly (ModelloRaciMatrix & { noteAfter?: string })[], + }, } as const; -export const modelloOrganizzativoRuoli = [ - { - label: 'Founder / CEO (1)', - text: 'strategia, approvazione delle policy, contatti con board e investitori, accountability complessiva verso legge e contratti.', - }, - { - label: 'CTO / Head of Product (1)', - text: 'architettura, roadmap, quality gate di prodotto, responsabilità tecnica end-to-end.', - }, - { - label: 'Lead Engineer (1–2)', - text: 'sviluppo, code review, CI/CD, qualità del codice in reparto.', - }, - { - label: 'DevOps / Platform (1, oppure outsourcing)', - text: 'deploy, KMS, backup e disaster recovery, governo ambiente di produzione.', - }, - { - label: 'Security & Privacy Lead (1, ibrido o contractor)', - text: 'sicurezza operativa, vulnerabilità, allineamento con DPO e rilasci sensibili.', - }, - { - label: 'DPO / Privacy responsible (frazionale o outsourcing)', - text: 'DPIA, diritti degli interessati, coerenza informativa e register dei trattamenti.', - }, - { - label: 'Legal & compliance (frazionale o esterno)', - text: 'contratti, NDA, normative di settore pertinenza Legal Tech e Health Tech.', - }, - { - label: 'Product / domain advisor (part-time o consulente)', - text: 'convalida funzionalità ad impatto su decisioni mediche o legali, avvertenze d’uso.', - }, - { - label: 'Customer success / support (1)', - text: 'onboarding, richieste, escalation verso tecnica e governance.', - }, - { - label: 'Operations / HR (1, part-time)', - text: 'onboarding personale, formazione, canali segnalazioni e whistleblowing interno.', - }, - { - label: 'Finance (1, part-time o outsourcing)', - text: 'contabilità, incassi, policy fornitori.', - }, -] as const; +export const getModelloOrganizzativo = (locale: SupportedLocale) => + modelloOrganizzativoByLocale[locale]; -export const modelloOrganizzativoGovernance = [ - { - nome: 'Weekly tactical', - partecipanti: 'Founder, CTO, Security/privacy, customer success', - nota: 'priorità, incidenti aperti, rilasci critici.', - }, - { - nome: 'Product sync (bisettimanale)', - partecipanti: 'CTO, lead engineer, domain advisor', - nota: 'backlog, release, checkpoint compliance di prodotto (per linea ove serva).', - }, - { - nome: 'Compliance check (mensile)', - partecipanti: 'CEO, legal, DPO, security', - nota: 'DPIA, vendor ad alto rischio, sintesi incidenti e correzioni.', - }, - { - nome: 'Review trimestrale', - partecipanti: 'board o founders', - nota: 'strategia, budget, rischi e capacity.', - }, -] as const; +/** Retro-compatibilità: fallback italiano. */ +export const modelloOrganizzativo = { + introBox: modelloOrganizzativoByLocale.it.introBox, + perimetro: modelloOrganizzativoByLocale.it.perimetro, +} as const; -export const modelloOrganizzativoResponsabilitaSintesi: readonly string[] = [ - "Codice etico e policy: owner legal & compliance; approvazione CEO.", - "Sicurezza operativa e incident response: owner security lead; esecuzione tecnica CTO.", - "Privacy, trattamenti sensibili, DPIA: owner DPO; supporto legal.", - "Rilasci in produzione: accountable CTO; responsible lead engineer; consulted security, DPO, domain advisor.", - "Fornitori e sub-processori: owner operations e legal; due diligence security e DPO.", - "Richieste interessati (DSR): owner DPO; operatività customer success ove applicabile.", - "Segnalazioni e whistleblowing: owner operations/HR; supporto investigativo legal.", -] as const; - -export const modelloOrganizzativoControlliLean: readonly string[] = [ - 'IAM con MFA per accesso a produzione e a segreti.', - 'CI/CD con SAST e scansione dipendenze in pipeline.', - 'SBOM per ogni release.', - 'TLS in transito; cifratura a riposo per dati sensibili.', - 'Backup giornalieri; test DR trimestrale con ripristino documentato.', - "Log e alerting su anomalie (SIEM o servizio gestito).", - "Checklist pre-release security/privacy con traccia d'approvazione.", -] as const; - -export const modelloOrganizzativoKpi = [ - { area: 'Security', testo: 'patch critiche entro SLA; MTTD e MTTR su incidenti.' }, - { area: 'Privacy', testo: 'tempo risposta DSR; DPIA aperte vs completate per perimetro (Legale, Sanitario, piattaforma).' }, - { area: 'Product', testo: 'lead time deploy; copertura test sui moduli critici (per linea prodotto).' }, - { area: 'Operations', testo: 'uptime su SLA; tempo risposta support; segnalazioni chiuse nel periodo.' }, -] as const; - -export const modelloOrganizzativoDocumentazione: readonly string[] = [ - 'Codice etico, adesioni in registro.', - 'Informativa privacy, DPA, condizioni d’uso.', - 'DPIA per trattamenti critici (riferire per perimetro, come nel codice etico).', - "Trust/security brief per clienti e audit (1–2 pagine).", - "Playbook incident response (versione eseguibile).", - "SBOM e registro fornitori e sub-processori.", - "Checklist pre-release e log approvazioni.", -] as const; - -export const modelloOrganizzativoPiano30: readonly { quando: string; testo: string }[] = [ - { - quando: 'Giorni 0–3', - testo: 'nomine scritte su security, DPO e legal frazionali, con deleghe.', - }, - { - quando: 'Giorni 4–10', - testo: "checklist pre-release in pipeline; MFA e policy IAM al minimo sopra.", - }, - { - quando: 'Giorni 11–17', - testo: - 'avviare o aggiornare una DPIA sul trattamento più critico (es. perimetro MediAura o LexAura); due diligence fornitori ad alto rischio.', - }, - { - quando: 'Giorni 18–24', - testo: - 'Trust center di base: link a codice etico, canali DPO/security, materiali privacy/DPA se disponibili.', - }, - { - quando: 'Giorni 25–30', - testo: 'esercitazione su incident; test rollback e backup; formazione security/privacy obbligatoria iniziale.', - }, -] as const; - -export const modelloOrganizzativoOutsourcing: readonly { titolo: string; testo: string }[] = [ - { - titolo: 'Security ops / SOC', - testo: 'log, alerting, penetration test periodici.', - }, - { - titolo: 'DPO e legal', - testo: "consulenti con PDPA, GDPR e contesto medico-legale dei mercati in cui servite i clienti.", - }, - { - titolo: 'DevOps / platform', - testo: "servizi cloud gestiti (KMS, database gestiti) per ridurre toil interno.", - }, -] as const; - -export const modelloOrganizzativoNote: readonly string[] = [ - "Separazione dei compiti: chi approva in produzione non è l’unico a concedere accessi amministrativi.", - 'Automatizzare controlli ripetitivi (SAST, SBOM, scan dipendenze).', - "Documentare su ticketing accettazione rischio e decisioni per audit e post-mortem.", - 'Per LexAura e MediAura: convalida esterna su funzionalità ad alto rischio di dominio.', - 'Revisione trimestrale del modello; aggiornare le voci in questo documento e le deleghe scritte.', -] as const; - -export const modelloOrganizzativoFlussiDecisionali: readonly { titolo: string; testo: string }[] = [ - { - titolo: 'Decisione tecnica ordinaria', - testo: "lead engineer → CTO (ticket con nota se impatta rischi privacy/sicurezza o contrattuali).", - }, - { - titolo: "Rilascio con impatto privacy o sicurezza", - testo: "via libera di security lead e DPO, target 48 ore lavorative salvo deroga motivata scritta.", - }, - { - titolo: "Incident P0 (es. data breach probabile o confermato)", - testo: "security notifica entro 4h CEO, DPO e legal; board se impatto su clienti, regolatori o classi di dati sensibili elevato.", - }, -] as const; +export const modelloOrganizzativoRuoli = modelloOrganizzativoByLocale.it.ruoli; +export const modelloOrganizzativoGovernance = + modelloOrganizzativoByLocale.it.governance; +export const modelloOrganizzativoResponsabilitaSintesi = + modelloOrganizzativoByLocale.it.responsabilitaSintesi; +export const modelloOrganizzativoControlliLean = + modelloOrganizzativoByLocale.it.controlliLean; +export const modelloOrganizzativoKpi = modelloOrganizzativoByLocale.it.kpi; +export const modelloOrganizzativoDocumentazione = + modelloOrganizzativoByLocale.it.documentazione; +export const modelloOrganizzativoPiano30 = + modelloOrganizzativoByLocale.it.piano30; +export const modelloOrganizzativoOutsourcing = + modelloOrganizzativoByLocale.it.outsourcing; +export const modelloOrganizzativoNote = modelloOrganizzativoByLocale.it.note; +export const modelloOrganizzativoFlussiDecisionali = + modelloOrganizzativoByLocale.it.flussiDecisionali; diff --git a/src/data/news.ts b/src/data/news.ts new file mode 100644 index 0000000..dddd02c --- /dev/null +++ b/src/data/news.ts @@ -0,0 +1,208 @@ +/** + * Pagina Novità / News / ข่าว — contenuti localizzati. + */ +import type { SupportedLocale } from './home/navigation'; + +export type NewsBullet = { + title?: string; + text: string; +}; + +export type NewsSection = { + title: string; + paragraphs?: readonly string[]; + bullets?: readonly NewsBullet[]; +}; + +type NewsLocaleBundle = { + page: { + title: string; + description: string; + heading: string; + lead: string; + }; + statusBanner: string; + sections: readonly NewsSection[]; + contact: { + before: string; + linkLabel: string; + href: string; + after: string; + }; +}; + +const newsByLocale: Record = { + it: { + page: { + title: 'Novità — NexStudio', + description: 'Novità, release e articoli da NexStudio.', + heading: 'Novità', + lead: + 'Aggiornamenti ufficiali su piattaforma, compliance, infrastruttura e contenuti editoriali.', + }, + statusBanner: + 'Stato editoriale: canale attivo. Le prossime pubblicazioni verranno aggiornate su questa pagina con frequenza periodica.', + sections: [ + { + title: 'Programma editoriale', + bullets: [ + { + title: 'Release tecniche:', + text: 'aggiornamenti su funzionalità, integrazioni e miglioramenti di stabilità.', + }, + { + title: 'Compliance:', + text: 'novità su policy, sicurezza applicativa e adempimenti normativi.', + }, + { + title: 'Case e risultati:', + text: 'note operative su adozione, scalabilità e impatti di business.', + }, + ], + }, + { + title: 'Canali di distribuzione', + bullets: [ + { + text: 'Questa pagina resta il punto di riferimento ufficiale per annunci e changelog sintetici.', + }, + { + text: 'La newsletter è attiva dal footer del sito (iscrizione con conferma email).', + }, + { + text: 'I contenuti long-form potranno essere pubblicati anche su canali esterni, con rimando qui.', + }, + ], + }, + { + title: 'Archivio', + paragraphs: [ + 'In questa fase il sito è in pre-lancio operativo. Il primo blocco di news verrà pubblicato con il go-live ufficiale.', + ], + }, + ], + contact: { + before: + 'Per richieste stampa, partnership o approfondimenti tecnici è possibile usare il form nella sezione ', + linkLabel: 'Contatti', + href: '/#contatti', + after: '.', + }, + }, + en: { + page: { + title: 'News — NexStudio', + description: 'News, releases, and articles from NexStudio.', + heading: 'News', + lead: + 'Official updates on platform, compliance, infrastructure, and editorial content.', + }, + statusBanner: + 'Editorial status: channel active. Upcoming publications will be updated on this page on a periodic basis.', + sections: [ + { + title: 'Editorial programme', + bullets: [ + { + title: 'Technical releases:', + text: 'updates on features, integrations, and stability improvements.', + }, + { + title: 'Compliance:', + text: 'news on policies, application security, and regulatory requirements.', + }, + { + title: 'Cases and results:', + text: 'operational notes on adoption, scalability, and business impact.', + }, + ], + }, + { + title: 'Distribution channels', + bullets: [ + { + text: 'This page remains the official reference point for announcements and concise changelogs.', + }, + { + text: 'The newsletter is available from the site footer (subscription with email confirmation).', + }, + { + text: 'Long-form content may also be published on external channels, with a link back here.', + }, + ], + }, + { + title: 'Archive', + paragraphs: [ + 'At this stage the site is in pre-launch operations. The first block of news will be published with the official go-live.', + ], + }, + ], + contact: { + before: + 'For press requests, partnerships, or technical deep-dives, you can use the form in the ', + linkLabel: 'Contacts', + href: '/#contatti', + after: ' section.', + }, + }, + th: { + page: { + title: 'ข่าว — NexStudio', + description: 'ข่าว รีลีส และบทความจาก NexStudio', + heading: 'ข่าว', + lead: + 'อัปเดตอย่างเป็นทางการเกี่ยวกับแพลตฟอร์ม การปฏิบัติตามกฎ โครงสร้างพื้นฐาน และเนื้อหาบรรณาธิการ', + }, + statusBanner: + 'สถานะบรรณาธิการ: ช่องทางใช้งานอยู่ สิ่งที่จะเผยแพร่ต่อไปจะอัปเดตบนหน้านี้เป็นระยะ', + sections: [ + { + title: 'แผนบรรณาธิการ', + bullets: [ + { + title: 'รีลีสทางเทคนิค:', + text: 'อัปเดตฟีเจอร์ การผสานระบบ และการปรับปรุงความเสถียร', + }, + { + title: 'การปฏิบัติตามกฎ:', + text: 'ข่าวเกี่ยวกับนโยบาย ความปลอดภัยของแอปพลิเคชัน และข้อกำหนดด้านกฎระเบียบ', + }, + { + title: 'กรณีศึกษาและผลลัพธ์:', + text: 'บันทึกเชิงปฏิบัติเกี่ยวกับการนำไปใช้ ความสามารถในการขยายผล และผลกระทบทางธุรกิจ', + }, + ], + }, + { + title: 'ช่องทางการเผยแพร่', + bullets: [ + { + text: 'หน้านี้ยังคงเป็นจุดอ้างอิงอย่างเป็นทางการสำหรับประกาศและ changelog แบบสรุป', + }, + { + text: 'จดหมายข่าวเปิดใช้งานจากส่วนท้ายของเว็บไซต์ (สมัครพร้อมยืนยันอีเมล)', + }, + { + text: 'เนื้อหายาวอาจเผยแพร่บนช่องทางภายนอกด้วย โดยมีลิงก์กลับมายังที่นี่', + }, + ], + }, + { + title: 'คลังข่าว', + paragraphs: [ + 'ในระยะนี้เว็บไซต์อยู่ในช่วงก่อนเปิดใช้งานอย่างเป็นทางการ ชุดข่าวชุดแรกจะเผยแพร่พร้อมการเปิดตัวอย่างเป็นทางการ', + ], + }, + ], + contact: { + before: + 'สำหรับคำขอสื่อ ความร่วมมือ หรือข้อมูลเชิงลึกทางเทคนิค สามารถใช้แบบฟอร์มในส่วน ', + linkLabel: 'ติดต่อ', + href: '/#contatti', + after: ' ได้', + }, + }, +}; + +export const getNews = (locale: SupportedLocale) => newsByLocale[locale]; diff --git a/src/data/privacy.ts b/src/data/privacy.ts index 4aeedcf..a66a925 100644 --- a/src/data/privacy.ts +++ b/src/data/privacy.ts @@ -2,22 +2,7 @@ * Informativa privacy del portale NexStudio e dei prodotti SaaS LexAura / MediAura. * Questo file centralizza i contenuti della pagina /privacy per facilitare revisioni legali. */ -export const privacyDocument = { - version: '1.1', - inVigoreDal: '[DATA]', - ultimoAggiornamento: '[DATA]', -} as const; - -export const privacyCrossReferences = { - lead: - "L'informativa distingue il portale istituzionale NexStudio dai servizi SaaS LexAura e MediAura; le informative privacy specifiche dei singoli SaaS, pubblicate nei rispettivi portali applicativi, restano il riferimento di dettaglio per l'uso del prodotto.", -} as const; - -export const privacyRiferimenti: readonly { label: string; href: string }[] = [ - { label: "Condizioni d'uso", href: '/terms' }, - { label: 'Cookie policy', href: '/cookies' }, - { label: 'Diritti GDPR', href: '/gdpr' }, -] as const; +import type { SupportedLocale } from './home/navigation'; export type PrivacySection = { id: string; @@ -28,138 +13,505 @@ export type PrivacySection = { paragraphsAfterBullets?: readonly string[]; }; -export const privacySections: readonly PrivacySection[] = [ - { - id: 'ambito', - title: '1. Ambito della presente informativa', - paragraphs: [ - "La presente informativa descrive il quadro generale con cui NexStudio S.r.l. tratta i dati personali raccolti tramite il sito istituzionale pubblico e i canali corporate (collegati anche ai prodotti LexAura e MediAura).", - "Per l'uso operativo dei SaaS, il livello di dettaglio e il ruolo privacy possono variare: NexStudio può operare come titolare, contitolare o responsabile del trattamento a seconda del servizio e degli accordi contrattuali.", - "In caso di conflitto tra questa pagina e un Data Processing Agreement (DPA), un contratto quadro o condizioni speciali firmate, prevalgono i documenti contrattuali specifici per il servizio acquistato.", - ], +const privacyByLocale = { + it: { + document: { + version: '1.1', + inVigoreDal: '[DATA]', + ultimoAggiornamento: '[DATA]', + }, + crossReferences: { + lead: + "L'informativa distingue il portale istituzionale NexStudio dai servizi SaaS LexAura e MediAura; le informative privacy specifiche dei singoli SaaS, pubblicate nei rispettivi portali applicativi, restano il riferimento di dettaglio per l'uso del prodotto.", + }, + riferimenti: [ + { label: "Condizioni d'uso", href: '/terms' }, + { label: 'Cookie policy', href: '/cookies' }, + { label: 'Diritti GDPR', href: '/gdpr' }, + ] as const, + sections: [ + { + id: 'ambito', + title: '1. Ambito della presente informativa', + paragraphs: [ + 'La presente informativa descrive il quadro generale con cui NexStudio S.r.l. tratta i dati personali raccolti tramite il sito istituzionale pubblico e i canali corporate (collegati anche ai prodotti LexAura e MediAura).', + "Per l'uso operativo dei SaaS, il livello di dettaglio e il ruolo privacy possono variare: NexStudio può operare come titolare, contitolare o responsabile del trattamento a seconda del servizio e degli accordi contrattuali.", + 'In caso di conflitto tra questa pagina e un Data Processing Agreement (DPA), un contratto quadro o condizioni speciali firmate, prevalgono i documenti contrattuali specifici per il servizio acquistato.', + ], + }, + { + id: 'titolare', + title: '2. Identità del titolare e punti di contatto', + paragraphs: [ + 'Titolare del trattamento: NexStudio S.r.l., con sede legale in Italia, [INDIRIZZO_COMPLETO], P.IVA [DA_INSERIRE].', + 'Canali per richieste privacy:', + ], + bullets: [ + 'Email: privacy@nexstudio.com', + 'Form di contatto su nexstudio.ai', + 'Per i clienti SaaS: canali autenticati/ticket previsti nei rispettivi portali (LexAura, MediAura)', + ], + paragraphsAfterBullets: [ + 'Il Responsabile della Protezione dei Dati (DPO) è contattabile agli stessi recapiti.', + ], + }, + { + id: 'categorie-dati', + title: '3. Categorie di dati trattati', + paragraphs: [ + 'Le categorie di dati variano in funzione del canale utilizzato e dei moduli/feature attivi.', + ], + bullets: [ + 'Portale NexStudio: dati di navigazione (log tecnici, IP, user agent), dati di contatto inviati volontariamente (nome, email, azienda, contenuto del messaggio), preferenze cookie e metriche aggregate.', + 'LexAura (Legal Tech): dati di account e profilo utente, metadati di workspace, documenti giuridici caricati o generati, richieste testuali ai motori di analisi/sintesi, log di audit su accessi e operazioni.', + 'MediAura (Health Tech): dati di account e ruoli, metadati organizzativi, documentazione sanitaria o amministrativa, input vocali e relative trascrizioni, log tecnici e di sicurezza.', + 'Categorie particolari ex art. 9 GDPR: possono emergere in MediAura (e, in specifici casi, in LexAura) quando i clienti caricano contenuti che includono dati sanitari o altri dati sensibili; il trattamento avviene solo nei limiti del servizio e delle istruzioni ricevute dal cliente titolare.', + ], + }, + { + id: 'finalita-basi', + title: '4. Finalità e basi giuridiche del trattamento', + paragraphs: [], + bullets: [ + 'Gestione del sito istituzionale, sicurezza e continuità operativa (base: legittimo interesse alla sicurezza, prevenzione abusi e mantenimento del servizio).', + "Gestione richieste pre-contrattuali, demo, contatti commerciali e supporto (base: misure precontrattuali su richiesta dell'interessato; legittimo interesse nella gestione B2B).", + 'Erogazione dei SaaS LexAura e MediAura, autenticazione utenti, gestione tenant e assistenza tecnica (base: esecuzione del contratto con il cliente business).', + 'Conformità normativa, adempimenti amministrativi/fiscali, gestione contenziosi e difesa di diritti (base: obbligo legale e legittimo interesse alla tutela in giudizio).', + 'Comunicazioni marketing/newsletter, ove attive (base: consenso, salvo eccezioni di soft spam consentite dalla normativa applicabile).', + 'Miglioramento del servizio e sviluppo funzionalità IA: solo se previsto dal contratto o da istruzioni documentate; in assenza di tale base i dati non sono utilizzati per training generalista.', + ], + }, + { + id: 'ruoli-saas', + title: '5. Ruoli privacy specifici per LexAura e MediAura', + paragraphs: [ + 'Per i servizi SaaS B2B, il cliente determina normalmente finalità e mezzi del trattamento relativi ai dati caricati nel proprio ambiente applicativo, agendo come titolare del trattamento. NexStudio agisce di regola come responsabile del trattamento per conto del cliente, con nomina contrattuale e istruzioni documentate.', + 'Qualora NexStudio determini autonomamente finalità specifiche (es. prevenzione frodi, sicurezza infrastrutturale, metriche aggregate non riconducibili al singolo interessato), agisce come titolare autonomo per tali trattamenti.', + 'Le informative privacy dedicate di LexAura e MediAura, pubblicate nei rispettivi siti o ambienti applicativi, approfondiscono categorie dati, flussi, tempi di retention e basi giuridiche specifiche del singolo prodotto.', + ], + }, + { + id: 'conservazione', + title: '6. Tempi di conservazione', + paragraphs: [], + bullets: [ + "Dati di contatto dal sito: 24 mesi dall'ultima interazione.", + 'Dati di account SaaS: per tutta la durata del rapporto contrattuale + 30 giorni dalla cancellazione.', + 'Log tecnici e di sicurezza: massimo 30 giorni.', + 'Dati di fatturazione: 10 anni come richiesto dalla normativa fiscale italiana.', + 'Dati sanitari: secondo le istruzioni del titolare (cliente) e gli obblighi di legge.', + 'Dati analitici aggregati: indefinitamente in forma anonima.', + ], + }, + { + id: 'destinatari', + title: '7. Destinatari e categorie di soggetti autorizzati', + paragraphs: [ + 'I dati possono essere trattati da personale NexStudio autorizzato e istruito, nonché da fornitori qualificati che operano come responsabili/sub-responsabili (es. hosting cloud, servizi infrastrutturali, monitoraggio sicurezza, strumenti di comunicazione).', + "L'elenco aggiornato dei responsabili e sub-responsabili rilevanti per i clienti SaaS è messo a disposizione nei canali contrattuali o su richiesta.", + ], + }, + { + id: 'trasferimenti', + title: '8. Trasferimenti internazionali di dati', + paragraphs: [ + "In ragione dell'uso di fornitori cloud globali, alcuni trattamenti possono comportare trasferimenti verso Paesi extra SEE/UE. Quando richiesto dalla normativa, NexStudio adotta garanzie adeguate (es. clausole contrattuali standard, misure supplementari tecniche/organizzative, valutazioni di impatto sul trasferimento) e limita il trasferimento ai soli dati necessari.", + 'I dati sono preferibilmente trattati nello Spazio Economico Europeo. Cloudflare Inc. aderisce al Data Privacy Framework UE-USA e adotta Clausole Contrattuali Standard (SCC).', + ], + }, + { + id: 'sicurezza', + title: '9. Misure di sicurezza e governance', + paragraphs: [ + 'NexStudio adotta misure tecniche e organizzative proporzionate al rischio:', + ], + bullets: [ + 'Controlli di accesso basati su ruoli, autenticazione, segregazione logica degli ambienti cliente e principio del minimo privilegio.', + 'Cifratura dei dati in transito (TLS 1.3) e a riposo; gestione sicura delle chiavi.', + 'Logging, monitoraggio, audit trail e procedure di gestione incidenti.', + 'Procedure di backup, continuità operativa e disaster recovery.', + ], + }, + { + id: 'diritti', + title: '10. Diritti degli interessati e modalità di esercizio', + paragraphs: [ + "Gli interessati possono esercitare i diritti previsti dalla normativa applicabile (accesso, rettifica, cancellazione, limitazione, opposizione, portabilità, revoca del consenso, reclamo all'autorità competente).", + 'Per dati trattati nel contesto dei SaaS, la richiesta va di norma indirizzata prima al cliente titolare (es. studio legale o struttura sanitaria). NexStudio fornisce supporto al cliente titolare secondo contratto.', + 'Per dati trattati da NexStudio come titolare (es. contatti dal sito, log di sicurezza propri), le richieste possono essere inviate a privacy@nexstudio.com o tramite il form su nexstudio.ai.', + 'Autorità di controllo competente: Garante per la protezione dei dati personali (www.garanteprivacy.it).', + ], + }, + { + id: 'cookie-tracking', + title: '11. Cookie, analytics e tracciamenti', + paragraphs: [ + 'Le informazioni su cookie tecnici, eventuali cookie analitici e strumenti di tracciamento sono descritte nella Cookie Policy, da leggere congiuntamente alla presente informativa.', + ], + }, + { + id: 'minori', + title: '12. Trattamento dati di minori', + paragraphs: [ + "I servizi NexStudio sono progettati per un'utenza professionale e business. Non sono rivolti intenzionalmente a minori.", + ], + }, + { + id: 'aggiornamenti', + title: '13. Aggiornamenti della policy', + paragraphs: [ + 'NexStudio può aggiornare questa informativa per adeguamenti normativi, evoluzione dei servizi, modifiche organizzative o introduzione di nuove funzionalità. Le modifiche rilevanti saranno pubblicate su questa pagina con aggiornamento di versione e data.', + ], + }, + ] as const satisfies readonly PrivacySection[], + page: { + title: 'Privacy — NexStudio', + description: + 'Informativa privacy quadro NexStudio S.r.l.: sito istituzionale, contatti corporate, rimandi ai dettagli privacy dei SaaS LexAura (Legal Tech) e MediAura (Health Tech).', + heading: 'Informativa sulla privacy', + lead: + "Informativa quadro sul trattamento dei dati personali per il portale istituzionale NexStudio S.r.l., con sede legale in Italia, [INDIRIZZO_COMPLETO], e per i servizi SaaS LexAura e MediAura. L'informativa distingue il portale istituzionale NexStudio dai servizi SaaS LexAura e MediAura; le informative privacy specifiche dei singoli SaaS, pubblicate nei rispettivi portali applicativi, restano il riferimento di dettaglio per l'uso del prodotto.", + versionLabel: 'Versione', + inForceFromLabel: 'In vigore dal', + lastUpdateLabel: 'Ultimo aggiornamento', + relatedDocsLabel: 'Documenti connessi', + indexLabel: 'Indice', + }, }, - { - id: 'titolare', - title: "2. Identità del titolare e punti di contatto", - paragraphs: [ - "Titolare del trattamento: NexStudio S.r.l., con sede legale in Italia, [INDIRIZZO_COMPLETO], P.IVA [DA_INSERIRE].", - "Canali per richieste privacy:", - ], - bullets: [ - 'Email: privacy@nexstudio.com', - 'Form di contatto su nexstudio.ai', - 'Per i clienti SaaS: canali autenticati/ticket previsti nei rispettivi portali (LexAura, MediAura)', - ], - paragraphsAfterBullets: [ - 'Il Responsabile della Protezione dei Dati (DPO) è contattabile agli stessi recapiti.', - ], + en: { + document: { + version: '1.1', + inVigoreDal: '[DATA]', + ultimoAggiornamento: '[DATA]', + }, + crossReferences: { + lead: + 'This notice distinguishes the NexStudio institutional portal from the LexAura and MediAura SaaS services; the product-specific privacy notices published on the respective application portals remain the detailed reference for product use.', + }, + riferimenti: [ + { label: 'Terms of use', href: '/terms' }, + { label: 'Cookie policy', href: '/cookies' }, + { label: 'GDPR rights', href: '/gdpr' }, + ] as const, + sections: [ + { + id: 'ambito', + title: '1. Scope of this notice', + paragraphs: [ + 'This notice describes the general framework under which NexStudio S.r.l. processes personal data collected through the public institutional website and corporate channels (also linked to the LexAura and MediAura products).', + 'For operational use of the SaaS products, the level of detail and the privacy role may vary: NexStudio may act as controller, joint controller, or processor depending on the service and contractual agreements.', + 'In case of conflict between this page and a Data Processing Agreement (DPA), a framework agreement, or signed special terms, the contractual documents specific to the purchased service prevail.', + ], + }, + { + id: 'titolare', + title: '2. Controller identity and contact points', + paragraphs: [ + 'Data controller: NexStudio S.r.l., registered office in Italy, [INDIRIZZO_COMPLETO], VAT [DA_INSERIRE].', + 'Channels for privacy requests:', + ], + bullets: [ + 'Email: privacy@nexstudio.com', + 'Contact form on nexstudio.ai', + 'For SaaS customers: authenticated channels/tickets provided in the respective portals (LexAura, MediAura)', + ], + paragraphsAfterBullets: [ + 'The Data Protection Officer (DPO) can be contacted at the same addresses.', + ], + }, + { + id: 'categorie-dati', + title: '3. Categories of data processed', + paragraphs: [ + 'Data categories vary depending on the channel used and the active modules/features.', + ], + bullets: [ + 'NexStudio portal: browsing data (technical logs, IP, user agent), contact data submitted voluntarily (name, email, company, message content), cookie preferences, and aggregate metrics.', + 'LexAura (Legal Tech): account and user profile data, workspace metadata, legal documents uploaded or generated, text requests to analysis/summarization engines, audit logs of access and operations.', + 'MediAura (Health Tech): account and role data, organizational metadata, health or administrative documentation, voice inputs and related transcripts, technical and security logs.', + 'Special categories under Art. 9 GDPR: may arise in MediAura (and, in specific cases, in LexAura) when customers upload content including health data or other sensitive data; processing occurs only within the limits of the service and the instructions received from the customer controller.', + ], + }, + { + id: 'finalita-basi', + title: '4. Purposes and legal bases of processing', + paragraphs: [], + bullets: [ + 'Operation of the institutional website, security, and operational continuity (basis: legitimate interest in security, abuse prevention, and service maintenance).', + 'Handling of pre-contractual requests, demos, commercial contacts, and support (basis: pre-contractual measures at the data subject’s request; legitimate interest in B2B management).', + 'Provision of LexAura and MediAura SaaS, user authentication, tenant management, and technical support (basis: performance of the contract with the business customer).', + 'Regulatory compliance, administrative/tax obligations, dispute management, and defense of rights (basis: legal obligation and legitimate interest in legal protection).', + 'Marketing/newsletter communications, where active (basis: consent, subject to soft-spam exceptions permitted by applicable law).', + 'Service improvement and AI feature development: only if provided for by contract or documented instructions; absent such a basis, data are not used for general-purpose training.', + ], + }, + { + id: 'ruoli-saas', + title: '5. Privacy roles specific to LexAura and MediAura', + paragraphs: [ + 'For B2B SaaS services, the customer normally determines the purposes and means of processing relating to data uploaded into its application environment, acting as controller. NexStudio generally acts as processor on behalf of the customer, under contractual appointment and documented instructions.', + 'Where NexStudio independently determines specific purposes (e.g. fraud prevention, infrastructure security, aggregate metrics not attributable to an individual data subject), it acts as an independent controller for such processing.', + 'The dedicated LexAura and MediAura privacy notices, published on the respective sites or application environments, provide further detail on data categories, flows, retention periods, and legal bases specific to each product.', + ], + }, + { + id: 'conservazione', + title: '6. Retention periods', + paragraphs: [], + bullets: [ + 'Website contact data: 24 months from the last interaction.', + 'SaaS account data: for the entire duration of the contractual relationship + 30 days from deletion.', + 'Technical and security logs: maximum 30 days.', + 'Billing data: 10 years as required by Italian tax law.', + 'Health data: according to the controller (customer) instructions and legal obligations.', + 'Aggregate analytics data: indefinitely in anonymous form.', + ], + }, + { + id: 'destinatari', + title: '7. Recipients and categories of authorized parties', + paragraphs: [ + 'Data may be processed by authorized and instructed NexStudio personnel, as well as by qualified suppliers acting as processors/sub-processors (e.g. cloud hosting, infrastructure services, security monitoring, communication tools).', + 'The up-to-date list of processors and sub-processors relevant to SaaS customers is made available through contractual channels or upon request.', + ], + }, + { + id: 'trasferimenti', + title: '8. International data transfers', + paragraphs: [ + 'Due to the use of global cloud providers, some processing may involve transfers to countries outside the EEA/EU. Where required by law, NexStudio adopts appropriate safeguards (e.g. standard contractual clauses, supplementary technical/organizational measures, transfer impact assessments) and limits transfers to necessary data only.', + 'Data are preferably processed within the European Economic Area. Cloudflare Inc. adheres to the EU-US Data Privacy Framework and adopts Standard Contractual Clauses (SCCs).', + ], + }, + { + id: 'sicurezza', + title: '9. Security measures and governance', + paragraphs: [ + 'NexStudio adopts technical and organizational measures proportionate to the risk:', + ], + bullets: [ + 'Role-based access controls, authentication, logical segregation of customer environments, and the principle of least privilege.', + 'Encryption of data in transit (TLS 1.3) and at rest; secure key management.', + 'Logging, monitoring, audit trails, and incident management procedures.', + 'Backup, operational continuity, and disaster recovery procedures.', + ], + }, + { + id: 'diritti', + title: '10. Data subject rights and how to exercise them', + paragraphs: [ + 'Data subjects may exercise the rights provided by applicable law (access, rectification, erasure, restriction, objection, portability, withdrawal of consent, complaint to the competent authority).', + 'For data processed in the SaaS context, the request should normally be addressed first to the customer controller (e.g. law firm or healthcare organization). NexStudio supports the customer controller under contract.', + 'For data processed by NexStudio as controller (e.g. website contacts, its own security logs), requests may be sent to privacy@nexstudio.com or via the form on nexstudio.ai.', + 'Competent supervisory authority: Garante per la protezione dei dati personali (www.garanteprivacy.it).', + ], + }, + { + id: 'cookie-tracking', + title: '11. Cookies, analytics, and tracking', + paragraphs: [ + 'Information on technical cookies, any analytics cookies, and tracking tools is set out in the Cookie Policy, which should be read together with this notice.', + ], + }, + { + id: 'minori', + title: '12. Processing of children’s data', + paragraphs: [ + 'NexStudio services are designed for professional and business users. They are not intentionally directed at children.', + ], + }, + { + id: 'aggiornamenti', + title: '13. Policy updates', + paragraphs: [ + 'NexStudio may update this notice for regulatory adjustments, service evolution, organizational changes, or introduction of new features. Material changes will be published on this page with an updated version and date.', + ], + }, + ] as const satisfies readonly PrivacySection[], + page: { + title: 'Privacy — NexStudio', + description: + 'NexStudio S.r.l. framework privacy notice: institutional website, corporate contacts, and references to LexAura (Legal Tech) and MediAura (Health Tech) SaaS privacy details.', + heading: 'Privacy notice', + lead: + 'Framework notice on the processing of personal data for the institutional portal of NexStudio S.r.l., registered office in Italy, [INDIRIZZO_COMPLETO], and for the LexAura and MediAura SaaS services. This notice distinguishes the NexStudio institutional portal from the LexAura and MediAura SaaS services; the product-specific privacy notices published on the respective application portals remain the detailed reference for product use.', + versionLabel: 'Version', + inForceFromLabel: 'In force from', + lastUpdateLabel: 'Last updated', + relatedDocsLabel: 'Related documents', + indexLabel: 'Contents', + }, }, - { - id: 'categorie-dati', - title: '3. Categorie di dati trattati', - paragraphs: [ - "Le categorie di dati variano in funzione del canale utilizzato e dei moduli/feature attivi.", - ], - bullets: [ - "Portale NexStudio: dati di navigazione (log tecnici, IP, user agent), dati di contatto inviati volontariamente (nome, email, azienda, contenuto del messaggio), preferenze cookie e metriche aggregate.", - "LexAura (Legal Tech): dati di account e profilo utente, metadati di workspace, documenti giuridici caricati o generati, richieste testuali ai motori di analisi/sintesi, log di audit su accessi e operazioni.", - "MediAura (Health Tech): dati di account e ruoli, metadati organizzativi, documentazione sanitaria o amministrativa, input vocali e relative trascrizioni, log tecnici e di sicurezza.", - "Categorie particolari ex art. 9 GDPR: possono emergere in MediAura (e, in specifici casi, in LexAura) quando i clienti caricano contenuti che includono dati sanitari o altri dati sensibili; il trattamento avviene solo nei limiti del servizio e delle istruzioni ricevute dal cliente titolare.", - ], + th: { + document: { + version: '1.1', + inVigoreDal: '[DATA]', + ultimoAggiornamento: '[DATA]', + }, + crossReferences: { + lead: + 'ประกาศนี้แยกพอร์ทัลสถาบัน NexStudio จากบริการ SaaS LexAura และ MediAura ประกาศความเป็นส่วนตัวเฉพาะผลิตภัณฑ์ที่เผยแพร่บนพอร์ทัลแอปพลิเคชันที่เกี่ยวข้องยังคงเป็นเอกสารอ้างอิงรายละเอียดสำหรับการใช้ผลิตภัณฑ์', + }, + riferimenti: [ + { label: 'เงื่อนไขการใช้งาน', href: '/terms' }, + { label: 'นโยบายคุกกี้', href: '/cookies' }, + { label: 'สิทธิ GDPR', href: '/gdpr' }, + ] as const, + sections: [ + { + id: 'ambito', + title: '1. ขอบเขตของประกาศฉบับนี้', + paragraphs: [ + 'ประกาศฉบับนี้อธิบายกรอบทั่วไปที่ NexStudio S.r.l. ประมวลผลข้อมูลส่วนบุคคลที่เก็บรวบรวมผ่านเว็บไซต์สถาบันสาธารณะและช่องทางองค์กร (ซึ่งเชื่อมโยงกับผลิตภัณฑ์ LexAura และ MediAura ด้วย)', + 'สำหรับการใช้งาน SaaS ในทางปฏิบัติ ระดับรายละเอียดและบทบาทความเป็นส่วนตัวอาจแตกต่างกัน: NexStudio อาจทำหน้าที่เป็นผู้ควบคุม ผู้ควบคุมร่วม หรือผู้ประมวลผล ขึ้นอยู่กับบริการและข้อตกลงตามสัญญา', + 'หากเกิดความขัดแย้งระหว่างหน้านี้กับ Data Processing Agreement (DPA) สัญญากรอบ หรือเงื่อนไขพิเศษที่ลงนามแล้ว ให้ยึดเอกสารสัญญาเฉพาะของบริการที่ซื้อ', + ], + }, + { + id: 'titolare', + title: '2. ตัวตนของผู้ควบคุมและจุดติดต่อ', + paragraphs: [ + 'ผู้ควบคุมข้อมูล: NexStudio S.r.l. สำนักงานจดทะเบียนในอิตาลี [INDIRIZZO_COMPLETO] หมายเลขภาษีมูลค่าเพิ่ม [DA_INSERIRE]', + 'ช่องทางสำหรับคำขอความเป็นส่วนตัว:', + ], + bullets: [ + 'อีเมล: privacy@nexstudio.com', + 'แบบฟอร์มติดต่อบน nexstudio.ai', + 'สำหรับลูกค้า SaaS: ช่องทางที่ผ่านการยืนยันตัวตน/ตั๋วในพอร์ทัลที่เกี่ยวข้อง (LexAura, MediAura)', + ], + paragraphsAfterBullets: [ + 'เจ้าหน้าที่คุ้มครองข้อมูล (DPO) สามารถติดต่อได้ที่ที่อยู่เดียวกัน', + ], + }, + { + id: 'categorie-dati', + title: '3. ประเภทข้อมูลที่ประมวลผล', + paragraphs: [ + 'ประเภทข้อมูลแตกต่างกันตามช่องทางที่ใช้และโมดูล/ฟีเจอร์ที่เปิดใช้งาน', + ], + bullets: [ + 'พอร์ทัล NexStudio: ข้อมูลการท่องเว็บ (ล็อกทางเทคนิค IP user agent) ข้อมูลติดต่อที่ส่งโดยสมัครใจ (ชื่อ อีเมล บริษัท เนื้อหาข้อความ) การตั้งค่าคุกกี้ และเมตริกรวม', + 'LexAura (Legal Tech): ข้อมูลบัญชีและโปรไฟล์ผู้ใช้ เมทาดาทาของ workspace เอกสารกฎหมายที่อัปโหลดหรือสร้าง คำขอข้อความไปยังเอนจินวิเคราะห์/สรุป ล็อกการตรวจสอบการเข้าถึงและการดำเนินการ', + 'MediAura (Health Tech): ข้อมูลบัญชีและบทบาท เมทาดาทาองค์กร เอกสารด้านสุขภาพหรือธุรการ อินพุตเสียงและใบถอดเสียงที่เกี่ยวข้อง ล็อกทางเทคนิคและความปลอดภัย', + 'ประเภทพิเศษตามมาตรา 9 GDPR: อาจเกิดขึ้นใน MediAura (และในบางกรณีใน LexAura) เมื่อลูกค้าอัปโหลดเนื้อหาที่มีข้อมูลสุขภาพหรือข้อมูลอ่อนไหวอื่น การประมวลผลเกิดขึ้นเฉพาะในขอบเขตของบริการและตามคำสั่งที่ได้รับจากลูกค้าผู้ควบคุม', + ], + }, + { + id: 'finalita-basi', + title: '4. วัตถุประสงค์และฐานทางกฎหมายของการประมวลผล', + paragraphs: [], + bullets: [ + 'การจัดการเว็บไซต์สถาบัน ความปลอดภัย และความต่อเนื่องในการดำเนินงาน (ฐาน: ประโยชน์โดยชอบด้วยกฎหมายด้านความปลอดภัย การป้องกันการใช้ในทางที่ผิด และการรักษบริการ)', + 'การจัดการคำขอก่อนสัญญา การสาธิต การติดต่อเชิงพาณิชย์ และการสนับสนุน (ฐาน: มาตรการก่อนสัญญาตามคำขอของเจ้าของข้อมูล; ประโยชน์โดยชอบด้วยกฎหมายในการจัดการ B2B)', + 'การให้บริการ SaaS LexAura และ MediAura การยืนยันตัวตนผู้ใช้ การจัดการเทแนนท์ และการสนับสนุนทางเทคนิค (ฐาน: การปฏิบัติตามสัญญากับลูกค้าธุรกิจ)', + 'การปฏิบัติตามข้อกำกับ ภาระผูกพันด้านการบริหาร/ภาษี การจัดการข้อพิพาท และการป้องกันสิทธิ (ฐาน: ข้อผูกพันทางกฎหมายและประโยชน์โดยชอบด้วยกฎหมายในการคุ้มครองทางคดี)', + 'การสื่อสารการตลาด/จดหมายข่าว หากเปิดใช้งาน (ฐาน: ความยินยอม เว้นแต่ข้อยกเว้น soft spam ที่กฎหมายอนุญาต)', + 'การปรับปรุงบริการและการพัฒนาฟีเจอร์ AI: เฉพาะเมื่อสัญญาหรือคำสั่งที่เป็นลายลักษณ์อักษรกำหนดไว้ หากไม่มีฐานดังกล่าว จะไม่ใช้ข้อมูลเพื่อการฝึกโมเดลทั่วไป', + ], + }, + { + id: 'ruoli-saas', + title: '5. บทบาทความเป็นส่วนตัวเฉพาะสำหรับ LexAura และ MediAura', + paragraphs: [ + 'สำหรับบริการ SaaS แบบ B2B โดยปกติลูกค้าเป็นผู้กำหนดวัตถุประสงค์และวิธีการประมวลผลที่เกี่ยวข้องกับข้อมูลที่อัปโหลดในสภาพแวดล้อมแอปพลิเคชันของตน โดยทำหน้าที่เป็นผู้ควบคุม NexStudio โดยทั่วไปทำหน้าที่เป็นผู้ประมวลผลในนามของลูกค้า ตามการแต่งตั้งตามสัญญาและคำสั่งที่เป็นลายลักษณ์อักษร', + 'หาก NexStudio กำหนดวัตถุประสงค์เฉพาะด้วยตนเอง (เช่น การป้องกันการฉ้อโกง ความปลอดภัยโครงสร้างพื้นฐาน เมตริกรวมที่ไม่สามารถโยงไปยังเจ้าของข้อมูลรายบุคคล) จะทำหน้าที่เป็นผู้ควบคุมอิสระสำหรับการประมวลผลดังกล่าว', + 'ประกาศความเป็นส่วนตัวเฉพาะของ LexAura และ MediAura ที่เผยแพร่บนไซต์หรือสภาพแวดล้อมแอปพลิเคชันที่เกี่ยวข้อง จะให้รายละเอียดเพิ่มเติมเกี่ยวกับประเภทข้อมูล กระแสข้อมูล ระยะเวลาเก็บรักษา และฐานทางกฎหมายเฉพาะของแต่ละผลิตภัณฑ์', + ], + }, + { + id: 'conservazione', + title: '6. ระยะเวลาเก็บรักษา', + paragraphs: [], + bullets: [ + 'ข้อมูลติดต่อจากเว็บไซต์: 24 เดือนนับจากการโต้ตอบครั้งล่าสุด', + 'ข้อมูลบัญชี SaaS: ตลอดระยะเวลาความสัมพันธ์ตามสัญญา + 30 วันนับจากการลบ', + 'ล็อกทางเทคนิคและความปลอดภัย: สูงสุด 30 วัน', + 'ข้อมูลการเรียกเก็บเงิน: 10 ปีตามที่กฎหมายภาษีอิตาลีกำหนด', + 'ข้อมูลสุขภาพ: ตามคำสั่งของผู้ควบคุม (ลูกค้า) และข้อผูกพันทางกฎหมาย', + 'ข้อมูลวิเคราะห์แบบรวม: ไม่มีกำหนดในรูปแบบนิรนาม', + ], + }, + { + id: 'destinatari', + title: '7. ผู้รับและประเภทของผู้ที่ได้รับอนุญาต', + paragraphs: [ + 'ข้อมูลอาจถูกประมวลผลโดยบุคลากร NexStudio ที่ได้รับอนุญาตและคำแนะนำ รวมถึงผู้ให้บริการที่มีคุณสมบัติซึ่งทำหน้าที่เป็นผู้ประมวลผล/ผู้ประมวลผลช่วง (เช่น การโฮสต์คลาวด์ บริการโครงสร้างพื้นฐาน การตรวจสอบความปลอดภัย เครื่องมือสื่อสาร)', + 'รายชื่อผู้ประมวลผลและผู้ประมวลผลช่วงที่เกี่ยวข้องกับลูกค้า SaaS ที่เป็นปัจจุบัน จะจัดให้ผ่านช่องทางตามสัญญาหรือตามคำขอ', + ], + }, + { + id: 'trasferimenti', + title: '8. การโอนข้อมูลระหว่างประเทศ', + paragraphs: [ + 'เนื่องจากการใช้ผู้ให้บริการคลาวด์ระดับโลก การประมวลผลบางส่วนอาจเกี่ยวข้องกับการโอนไปยังประเทศนอก EEA/EU เมื่อกฎหมายกำหนด NexStudio จะใช้การคุ้มครองที่เหมาะสม (เช่น ข้อสัญญามาตรฐาน มาตรการทางเทคนิค/องค์กรเสริม การประเมินผลกระทบการโอน) และจำกัดการโอนเฉพาะข้อมูลที่จำเป็น', + 'ข้อมูลจะถูกประมวลผลในเขตเศรษฐกิจยุโรปเป็นหลัก Cloudflare Inc. ปฏิบัติตาม EU-US Data Privacy Framework และใช้ Standard Contractual Clauses (SCC)', + ], + }, + { + id: 'sicurezza', + title: '9. มาตรการความปลอดภัยและการกำกับดูแล', + paragraphs: [ + 'NexStudio ใช้มาตรการทางเทคนิคและองค์กรที่สัดส่วนกับความเสี่ยง:', + ], + bullets: [ + 'การควบคุมการเข้าถึงตามบทบาท การยืนยันตัวตน การแยกสภาพแวดล้อมลูกค้าเชิงตรรกะ และหลักการสิทธิ์น้อยที่สุด', + 'การเข้ารหัสข้อมูลระหว่างส่ง (TLS 1.3) และขณะเก็บรักษา การจัดการคีย์อย่างปลอดภัย', + 'การบันทึกล็อก การตรวจสอบ เส้นทางการตรวจสอบ และกระบวนการจัดการเหตุการณ์', + 'กระบวนการสำรองข้อมูล ความต่อเนื่องในการดำเนินงาน และการกู้คืนจากภัยพิบัติ', + ], + }, + { + id: 'diritti', + title: '10. สิทธิของเจ้าของข้อมูลและวิธีการใช้สิทธิ', + paragraphs: [ + 'เจ้าของข้อมูลอาจใช้สิทธิตามกฎหมายที่ใช้บังคับ (เข้าถึง แก้ไข ลบ จำกัด คัดค้าน โอนย้าย ถอนความยินยอม ร้องเรียนต่อหน่วยงานที่มีอำนาจ)', + 'สำหรับข้อมูลที่ประมวลผลในบริบท SaaS โดยปกติควรร้องขอไปยังลูกค้าผู้ควบคุมก่อน (เช่น สำนักงานกฎหมายหรือองค์กรด้านสุขภาพ) NexStudio สนับสนุนลูกค้าผู้ควบคุมตามสัญญา', + 'สำหรับข้อมูลที่ NexStudio ประมวลผลในฐานะผู้ควบคุม (เช่น ข้อมูลติดต่อจากเว็บไซต์ ล็อกความปลอดภัยของตนเอง) สามารถส่งคำขอไปที่ privacy@nexstudio.com หรือผ่านแบบฟอร์มบน nexstudio.ai', + 'หน่วยงานกำกับดูแลที่มีอำนาจ: Garante per la protezione dei dati personali (www.garanteprivacy.it)', + ], + }, + { + id: 'cookie-tracking', + title: '11. คุกกี้ การวิเคราะห์ และการติดตาม', + paragraphs: [ + 'ข้อมูลเกี่ยวกับคุกกี้ทางเทคนิค คุกกี้เชิงวิเคราะห์ (หากมี) และเครื่องมือติดตาม ระบุไว้ในนโยบายคุกกี้ ซึ่งควรอ่านร่วมกับประกาศฉบับนี้', + ], + }, + { + id: 'minori', + title: '12. การประมวลผลข้อมูลของผู้เยาว์', + paragraphs: [ + 'บริการของ NexStudio ออกแบบมาสำหรับผู้ใช้ระดับมืออาชีพและธุรกิจ ไม่ได้มุ่งเป้าไปที่ผู้เยาว์โดยเจตนา', + ], + }, + { + id: 'aggiornamenti', + title: '13. การอัปเดตนโยบาย', + paragraphs: [ + 'NexStudio อาจอัปเดตประกาศนี้เพื่อปรับตามข้อกำกับ การพัฒนาบริการ การเปลี่ยนแปลงองค์กร หรือการนำฟีเจอร์ใหม่มาใช้ การเปลี่ยนแปลงที่มีนัยสำคัญจะเผยแพร่บนหน้านี้พร้อมอัปเดตเวอร์ชันและวันที่', + ], + }, + ] as const satisfies readonly PrivacySection[], + page: { + title: 'Privacy — NexStudio', + description: + 'ประกาศความเป็นส่วนตัวกรอบของ NexStudio S.r.l.: เว็บไซต์สถาบัน การติดต่อองค์กร และการอ้างอิงรายละเอียดความเป็นส่วนตัวของ SaaS LexAura (Legal Tech) และ MediAura (Health Tech)', + heading: 'ประกาศความเป็นส่วนตัว', + lead: + 'ประกาศกรอบเกี่ยวกับการประมวลผลข้อมูลส่วนบุคคลสำหรับพอร์ทัลสถาบันของ NexStudio S.r.l. สำนักงานจดทะเบียนในอิตาลี [INDIRIZZO_COMPLETO] และสำหรับบริการ SaaS LexAura และ MediAura ประกาศนี้แยกพอร์ทัลสถาบัน NexStudio จากบริการ SaaS LexAura และ MediAura ประกาศความเป็นส่วนตัวเฉพาะผลิตภัณฑ์ที่เผยแพร่บนพอร์ทัลแอปพลิเคชันที่เกี่ยวข้องยังคงเป็นเอกสารอ้างอิงรายละเอียดสำหรับการใช้ผลิตภัณฑ์', + versionLabel: 'เวอร์ชัน', + inForceFromLabel: 'มีผลตั้งแต่', + lastUpdateLabel: 'อัปเดตล่าสุด', + relatedDocsLabel: 'เอกสารที่เกี่ยวข้อง', + indexLabel: 'สารบัญ', + }, }, - { - id: 'finalita-basi', - title: '4. Finalità e basi giuridiche del trattamento', - paragraphs: [], - bullets: [ - "Gestione del sito istituzionale, sicurezza e continuità operativa (base: legittimo interesse alla sicurezza, prevenzione abusi e mantenimento del servizio).", - "Gestione richieste pre-contrattuali, demo, contatti commerciali e supporto (base: misure precontrattuali su richiesta dell'interessato; legittimo interesse nella gestione B2B).", - "Erogazione dei SaaS LexAura e MediAura, autenticazione utenti, gestione tenant e assistenza tecnica (base: esecuzione del contratto con il cliente business).", - "Conformità normativa, adempimenti amministrativi/fiscali, gestione contenziosi e difesa di diritti (base: obbligo legale e legittimo interesse alla tutela in giudizio).", - "Comunicazioni marketing/newsletter, ove attive (base: consenso, salvo eccezioni di soft spam consentite dalla normativa applicabile).", - "Miglioramento del servizio e sviluppo funzionalità IA: solo se previsto dal contratto o da istruzioni documentate; in assenza di tale base i dati non sono utilizzati per training generalista.", - ], - }, - { - id: 'ruoli-saas', - title: '5. Ruoli privacy specifici per LexAura e MediAura', - paragraphs: [ - "Per i servizi SaaS B2B, il cliente determina normalmente finalità e mezzi del trattamento relativi ai dati caricati nel proprio ambiente applicativo, agendo come titolare del trattamento. NexStudio agisce di regola come responsabile del trattamento per conto del cliente, con nomina contrattuale e istruzioni documentate.", - "Qualora NexStudio determini autonomamente finalità specifiche (es. prevenzione frodi, sicurezza infrastrutturale, metriche aggregate non riconducibili al singolo interessato), agisce come titolare autonomo per tali trattamenti.", - "Le informative privacy dedicate di LexAura e MediAura, pubblicate nei rispettivi siti o ambienti applicativi, approfondiscono categorie dati, flussi, tempi di retention e basi giuridiche specifiche del singolo prodotto.", - ], - }, - { - id: 'conservazione', - title: '6. Tempi di conservazione', - paragraphs: [], - bullets: [ - "Dati di contatto dal sito: 24 mesi dall'ultima interazione.", - "Dati di account SaaS: per tutta la durata del rapporto contrattuale + 30 giorni dalla cancellazione.", - "Log tecnici e di sicurezza: massimo 30 giorni.", - "Dati di fatturazione: 10 anni come richiesto dalla normativa fiscale italiana.", - "Dati sanitari: secondo le istruzioni del titolare (cliente) e gli obblighi di legge.", - "Dati analitici aggregati: indefinitamente in forma anonima.", - ], - }, - { - id: 'destinatari', - title: '7. Destinatari e categorie di soggetti autorizzati', - paragraphs: [ - "I dati possono essere trattati da personale NexStudio autorizzato e istruito, nonché da fornitori qualificati che operano come responsabili/sub-responsabili (es. hosting cloud, servizi infrastrutturali, monitoraggio sicurezza, strumenti di comunicazione).", - "L'elenco aggiornato dei responsabili e sub-responsabili rilevanti per i clienti SaaS è messo a disposizione nei canali contrattuali o su richiesta.", - ], - }, - { - id: 'trasferimenti', - title: '8. Trasferimenti internazionali di dati', - paragraphs: [ - "In ragione dell'uso di fornitori cloud globali, alcuni trattamenti possono comportare trasferimenti verso Paesi extra SEE/UE. Quando richiesto dalla normativa, NexStudio adotta garanzie adeguate (es. clausole contrattuali standard, misure supplementari tecniche/organizzative, valutazioni di impatto sul trasferimento) e limita il trasferimento ai soli dati necessari.", - "I dati sono preferibilmente trattati nello Spazio Economico Europeo. Cloudflare Inc. aderisce al Data Privacy Framework UE-USA e adotta Clausole Contrattuali Standard (SCC).", - ], - }, - { - id: 'sicurezza', - title: '9. Misure di sicurezza e governance', - paragraphs: [ - "NexStudio adotta misure tecniche e organizzative proporzionate al rischio:", - ], - bullets: [ - "Controlli di accesso basati su ruoli, autenticazione, segregazione logica degli ambienti cliente e principio del minimo privilegio.", - "Cifratura dei dati in transito (TLS 1.3) e a riposo; gestione sicura delle chiavi.", - "Logging, monitoraggio, audit trail e procedure di gestione incidenti.", - "Procedure di backup, continuità operativa e disaster recovery.", - ], - }, - { - id: 'diritti', - title: "10. Diritti degli interessati e modalità di esercizio", - paragraphs: [ - "Gli interessati possono esercitare i diritti previsti dalla normativa applicabile (accesso, rettifica, cancellazione, limitazione, opposizione, portabilità, revoca del consenso, reclamo all'autorità competente).", - "Per dati trattati nel contesto dei SaaS, la richiesta va di norma indirizzata prima al cliente titolare (es. studio legale o struttura sanitaria). NexStudio fornisce supporto al cliente titolare secondo contratto.", - "Per dati trattati da NexStudio come titolare (es. contatti dal sito, log di sicurezza propri), le richieste possono essere inviate a privacy@nexstudio.com o tramite il form su nexstudio.ai.", - "Autorità di controllo competente: Garante per la protezione dei dati personali (www.garanteprivacy.it).", - ], - }, - { - id: 'cookie-tracking', - title: '11. Cookie, analytics e tracciamenti', - paragraphs: [ - "Le informazioni su cookie tecnici, eventuali cookie analitici e strumenti di tracciamento sono descritte nella Cookie Policy, da leggere congiuntamente alla presente informativa.", - ], - }, - { - id: 'minori', - title: '12. Trattamento dati di minori', - paragraphs: [ - "I servizi NexStudio sono progettati per un'utenza professionale e business. Non sono rivolti intenzionalmente a minori.", - ], - }, - { - id: 'aggiornamenti', - title: '13. Aggiornamenti della policy', - paragraphs: [ - "NexStudio può aggiornare questa informativa per adeguamenti normativi, evoluzione dei servizi, modifiche organizzative o introduzione di nuove funzionalità. Le modifiche rilevanti saranno pubblicate su questa pagina con aggiornamento di versione e data.", - ], - }, -] as const; +} as const; + +export const getPrivacy = (locale: SupportedLocale) => privacyByLocale[locale]; + +/** Retro-compatibilità: fallback italiano. */ +export const privacyDocument = privacyByLocale.it.document; +export const privacyCrossReferences = privacyByLocale.it.crossReferences; +export const privacyRiferimenti = privacyByLocale.it.riferimenti; +export const privacySections = privacyByLocale.it.sections; diff --git a/src/data/terms.ts b/src/data/terms.ts index 03fc2d7..708b769 100644 --- a/src/data/terms.ts +++ b/src/data/terms.ts @@ -3,10 +3,7 @@ * I contratti B2B su LexAura, MediAura o servizi professionali restano strumenti separati. * Aggiornare versione e data in sync con la pagina (box in testa). */ -export const termsDocument = { - version: '1.1', - inVigoreDal: '[DATA]', -} as const; +import type { SupportedLocale } from './home/navigation'; export type TermsSection = { id: string; @@ -15,96 +12,343 @@ export type TermsSection = { bullets?: readonly string[]; }; -export const termsSections: readonly TermsSection[] = [ - { - id: 'premessa', - title: '1. Premessa e ambito', - paragraphs: [ - "Le presenti condizioni d’uso regolano l’accesso e la consultazione del sito web di NexStudio S.r.l. (di seguito «NexStudio», «noi»), con sede legale in Italia, [INDIRIZZO_COMPLETO]. I servizi software commerciali (inclusi i prodotti LexAura e MediAura) sono regolati da condizioni generali, ordini, offerte o accordi specifici sottoscritti con i clienti: in caso di conflitto tra il presente testo e un contratto B2B sottoscritto, prevalgono i documenti specifici del servizio e gli accordi contrattuali applicabili.", - "Per il trattamento dei dati personali e i cookie si rimanda rispettivamente all’informativa privacy e alla cookie policy, citate più sotto.", - ], +const termsByLocale = { + it: { + document: { + version: '1.1', + inVigoreDal: '[DATA]', + }, + crossReferences: { + leadNote: + 'Per LexAura e MediAura, le informative privacy dedicate pubblicate sui rispettivi portali SaaS restano il riferimento di dettaglio del singolo prodotto.', + }, + riferimenti: [ + { label: 'Informativa privacy', href: '/privacy' }, + { label: 'Cookie policy', href: '/cookies' }, + { label: 'Diritti GDPR', href: '/gdpr' }, + { label: 'Codice etico', href: '/codice-etico' }, + ] as const, + sections: [ + { + id: 'premessa', + title: '1. Premessa e ambito', + paragraphs: [ + "Le presenti condizioni d’uso regolano l’accesso e la consultazione del sito web di NexStudio S.r.l. (di seguito «NexStudio», «noi»), con sede legale in Italia, [INDIRIZZO_COMPLETO]. I servizi software commerciali (inclusi i prodotti LexAura e MediAura) sono regolati da condizioni generali, ordini, offerte o accordi specifici sottoscritti con i clienti: in caso di conflitto tra il presente testo e un contratto B2B sottoscritto, prevalgono i documenti specifici del servizio e gli accordi contrattuali applicabili.", + 'Per il trattamento dei dati personali e i cookie si rimanda rispettivamente all’informativa privacy e alla cookie policy, citate più sotto.', + ], + }, + { + id: 'accettazione', + title: '2. Accettazione e requisiti', + paragraphs: [ + 'L’utilizzo del sito (navigazione oltre la mera apertura della home, invio di moduli ove presenti, uso di strumenti di contatto) implica la conoscenza e l’accettazione delle presenti condizioni e della versione in vigore della privacy policy e, ove applicabile, della cookie policy.', + 'L’utente dichiara di avere l’età e la capacità legale per vincolarsi, o di agire sotto la responsabilità di un rappresentante legale idoneo.', + ], + }, + { + id: 'servizi', + title: '3. Contenuti e servizi informativi', + paragraphs: [ + 'Il sito ha finalità promozionali e informative su NexStudio, sui prodotti e sull’organizzazione. Le descrizioni, schermate, esempi e roadmap non costituiscono offerta vincolante né promessa di feature: restano subordinati a contrattualizzazione, disponibilità tecnica e condizioni di mercato.', + 'NexStudio si impegna a mantenere le informazioni ragionevolmente aggiornate, senza obbligo di esaustività o di aggiornamento in tempo reale. Può modificare, sospendere o limitare l’accesso a sezioni del sito per manutenzione, sicurezza o evoluzione del prodotto.', + ], + }, + { + id: 'uso-lecito', + title: '4. Uso lecito del sito', + paragraphs: [ + 'L’utente si impegna a usare il sito in conformità a legge, buona fede e condotta professionale, in particolare a:', + ], + bullets: [ + 'non introdurre malware, né tentare di eludere misure di sicurezza, né effettuare attività che sovraccaricano in modo abnorme o automatizzato non autorizzato l’infrastruttura;', + 'non copiare o sfruttare illecitamente i contenuti (cfr. sotto proprietà intellettuale) né impersonare NexStudio o terzi;', + 'non usare canali di contatto per contenuti illeciti, diffamatori, spam o al di fuori delle finalità richieste (commerciale, supporto, segnalazioni, ecc.).', + ], + }, + { + id: 'proprieta', + title: '5. Proprietà intellettuale', + paragraphs: [ + 'Testi, logotipi, elementi grafici, layout, nomi di prodotto (inclusi LexAura e MediAura) e, ove presenti, software dimostrativo o materiali scaricabili, sono protetti dalle norme sul diritto d’autore e dalle norme sui marchi applicabili. È vietata la riproduzione, distribuzione o modifica non espressamente autorizzata, salvo uso consentito per legge (citazione, breve estratto con attribuzione) o espressa deroga scritta.', + ], + }, + { + id: 'terze-parti', + title: '6. Link, servizi di terzi e strumenti incorporati', + paragraphs: [ + 'Il sito può contenere collegamenti a siti o servizi di terzi. NexStudio non controlla tali risorse e non risponde dei loro contenuti o politiche; l’accesso avviene sotto la responsabilità dell’utente, che dovrà leggere le condizioni e l’informativa privacy del terzo.', + ], + }, + { + id: 'responsabilita', + title: '7. Limitazione di responsabilità', + paragraphs: [ + 'Nella misura massima consentita dalla legge applicabile, il sito e i suoi contenuti sono forniti «così come sono» e «secondo disponibilità», senza garanzie implicite di adeguatezza a un fine particolare, non interruzione o assenza di errori. Il materiale informativo non sostituisce consulenza legale, sanitaria o professionale: decisioni e responsabilità restano a carico del visitatore o del professionista e dei propri clienti.', + 'NexStudio non risponde per danni indiretti, consequenziali, mancati guadagni, perdita di dati, interruzioni, azioni di terzi o fatti oltre il controllo ragionevole, salvo quanto non possa essere escluso o limitato per legge imperativa.', + ], + }, + { + id: 'sospensione', + title: '8. Sospensione, violazione e forza maggiore', + paragraphs: [ + 'NexStudio può sospendere, limitare o interrompere l’accesso in caso di violazione delle presenti condizioni, rischio per la sicurezza, ordini di autorità, o forza maggiore. La mancata esecuzione in tali casi non costituisce inadempimento a titolo di danno.', + ], + }, + { + id: 'legge', + title: '9. Legge applicabile e foro competente', + paragraphs: [ + 'Salvo disposizioni inderogabili a tutela del consumatore, le presenti condizioni e ogni contestazione inerente al sito informativo sono regolate dalla legge italiana. Il foro competente è Padova.', + ], + }, + { + id: 'contatti-termini', + title: '10. Contatti in merito a queste condizioni', + paragraphs: [ + 'Per domande sulle presenti condizioni d’uso del sito, utilizzare i canali indicati nella sezione contatti del sito. Per trattamento dei dati personali e diritti: privacy@nexstudio.com o il form su nexstudio.ai.', + ], + }, + ] as const satisfies readonly TermsSection[], + page: { + title: 'Condizioni d’uso — NexStudio', + description: + 'Condizioni d’uso del sito web NexStudio S.r.l.: accettazione, utilizzo lecito, responsabilità, legge italiana e foro di Padova. LexAura e MediAura, servizi B2B per contratto a parte.', + heading: 'Condizioni d’uso', + lead: + "Si applicano alla navigazione e all'uso del sito informativo pubblico di NexStudio S.r.l., con sede legale in Italia, [INDIRIZZO_COMPLETO]. I contratti d'abbonamento o d'acquisto sui prodotti software restano retti da offerte, ordini o accordi separati. Per LexAura e MediAura, le informative privacy dedicate pubblicate sui rispettivi portali SaaS restano il riferimento di dettaglio del singolo prodotto.", + versionLabel: 'Versione', + inForceFromLabel: 'In vigore dal', + lastUpdateLabel: 'Ultimo aggiornamento', + relatedDocsLabel: 'Documenti connessi', + indexLabel: 'Indice', + }, }, - { - id: 'accettazione', - title: '2. Accettazione e requisiti', - paragraphs: [ - "L’utilizzo del sito (navigazione oltre la mera apertura della home, invio di moduli ove presenti, uso di strumenti di contatto) implica la conoscenza e l’accettazione delle presenti condizioni e della versione in vigore della privacy policy e, ove applicabile, della cookie policy.", - "L’utente dichiara di avere l’età e la capacità legale per vincolarsi, o di agire sotto la responsabilità di un rappresentante legale idoneo.", - ], + en: { + document: { + version: '1.1', + inVigoreDal: '[DATA]', + }, + crossReferences: { + leadNote: + 'For LexAura and MediAura, the dedicated privacy notices published on the respective SaaS portals remain the detailed reference for each product.', + }, + riferimenti: [ + { label: 'Privacy notice', href: '/privacy' }, + { label: 'Cookie policy', href: '/cookies' }, + { label: 'GDPR rights', href: '/gdpr' }, + { label: 'Code of ethics', href: '/codice-etico' }, + ] as const, + sections: [ + { + id: 'premessa', + title: '1. Preamble and scope', + paragraphs: [ + 'These terms of use govern access to and consultation of the website of NexStudio S.r.l. (hereinafter “NexStudio”, “we”), with registered office in Italy, [INDIRIZZO_COMPLETO]. Commercial software services (including the LexAura and MediAura products) are governed by general terms, orders, offers, or specific agreements entered into with customers: in case of conflict between this text and a signed B2B contract, the service-specific documents and applicable contractual agreements prevail.', + 'For the processing of personal data and cookies, reference is made respectively to the privacy notice and the cookie policy cited below.', + ], + }, + { + id: 'accettazione', + title: '2. Acceptance and requirements', + paragraphs: [ + 'Use of the site (browsing beyond merely opening the home page, submitting forms where present, using contact tools) implies knowledge and acceptance of these terms and of the privacy policy in force and, where applicable, the cookie policy.', + 'The user declares that they have the age and legal capacity to be bound, or that they act under the responsibility of a suitable legal representative.', + ], + }, + { + id: 'servizi', + title: '3. Informational content and services', + paragraphs: [ + 'The site has promotional and informational purposes regarding NexStudio, its products, and its organization. Descriptions, screenshots, examples, and roadmaps do not constitute a binding offer or a promise of features: they remain subject to contracting, technical availability, and market conditions.', + 'NexStudio undertakes to keep information reasonably up to date, without any obligation of exhaustiveness or real-time updates. It may modify, suspend, or restrict access to sections of the site for maintenance, security, or product evolution.', + ], + }, + { + id: 'uso-lecito', + title: '4. Lawful use of the site', + paragraphs: [ + 'The user undertakes to use the site in accordance with law, good faith, and professional conduct, in particular to:', + ], + bullets: [ + 'not introduce malware, attempt to circumvent security measures, or carry out activities that abnormally overload or involve unauthorized automation of the infrastructure;', + 'not copy or unlawfully exploit content (see intellectual property below) or impersonate NexStudio or third parties;', + 'not use contact channels for unlawful, defamatory, or spam content, or outside the requested purposes (commercial, support, reports, etc.).', + ], + }, + { + id: 'proprieta', + title: '5. Intellectual property', + paragraphs: [ + 'Texts, logos, graphic elements, layout, product names (including LexAura and MediAura) and, where present, demo software or downloadable materials are protected by applicable copyright and trademark laws. Reproduction, distribution, or modification not expressly authorized is prohibited, except for use permitted by law (citation, short excerpt with attribution) or an express written waiver.', + ], + }, + { + id: 'terze-parti', + title: '6. Links, third-party services, and embedded tools', + paragraphs: [ + 'The site may contain links to third-party sites or services. NexStudio does not control such resources and is not responsible for their content or policies; access is at the user’s responsibility, who must read the third party’s terms and privacy notice.', + ], + }, + { + id: 'responsabilita', + title: '7. Limitation of liability', + paragraphs: [ + 'To the maximum extent permitted by applicable law, the site and its contents are provided “as is” and “as available”, without implied warranties of fitness for a particular purpose, uninterrupted availability, or absence of errors. Informational material does not replace legal, healthcare, or professional advice: decisions and responsibility remain with the visitor or the professional and their own clients.', + 'NexStudio is not liable for indirect, consequential damages, lost profits, data loss, interruptions, third-party actions, or events beyond reasonable control, except where exclusion or limitation is not permitted by mandatory law.', + ], + }, + { + id: 'sospensione', + title: '8. Suspension, breach, and force majeure', + paragraphs: [ + 'NexStudio may suspend, restrict, or interrupt access in case of breach of these terms, security risk, orders of authorities, or force majeure. Non-performance in such cases does not constitute a breach giving rise to damages.', + ], + }, + { + id: 'legge', + title: '9. Governing law and competent court', + paragraphs: [ + 'Save for mandatory provisions protecting consumers, these terms and any dispute relating to the informational site are governed by Italian law. The competent court is Padua.', + ], + }, + { + id: 'contatti-termini', + title: '10. Contacts regarding these terms', + paragraphs: [ + 'For questions about these website terms of use, use the channels indicated in the contacts section of the site. For personal data processing and rights: privacy@nexstudio.com or the form on nexstudio.ai.', + ], + }, + ] as const satisfies readonly TermsSection[], + page: { + title: 'Terms of use — NexStudio', + description: + 'Terms of use of the NexStudio S.r.l. website: acceptance, lawful use, liability, Italian law and Padua court. LexAura and MediAura B2B services under separate contract.', + heading: 'Terms of use', + lead: + 'These terms apply to browsing and use of the public informational website of NexStudio S.r.l., registered office in Italy, [INDIRIZZO_COMPLETO]. Subscription or purchase contracts for software products remain governed by separate offers, orders, or agreements. For LexAura and MediAura, the dedicated privacy notices published on the respective SaaS portals remain the detailed reference for each product.', + versionLabel: 'Version', + inForceFromLabel: 'In force from', + lastUpdateLabel: 'Last updated', + relatedDocsLabel: 'Related documents', + indexLabel: 'Contents', + }, }, - { - id: 'servizi', - title: '3. Contenuti e servizi informativi', - paragraphs: [ - "Il sito ha finalità promozionali e informative su NexStudio, sui prodotti e sull’organizzazione. Le descrizioni, schermate, esempi e roadmap non costituiscono offerta vincolante né promessa di feature: restano subordinati a contrattualizzazione, disponibilità tecnica e condizioni di mercato.", - "NexStudio si impegna a mantenere le informazioni ragionevolmente aggiornate, senza obbligo di esaustività o di aggiornamento in tempo reale. Può modificare, sospendere o limitare l’accesso a sezioni del sito per manutenzione, sicurezza o evoluzione del prodotto.", - ], + th: { + document: { + version: '1.1', + inVigoreDal: '[DATA]', + }, + crossReferences: { + leadNote: + 'สำหรับ LexAura และ MediAura ประกาศความเป็นส่วนตัวเฉพาะที่เผยแพร่บนพอร์ทัล SaaS ที่เกี่ยวข้องยังคงเป็นเอกสารอ้างอิงรายละเอียดของแต่ละผลิตภัณฑ์', + }, + riferimenti: [ + { label: 'ประกาศความเป็นส่วนตัว', href: '/privacy' }, + { label: 'นโยบายคุกกี้', href: '/cookies' }, + { label: 'สิทธิ GDPR', href: '/gdpr' }, + { label: 'จรรยาบรรณ', href: '/codice-etico' }, + ] as const, + sections: [ + { + id: 'premessa', + title: '1. คำนำและขอบเขต', + paragraphs: [ + 'เงื่อนไขการใช้งานฉบับนี้กำกับดูแลการเข้าถึงและการดูเว็บไซต์ของ NexStudio S.r.l. (ต่อไปนี้เรียก «NexStudio» «เรา») สำนักงานจดทะเบียนในอิตาลี [INDIRIZZO_COMPLETO] บริการซอฟต์แวร์เชิงพาณิชย์ (รวมถึงผลิตภัณฑ์ LexAura และ MediAura) อยู่ภายใต้เงื่อนไขทั่วไป คำสั่งซื้อ ข้อเสนอ หรือข้อตกลงเฉพาะที่ทำกับลูกค้า หากเกิดความขัดแย้งระหว่างข้อความนี้กับสัญญา B2B ที่ลงนามแล้ว ให้ยึดเอกสารเฉพาะของบริการและข้อตกลงตามสัญญาที่ใช้บังคับ', + 'สำหรับการประมวลผลข้อมูลส่วนบุคคลและคุกกี้ ให้อ้างอิงประกาศความเป็นส่วนตัวและนโยบายคุกกี้ที่ระบุไว้ด้านล่างตามลำดับ', + ], + }, + { + id: 'accettazione', + title: '2. การยอมรับและคุณสมบัติ', + paragraphs: [ + 'การใช้เว็บไซต์ (การท่องเว็บนอกเหนือจากการเปิดหน้าแรก การส่งแบบฟอร์มหากมี การใช้เครื่องมือติดต่อ) ถือว่าทราบและยอมรับเงื่อนไขฉบับนี้ รวมถึงนโยบายความเป็นส่วนตัวที่ใช้บังคับ และนโยบายคุกกี้หากเกี่ยวข้อง', + 'ผู้ใช้รับรองว่ามีอายุและความสามารถทางกฎหมายที่จะผูกพัน หรือดำเนินการภายใต้ความรับผิดชอบของตัวแทนทางกฎหมายที่เหมาะสม', + ], + }, + { + id: 'servizi', + title: '3. เนื้อหาและบริการข้อมูล', + paragraphs: [ + 'เว็บไซต์มีวัตถุประสงค์เพื่อส่งเสริมและให้ข้อมูลเกี่ยวกับ NexStudio ผลิตภัณฑ์ และองค์กร คำอธิบาย ภาพหน้าจอ ตัวอย่าง และ roadmap ไม่ถือเป็นข้อเสนอที่มีผลผูกพันหรือคำมั่นสัญญาฟีเจอร์: ยังขึ้นอยู่กับการทำสัญญา ความพร้อมทางเทคนิค และเงื่อนไขตลาด', + 'NexStudio มุ่งมั่นรักษาข้อมูลให้เป็นปัจจุบันอย่างสมเหตุสมผล โดยไม่มีข้อผูกพันว่าต้องครบถ้วนหรืออัปเดตแบบเรียลไทม์ อาจแก้ไข ระงับ หรือจำกัดการเข้าถึงส่วนต่างๆ ของเว็บไซต์เพื่อบำรุงรักษา ความปลอดภัย หรือการพัฒนาผลิตภัณฑ์', + ], + }, + { + id: 'uso-lecito', + title: '4. การใช้เว็บไซต์โดยชอบด้วยกฎหมาย', + paragraphs: [ + 'ผู้ใช้ตกลงใช้เว็บไซต์ให้สอดคล้องกับกฎหมาย เจตนาดี และพฤติกรรมระดับมืออาชีพ โดยเฉพาะอย่างยิ่ง:', + ], + bullets: [ + 'ไม่นำมัลแวร์เข้ามา ไม่พยายามหลีกเลี่ยงมาตรการความปลอดภัย และไม่ดำเนินกิจกรรมที่ทำให้โครงสร้างพื้นฐานรับภาระเกินปกติหรือใช้ระบบอัตโนมัติโดยไม่ได้รับอนุญาต;', + 'ไม่คัดลอกหรือใช้ประโยชน์เนื้อหาโดยมิชอบ (ดูทรัพย์สินทางปัญญาด้านล่าง) และไม่แอบอ้างเป็น NexStudio หรือบุคคลที่สาม;', + 'ไม่ใช้ช่องทางติดต่อเพื่อเนื้อหาที่ผิดกฎหมาย หมิ่นประมาท สแปม หรือนอกเหนือวัตถุประสงค์ที่ร้องขอ (เชิงพาณิชย์ การสนับสนุน การรายงาน ฯลฯ)', + ], + }, + { + id: 'proprieta', + title: '5. ทรัพย์สินทางปัญญา', + paragraphs: [ + 'ข้อความ โลโก้ องค์ประกอบกราฟิก เลย์เอาต์ ชื่อผลิตภัณฑ์ (รวมถึง LexAura และ MediAura) และซอฟต์แวร์สาธิตหรือวัสดุที่ดาวน์โหลดได้ (หากมี) ได้รับการคุ้มครองตามกฎหมายลิขสิทธิ์และเครื่องหมายการค้าที่ใช้บังคับ ห้ามทำซ้ำ แจกจ่าย หรือแก้ไขโดยไม่ได้รับอนุญาตอย่างชัดเจน เว้นแต่การใช้ที่กฎหมายอนุญาต (การอ้างอิง ข้อความสั้นพร้อมระบุแหล่งที่มา) หรือการผ่อนผันเป็นลายลักษณ์อักษร', + ], + }, + { + id: 'terze-parti', + title: '6. ลิงก์ บริการของบุคคลที่สาม และเครื่องมือที่ฝังไว้', + paragraphs: [ + 'เว็บไซต์อาจมีลิงก์ไปยังไซต์หรือบริการของบุคคลที่สาม NexStudio ไม่ได้ควบคุมทรัพยากรดังกล่าวและไม่รับผิดชอบต่อเนื้อหาหรือนโยบายของบุคคลนั้น การเข้าถึงเป็นความรับผิดชอบของผู้ใช้ ซึ่งต้องอ่านเงื่อนไขและประกาศความเป็นส่วนตัวของบุคคลที่สาม', + ], + }, + { + id: 'responsabilita', + title: '7. ข้อจำกัดความรับผิด', + paragraphs: [ + 'ในขอบเขตสูงสุดที่กฎหมายที่ใช้บังคับอนุญาต เว็บไซต์และเนื้อหาถูกจัดให้ «ตามสภาพ» และ «ตามความพร้อมใช้งาน» โดยไม่มีการรับประกันโดยนัยว่าเหมาะสมกับวัตถุประสงค์เฉพาะ ไม่มีการรับประกันว่าจะไม่ขัดข้อง หรือไม่มีข้อผิดพลาด เอกสารข้อมูลไม่ทดแทนคำปรึกษาด้านกฎหมาย สุขภาพ หรือวิชาชีพ: การตัดสินใจและความรับผิดชอบยังคงอยู่กับผู้เยี่ยมชมหรือผู้ประกอบวิชาชีพและลูกค้าของตน', + 'NexStudio ไม่รับผิดต่อความเสียหายทางอ้อม ความเสียหายที่เป็นผลสืบเนื่อง กำไรที่สูญเสีย การสูญเสียข้อมูล การขัดข้อง การกระทำของบุคคลที่สาม หรือเหตุการณ์ที่อยู่นอกการควบคุมอย่างสมเหตุสมผล เว้นแต่สิ่งที่กฎหมายบังคับไม่อนุญาตให้ยกเว้นหรือจำกัด', + ], + }, + { + id: 'sospensione', + title: '8. การระงับ การละเมิด และเหตุสุดวิสัย', + paragraphs: [ + 'NexStudio อาจระงับ จำกัด หรือยุติการเข้าถึงในกรณีที่มีการละเมิดเงื่อนไขฉบับนี้ ความเสี่ยงด้านความปลอดภัย คำสั่งของหน่วยงาน หรือเหตุสุดวิสัย การไม่ปฏิบัติตามในกรณีดังกล่าวไม่ถือเป็นการผิดสัญญาที่ก่อให้เกิดค่าเสียหาย', + ], + }, + { + id: 'legge', + title: '9. กฎหมายที่ใช้บังคับและศาลที่มีอำนาจ', + paragraphs: [ + 'เว้นแต่บทบัญญัติที่ไม่อาจยกเว้นได้เพื่อคุ้มครองผู้บริโภค เงื่อนไขฉบับนี้และข้อพิพาทใดๆ ที่เกี่ยวกับเว็บไซต์ข้อมูลนี้อยู่ภายใต้กฎหมายอิตาลี ศาลที่มีอำนาจคือ Padova', + ], + }, + { + id: 'contatti-termini', + title: '10. การติดต่อเกี่ยวกับเงื่อนไขเหล่านี้', + paragraphs: [ + 'สำหรับคำถามเกี่ยวกับเงื่อนไขการใช้งานเว็บไซต์ฉบับนี้ ให้ใช้ช่องทางที่ระบุในส่วนติดต่อของเว็บไซต์ สำหรับการประมวลผลข้อมูลส่วนบุคคลและสิทธิ: privacy@nexstudio.com หรือแบบฟอร์มบน nexstudio.ai', + ], + }, + ] as const satisfies readonly TermsSection[], + page: { + title: 'เงื่อนไขการใช้งาน — NexStudio', + description: + 'เงื่อนไขการใช้งานเว็บไซต์ NexStudio S.r.l.: การยอมรับ การใช้โดยชอบ ความรับผิด กฎหมายอิตาลี และศาล Padova บริการ B2B LexAura และ MediAura อยู่ภายใต้สัญญาแยกต่างหาก', + heading: 'เงื่อนไขการใช้งาน', + lead: + 'เงื่อนไขเหล่านี้ใช้กับการท่องเว็บและการใช้เว็บไซต์ข้อมูลสาธารณะของ NexStudio S.r.l. สำนักงานจดทะเบียนในอิตาลี [INDIRIZZO_COMPLETO] สัญญาสมัครสมาชิกหรือซื้อผลิตภัณฑ์ซอฟต์แวร์ยังคงอยู่ภายใต้ข้อเสนอ คำสั่งซื้อ หรือข้อตกลงแยกต่างหาก สำหรับ LexAura และ MediAura ประกาศความเป็นส่วนตัวเฉพาะที่เผยแพร่บนพอร์ทัล SaaS ที่เกี่ยวข้องยังคงเป็นเอกสารอ้างอิงรายละเอียดของแต่ละผลิตภัณฑ์', + versionLabel: 'เวอร์ชัน', + inForceFromLabel: 'มีผลตั้งแต่', + lastUpdateLabel: 'อัปเดตล่าสุด', + relatedDocsLabel: 'เอกสารที่เกี่ยวข้อง', + indexLabel: 'สารบัญ', + }, }, - { - id: 'uso-lecito', - title: '4. Uso lecito del sito', - paragraphs: [ - "L’utente si impegna a usare il sito in conformità a legge, buona fede e condotta professionale, in particolare a:", - ], - bullets: [ - 'non introdurre malware, né tentare di eludere misure di sicurezza, né effettuare attività che sovraccaricano in modo abnorme o automatizzato non autorizzato l’infrastruttura;', - 'non copiare o sfruttare illecitamente i contenuti (cfr. sotto proprietà intellettuale) né impersonare NexStudio o terzi;', - "non usare canali di contatto per contenuti illeciti, diffamatori, spam o al di fuori delle finalità richieste (commerciale, supporto, segnalazioni, ecc.).", - ], - }, - { - id: 'proprieta', - title: '5. Proprietà intellettuale', - paragraphs: [ - "Testi, logotipi, elementi grafici, layout, nomi di prodotto (inclusi LexAura e MediAura) e, ove presenti, software dimostrativo o materiali scaricabili, sono protetti dalle norme sul diritto d’autore e dalle norme sui marchi applicabili. È vietata la riproduzione, distribuzione o modifica non espressamente autorizzata, salvo uso consentito per legge (citazione, breve estratto con attribuzione) o espressa deroga scritta.", - ], - }, - { - id: 'terze-parti', - title: '6. Link, servizi di terzi e strumenti incorporati', - paragraphs: [ - "Il sito può contenere collegamenti a siti o servizi di terzi. NexStudio non controlla tali risorse e non risponde dei loro contenuti o politiche; l’accesso avviene sotto la responsabilità dell’utente, che dovrà leggere le condizioni e l’informativa privacy del terzo.", - ], - }, - { - id: 'responsabilita', - title: '7. Limitazione di responsabilità', - paragraphs: [ - "Nella misura massima consentita dalla legge applicabile, il sito e i suoi contenuti sono forniti «così come sono» e «secondo disponibilità», senza garanzie implicite di adeguatezza a un fine particolare, non interruzione o assenza di errori. Il materiale informativo non sostituisce consulenza legale, sanitaria o professionale: decisioni e responsabilità restano a carico del visitatore o del professionista e dei propri clienti.", - "NexStudio non risponde per danni indiretti, consequenziali, mancati guadagni, perdita di dati, interruzioni, azioni di terzi o fatti oltre il controllo ragionevole, salvo quanto non possa essere escluso o limitato per legge imperativa.", - ], - }, - { - id: 'sospensione', - title: '8. Sospensione, violazione e forza maggiore', - paragraphs: [ - "NexStudio può sospendere, limitare o interrompere l’accesso in caso di violazione delle presenti condizioni, rischio per la sicurezza, ordini di autorità, o forza maggiore. La mancata esecuzione in tali casi non costituisce inadempimento a titolo di danno.", - ], - }, - { - id: 'legge', - title: '9. Legge applicabile e foro competente', - paragraphs: [ - "Salvo disposizioni inderogabili a tutela del consumatore, le presenti condizioni e ogni contestazione inerente al sito informativo sono regolate dalla legge italiana. Il foro competente è Padova.", - ], - }, - { - id: 'contatti-termini', - title: '10. Contatti in merito a queste condizioni', - paragraphs: [ - "Per domande sulle presenti condizioni d’uso del sito, utilizzare i canali indicati nella sezione contatti del sito. Per trattamento dei dati personali e diritti: privacy@nexstudio.com o il form su nexstudio.ai.", - ], - }, -] as const; - -export const termsRiferimenti: readonly { label: string; href: string }[] = [ - { label: 'Informativa privacy', href: '/privacy' }, - { label: 'Cookie policy', href: '/cookies' }, - { label: 'Diritti GDPR', href: '/gdpr' }, - { label: 'Codice etico', href: '/codice-etico' }, -] as const; - -export const termsCrossReferences = { - leadNote: - "Per LexAura e MediAura, le informative privacy dedicate pubblicate sui rispettivi portali SaaS restano il riferimento di dettaglio del singolo prodotto.", } as const; + +export const getTerms = (locale: SupportedLocale) => termsByLocale[locale]; + +/** Retro-compatibilità: fallback italiano. */ +export const termsDocument = termsByLocale.it.document; +export const termsCrossReferences = termsByLocale.it.crossReferences; +export const termsRiferimenti = termsByLocale.it.riferimenti; +export const termsSections = termsByLocale.it.sections; diff --git a/src/pages/about.astro b/src/pages/about.astro index 27ec538..b9fb70b 100644 --- a/src/pages/about.astro +++ b/src/pages/about.astro @@ -1,83 +1,40 @@ --- import SubpageLayout from '../layouts/SubpageLayout.astro'; +import type { SupportedLocale } from '../data/home/navigation'; +import { getAbout } from '../data/about'; + +const path = Astro.url.pathname; +const localeMatch = path.match(/^\/(en|th)(\/|$)/); +const currentLocale = (localeMatch?.[1] ?? 'it') as SupportedLocale; +const about = getAbout(currentLocale); +const { page, intro, sections } = about; --- -

- Ci impegniamo a rendere la tecnologia invisibile nel lavoro quotidiano. Progettiamo - software che assume su di sé processi strutturati, controlli e - complessità computazionale, così che chi lavora su norme, pazienti o documentazione - possa concentrarsi su giudizio, responsabilità e relazione — non su - menu, formati o incertezze operative. Nascondere la complessità sotto - interfaccia essenziale, tempi reattivi e tracciabilità è al centro di - come disegniamo il prodotto, non un optional estetico. -

+

{intro}

-

La nostra missione

-

- Operiamo dove un errore pesa: Legal Tech e Health Tech. Qui servono - precisione, tracciamento delle scelte e rispetto dei vincoli normativi, non - sperimenti generici. La nostra missione è fornire piattaforme SaaS mature - — come LexAura e MediAura — che integrino modelli - d’intelligenza artificiale in flussi già vissuti dallo studio o dalla struttura, con - continuità tra automazione, revisione umana e responsabilità riconoscibile. -

- -

Perché possiamo meritare la tua fiducia

-

- La fiducia non si ottiene con un motto, ma con ingegneria, chiarezza e - continuità. Significa architetture provate, aggiornamenti regolari dei - modelli d’analisi, assistenza e formazione laddove l’adozione chiede metodo oltre - al click. Significa anche onestà sui confini: l’IA nelle nostre offerte è pensata - per estendere e accelerare il lavoro professionale, lasciando a - avvocato, medico o organizzazione la decisione finale e la - documentazione che la norma richiede. -

- -

Come lavoriamo, in sintesi

-
    -
  • - Verticalità e dominio. Less genericismo, più requisiti operativi - (normative, flussi, audit) incorporati fin dalla progettazione. -
    • -
  • - Qualità e sicurezza come priorità, non retorica. Ingegneria, test - e infrastrutture coerenti con l’esposizione a dati sensibili. -
    • -
  • - Supporto e evoluzione. Il rapporto con il cliente non finisce - all’abbonamento: manutenzione evolutiva, assistenza e procedure chiare in caso di - urgenze operative, dove serve. -
    • -
  • - Comunicazione trasparente. Documentazione, informativa privacy - (dove obbligo) e aspettative reciproche esplicite, perché - l’onboarding non diventi il primo ostacolo. -
    • -
- -

Team e cultura

-

- Siamo developer, product e specialisti di dominio in un modello - distribuito: fusi orari diversi e linguaggi comuni, un solo obiettivo - prodotto. Ci muoviamo con iterazioni rapide laddove serve - innovazione, e con governance laddove un cambiamento impatta - validazione, conformità o continuità del servizio. La diversità del gruppo - (competenze, contesti) è per noi vantaggio competitivo: riduce l’assunto implicito - e costringe a rendere esplicito ciò che il software promette, e a chi. -

- -

Impegno nel tempo

-

- Il settore che ci sceglie non cerca un prototipo, ma un percorso - sostenibile: allineamento normativo, adozione in team, affiancamento quando - qualcosa non gira. Costruiamo e manteniamo il prodotto con quella lente, perché - nelle vostre professioni la continuità non è comodità, è - requisito. -

+ { + sections.map((s) => ( + <> +

{s.title}

+ {s.paragraphs?.map((p) => ( +

{p}

+ ))} + {s.bullets && s.bullets.length > 0 ? ( +
    + {s.bullets.map((b) => ( +
  • + {b.title} {b.text} +
    • + ))} +
+ ) : null} + + )) + } diff --git a/src/pages/codice-etico.astro b/src/pages/codice-etico.astro index fd28bd2..1c457ea 100644 --- a/src/pages/codice-etico.astro +++ b/src/pages/codice-etico.astro @@ -1,143 +1,77 @@ --- import SubpageLayout from '../layouts/SubpageLayout.astro'; -import { - getCodiceEticoPremessa, - codiceEticoConformityBlocks, - qualitaValidazioneProdotto, - getCodiceEticoProductListPhrase, - notePraticheDPIA, - codiceEticoTutelaDatiRuoli, -} from '../data/codice-etico'; +import { getCodiceEtico } from '../data/codice-etico'; + +const path = Astro.url.pathname; +const localeMatch = path.match(/^\/(en|th)(\/|$)/); +const currentLocale = (localeMatch?.[1] ?? 'it') as 'it' | 'en' | 'th'; +const c = getCodiceEtico(currentLocale); +const { page } = c; const link = 'text-sky-400/90 underline-offset-2 hover:text-sky-300 hover:underline'; + +const isLabeled = (item: string | { label: string; text: string }): item is { label: string; text: string } => + typeof item !== 'string'; ---

- Versione 1.0 + {page.versionLabel} 1.0 · - Entrata in vigore: 21 aprile 2026 + {page.inForceLabel}: {page.inForceDate}

-

Indice sintetico

+

{page.indexTitle}

    -
  1. Premessa
    2. -
  2. Ambito di applicazione
    3. -
  3. Valori e principi fondamentali
    4. -
  4. - Conformità normativa (per perimetro: piattaforma, legale, sanitario) -
      + { + c.index.map((item) => (
    1. - 4.1 Piattaforma e SaaS (orizzontale) + + {item.label} + + {item.children ? ( +
        + {item.children.map((child) => ( +
      1. + + {child.label} + +
        2. + ))} +
      + ) : null}
      2. -
    2. - 4.2 Ambito legale (LexAura) -
      3. -
    3. - 4.3 Ambito sanitario (MediAura) -
      4. -
    -
    5. -
  5. - Tutela dei dati personali e dati sensibili -
      -
    1. - 5.1 Ruoli: pazienti, clienti, abbonati, Società -
      2. -
    -
    6. -
  6. - Sicurezza dell’informazione e resilienza operativa -
    7. -
  7. - Qualità del software, validazione clinica e rischio per gli utenti -
    8. -
  8. - Proprietà intellettuale e uso di componenti esterni -
    9. -
  9. Uso responsabile di AI/ML e automazione
    10. -
  10. - Conflitti di interesse e integrità commerciale -
    11. -
  11. - Linee operative: sviluppo, rilascio e gestione vulnerabilità -
    12. -
  12. Governance, ruoli e responsabilità
    13. -
  13. - Onboarding, formazione e certificazione -
    14. -
  14. - Segnalazioni, protezione del segnalante e investigazioni -
    15. -
  15. Gestione delle violazioni e sanzioni
    16. -
  16. - Monitoraggio, audit e miglioramento continuo -
    17. -
  17. - Documentazione obbligatoria e registri -
    18. -
  18. Allegati e moduli
    19. -
  19. Approvazione e contatti utili
    20. + )) + }
-

1. Premessa

-

- {getCodiceEticoPremessa()} -

+

{c.premessaTitle}

+

{c.premessa}

-

2. Ambito di applicazione

-

- Si applica a: fondatori, dirigenti, dipendenti (full-time, part-time), collaboratori esterni, - consulenti, appaltatori e fornitori. Copre tutte le attività: analisi, progettazione, - sviluppo, test, rilascio, manutenzione, supporto, marketing, vendite e ricerca. -

+

{c.ambito.title}

+

{c.ambito.text}

-

3. Valori e principi fondamentali

+

{c.valori.title}

    -
  • Integrità, onestà e trasparenza.
    • -
  • Rispetto della dignità umana, inclusione e non discriminazione.
    • -
  • Responsabilità tecnico-professionale e qualità del servizio.
    • -
  • Riservatezza e protezione dei dati personali e sensibili.
    • -
  • Sicurezza e resilienza operativa.
    • -
  • Conformità legale e regolamentare.
    • -
  • Miglioramento continuo e accountability.
    • + {c.valori.items.map((item) =>
  • {item}
    • )}
-

4. Conformità normativa specifica

+

{c.conformita.title}

- I riferimenti sotto sono raggruppati: obblighi orizzontali a tutte le offerte - SaaS, riferimenti distinti per il perimetro - Legal Tech / LexAura e per Health Tech / MediAura (ciascuna - linea può estendersi o diversificare secondo prodotto e mercato, senza commistione indebita - ad altri perimetri). Riepilogo riga prodotto: - {getCodiceEticoProductListPhrase()}. + {c.conformita.introBefore} + {c.productListPhrase} + {c.conformita.introAfter}

{ - codiceEticoConformityBlocks.map((block, i) => ( -
0 && 'mt-5']} - data-conformity-block={block.id} - > -

+ c.conformityBlocks.map((block, i) => ( +
0 && 'mt-5']} data-conformity-block={block.id}> +

{block.title}

{block.lead ?

{block.lead}

: null} @@ -149,392 +83,242 @@ const link = 'text-sky-400/90 underline-offset-2 hover:text-sky-300 hover:underl
)) } -

- La Società effettua DPIA (Data Protection Impact Assessment) per trattamenti ad alto rischio e - consulta autorità o regulatory counsel quando necessario, con riferimenti - per ciascun trattamento al perimetro (piattaforma, legale, sanitario) ove - interessa. -

+

{c.conformita.afterBlocks}

-

5. Tutela dei dati personali e dati sensibili

-

{codiceEticoTutelaDatiRuoli.intro}

+

{c.tutelaDati.title}

+

{c.tutelaDatiRuoli.intro}

- {codiceEticoTutelaDatiRuoli.title} + {c.tutelaDatiRuoli.title}

{ - codiceEticoTutelaDatiRuoli.rows.map((r) => ( + c.tutelaDatiRuoli.rows.map((r) => (

- {r.label}.{' '} - {r.text} + {r.label}. {r.text}

)) } -

- {codiceEticoTutelaDatiRuoli.note} +

+ {c.tutelaDatiRuoli.note}

- Nella concreta operatività, la Società e i collaboratori si attengono ai principi operativi - seguenti (complementari ai ruoli sopra): + {c.tutelaDati.operationalIntro}

    -
  • Minimizzazione: raccogliere solo i dati necessari e pertinenti.
    • -
  • - Base giuridica: documentare la base legale per ogni trattamento (consenso, - esecuzione del contratto, obbligo legale, interesse legittimo valutato). -
    • -
  • - Informativa e consenso: fornire informative chiare e ottenere consensi - quando richiesto; gestire il consenso in modo verificabile. -
    • -
  • - Classificazione: definire categorie (PII, dati sanitari, informazioni legali - privilegiate) e applicare misure differenziate. -
    • -
  • - Conservazione e cancellazione: politiche di retention documentate; - anonimizzazione o cancellazione al termine delle finalità. -
    • -
  • - Trasferimenti internazionali: valutare basi legali (clausole contrattuali - standard, decisioni di adeguatezza, misure tecniche) per trasferimenti fuori dalla - Thailandia. -
    • -
  • - Diritti degli interessati: procedure per accesso, rettifica, cancellazione, - limitazione, portabilità e opposizione, con tempi e log documentati. -
    • -
  • - Sub-processori: contratti che impongono misure di sicurezza equivalenti, - obblighi di notifica in caso di violazione (breach) e divieti di ulteriori - sub-affidamenti non autorizzati. -
    • -
- -

6. Sicurezza dell’informazione e resilienza operativa

-
    -
  • - Security by design e privacy by design: integrazione di - sicurezza e privacy nel ciclo di vita del prodotto. -
    • -
  • - Controlli di accesso: principio del privilegio minimo, MFA obbligatorio per - accesso a risorse sensibili, gestione centralizzata delle identità. -
    • -
  • - Crittografia: cifratura a riposo e in transito con algoritmi aggiornati; - gestione sicura delle chiavi. -
    • -
  • - Logging e monitoraggio: log immutabili per accessi e operazioni su dati - sensibili e ambienti di produzione. -
    • -
  • - Vulnerability management: scansioni automatiche, penetration test - periodici, processo di patching e programma di responsible disclosure o bug bounty. -
    • -
  • - Continuità operativa e disaster recovery: piani testati regolarmente con - RTO/RPO definiti. -
    • -
  • - Gestione incidenti: playbook documentato (identificazione, containment, - eradicazione, recovery, post-mortem), ruoli e tempi di notifica interni ed esterni. -
    • -
- -

7. Qualità del software, validazione clinica e rischio per gli utenti

-
    -
  • - Standard di sviluppo: codice leggibile, test automatici, code review - obbligatorie, CI/CD sicuro. -
    • -
  • - Test e copertura: definire copertura minima per componenti critici; test di - integrazione, performance e sicurezza. -
    • { - qualitaValidazioneProdotto.map((v) => ( + c.tutelaDati.principles.map((p) => (
  • - Validazione (per {v.id === 'legal' ? 'perimetro legale' : 'perimetro sanitario'}):{' '} + {p.label}: {p.text} +
    • + )) + } +
+ +

{c.sicurezza.title}

+
    + { + c.sicurezza.items.map((item) => ( +
  • + {item.label}: {item.text} +
    • + )) + } +
+ +

{c.qualita.title}

+
    + { + c.qualita.itemsBefore.map((item) => ( +
  • + {item.label}: {item.text} +
    • + )) + } + { + c.qualitaValidazioneProdotto.map((v) => ( +
  • + + {v.id === 'legal' + ? c.qualita.validazioneLabelLegal + : c.qualita.validazioneLabelHealth} + : + {' '} {v.text}
    • )) } + { + c.qualita.itemsAfter.map((item) => ( +
  • + {item.label}: {item.text} +
    • + )) + } +
+ +

{c.proprieta.title}

+
    + { + c.proprieta.items.map((item) => + item.kind === 'labeled' ? ( +
  • + {item.label}: {item.text} +
    • + ) : ( +
  • {item.text}
    • + ), + ) + } +
+ +

{c.ai.title}

+
    + { + c.ai.items.map((item) => + isLabeled(item) ? ( +
  • + {item.label}: {item.text} +
    • + ) : ( +
  • {item}
    • + ), + ) + } +
+ +

{c.conflitti.title}

+
    + {c.conflitti.items.map((item) =>
  • {item}
    • )} +
+ +

{c.lineeOperative.title}

+
    + { + c.lineeOperative.items.map((item) => ( +
  • + {item.label}: {item.text} +
    • + )) + } +
+ +

{c.governance.title}

+
    + { + c.governance.items.map((item) => ( +
  • + {item.label}: {item.text} +
    • + )) + } +
+ +

{c.onboarding.title}

+
  • - Classificazione del rischio: valutare impatto su salute o diritti e - applicare misure di mitigazione proporzionate. + {c.onboarding.item1Before} + {c.productListPhrase} + {c.onboarding.item1After} +
    • + {c.onboarding.itemsRest.map((item) =>
  • {item}
    • )} +
+ +

{c.segnalazioni.title}

+
    +
  • + {c.segnalazioni.channelsLabel}:{' '} + {c.segnalazioni.channelsBefore}{' '} + ethics@nexstudio.com + {c.segnalazioni.channelsAfter}
  • - Non sostituzione del professionista: la piattaforma fornisce supporto e - strumenti informativi; non si presenta come sostitutiva di pareri professionali senza - esplicita supervisione e avallo professionale. + {c.segnalazioni.protection.label}:{' '} + {c.segnalazioni.protection.text}
  • - Registri ed evidenze: mantenere documentazione di test clinici, valutazioni - di rischio e approvazioni regolatorie. + {c.segnalazioni.investigations.label}:{' '} + {c.segnalazioni.investigations.text}
-

8. Proprietà intellettuale e uso di componenti esterni

+

{c.violazioni.title}

    -
  • - I contributi di dipendenti e consulenti inerenti a software, documentazione e know-how sono - di proprietà della Società, salvo diverso accordo scritto. -
    • -
  • - Open source: mantenere SBOM (Software Bill of Materials), verificare la - compatibilità delle licenze, rispettare obblighi di disclosure e aggiornamento delle patch. -
    • -
  • - Divieto di uso non autorizzato di codice o proprietà intellettuale di terzi; gestione dei - rischi di contaminazione IP. -
    • + {c.violazioni.items.map((item) =>
  • {item}
    • )}
-

9. Uso responsabile di AI/ML e automazione

+

{c.monitoraggio.title}

    -
  • Documentare dataset di training, provenienza, pre-elaborazione e limiti noti.
    • -
  • - Bias assessment: condurre analisi per identificare e mitigare pregiudizi - che possano discriminare o causare danni. -
    • -
  • - Supervisione umana: per decisioni che influenzano salute, procedimenti - legali o diritti fondamentali, prevedere supervisione umana e avvisi chiari sui limiti del - sistema. -
    • -
  • - Explainability e responsabilità: fornire informazioni comprensibili su - come i modelli supportano le decisioni e su prestazioni e affidabilità. -
    • -
  • - Monitoraggio post-release: misurare le prestazioni in produzione e - correggere drift o comportamenti inattesi. -
    • + { + c.monitoraggio.items.map((item) => + isLabeled(item) ? ( +
  • + {item.label}: {item.text} +
    • + ) : ( +
  • {item}
    • + ), + ) + }
-

10. Conflitti di interesse e integrità commerciale

+

{c.documentazione.title}

+

{c.documentazione.intro}

    -
  • - Dichiarazione obbligatoria di conflitti reali o potenziali (investimenti, relazioni con - fornitori o clienti). -
    • -
  • Politiche anticorruzione e anti-tangenti conformi a leggi nazionali e internazionali.
    • -
  • - Comunicazioni commerciali veritiere; non ingannare su capacità, approvazioni regolatorie o - risultati. -
    • -
  • - Trasparenza contrattuale: SLA, limitazioni di responsabilità e condizioni d’uso chiare e - accessibili. -
    • + {c.documentazione.items.map((item) =>
  • {item}
    • )}
-

11. Linee operative: sviluppo, rilascio e gestione vulnerabilità

+

{c.allegati.title}

    -
  • - Sviluppo: strategia di branch, code review obbligatoria, merge solo con CI - positiva, checklist pre-release (sicurezza, privacy, compliance). -
    • -
  • - Ambiente di test: uso di dati sintetici o anonimizzati; accesso a dati - reali solo su base minima e autorizzata, in ambienti isolati. -
    • -
  • - Deployment: CI/CD standardizzato con piano di rollback e rilasci graduali - per funzionalità critiche. -
    • -
  • - Gestione vulnerabilità: canale pubblico o privato per segnalazioni (bug - bounty o indirizzo dedicato security@), conferma di ricezione entro 72 ore, piano di - remediation con tempi stimati. -
    • -
  • - Patch management: tempi di rilascio delle patch definiti in base alla - severità. -
    • -
  • - Documentazione di rilascio: changelog, impatti noti e raccomandazioni - operative. -
    • + {c.allegati.items.map((item) =>
  • {item}
    • )}
-

12. Governance, ruoli e responsabilità

+

{c.approvazione.title}

    -
  • Board / fondatori: approvano le politiche, definiscono strategia e risorse.
    • -
  • CEO: responsabilità complessiva di conformità e governance.
    • -
  • CTO: qualità tecnica, architettura e pratiche di sviluppo.
    • -
  • - CISO / responsabile sicurezza: sicurezza operativa, risposta agli incidenti, - gestione delle vulnerabilità. -
    • -
  • - DPO / referente privacy: conformità PDPA e GDPR, DPIA, gestione richieste - degli interessati. -
    • -
  • - Legal & compliance: supervisione legale, contratti e valutazioni - regolatorie. -
    • -
  • HR: formazione, codice di condotta e gestione disciplinare.
    • -
  • - Team lead / PM: applicano le policy operative e garantiscono conformità - quotidiana. -
    • -
  • - Comitato etico (consigliato): gruppo multidisciplinare per valutare casi - complessi (impatti clinici o legali, conflitti), con riunioni periodiche e su richiesta. -
    • + { + c.approvazione.items.map((item) => ( +
  • + {item.label}: {item.text} +
    • + )) + } +
+

{page.contactsTitle}

+
    + { + c.approvazione.contacts.map((contact) => ( +
  • + {contact.label}:{' '} + + {contact.email} + + {contact.note === 'anonymous' ? ( + <> {page.anonymousPlatformNote} + ) : null} +
    • + )) + }
-

13. Onboarding, formazione e certificazione

-
    -
  • - Onboarding obbligatorio su: sicurezza informatica, privacy (PDPA e GDPR), gestione dati - sensibili, requisiti e documentazione riferibili a ciascuna linea prodotto - (oggi: {getCodiceEticoProductListPhrase()}; estendere il curriculum quando l’elenco - cresce), uso responsabile dell’AI, pratiche di coding sicuro. -
    • -
  • Formazione annuale obbligatoria e formazione aggiuntiva per ruoli critici.
    • -
  • Registrazione e conservazione dei record di formazione.
    • -
- -

14. Segnalazioni, protezione del segnalante e investigazioni

-
    -
  • - Canali: almeno un canale confidenziale interno (es. ethics@nexstudio.com), piattaforma anonima esterna o servizio terzo; contatto per escalation indipendente. -
    • -
  • - Protezione: divieto di ritorsioni; misure disciplinari per ritorsioni - comprovate. -
    • -
  • - Indagini: condotte in modo imparziale, documentato e con tempi definiti; - comunicazione dei risultati alla persona segnalante e alle parti interessate, nei limiti - della riservatezza. -
    • -
- -

15. Gestione delle violazioni e sanzioni

-
    -
  • - Azioni proporzionate alla gravità: formazione correttiva, richiamo, riassegnazione, - sospensione, risoluzione del rapporto contrattuale, azioni legali se necessario. -
    • -
  • Registro delle infrazioni e delle azioni intraprese; diritto di difesa dell’interessato.
    • -
- -

16. Monitoraggio, audit e miglioramento continuo

-
    -
  • Audit interni ed esterni regolari su sicurezza, privacy, compliance e controllo qualità.
    • -
  • - KPI (esempi): numero di incidenti, tempo medio di remediation, percentuale - di copertura dei test, percentuale di formazione completata, tempo medio di risposta alle - segnalazioni. -
    • -
  • - Revisione del Codice: almeno annuale o in caso di cambiamenti normativi, tecnologici o di - mercato. -
    • -
- -

17. Documentazione obbligatoria e registri

-

La Società mantiene e aggiorna, tra l’altro:

-
    -
  • registro dei trattamenti e DPIA;
    • -
  • SBOM e inventario dei componenti (open source);
    • -
  • log di accesso e audit trail;
    • -
  • registro incidenti e violazioni dei dati;
    • -
  • contratti con fornitori e sub-processori;
    • -
  • record di formazione e dichiarazioni di adesione al Codice.
    • -
- -

18. Allegati e moduli (inclusi)

-
    -
  • Dichiarazione personale di adesione al Codice (da firmare in onboarding).
    • -
  • Template NDA e clausole minime per fornitori e sub-processori.
    • -
  • Checklist pre-release (security e privacy).
    • -
  • Flowchart gestione incidenti e template di notifica.
    • -
  • Modello DPIA semplificato ed esempio compilato.
    • -
  • Modello informativa privacy e modulo consenso per utenti o pazienti.
    • -
  • Template SBOM.
    • -
  • Policy di retention dei dati (tempi e giustificazioni).
    • -
  • Template per valutazione d’impatto AI/ML.
    • -
- -

19. Approvazione e contatti utili

-
    -
  • - Approvato da: organo competente / amministratore delegato (nome e cognome - alla firma). -
    • -
  • - Responsabile aggiornamenti: Legal & compliance, con supporto di DPO - e CISO. -
    • -
  • - Revisione: minimo annuale o a fronte di mutamenti rilevanti. -
    • -
-

Contatti

- - -

Clausola finale di adesione (da firmare in onboarding)

+

{c.adesione.title}

- Dichiaro di aver letto e compreso il Codice Etico di NexStudio e mi impegno a - rispettarne i principi e le procedure. Mi impegno inoltre a segnalare, in buona fede, eventuali - violazioni di cui dovessi venire a conoscenza. + {c.adesione.textBefore} + NexStudio + {c.adesione.textAfter}

- Firma: + {page.signatureLabel}:{' '} + · - Data: + {page.dateLabel}:{' '} +

-

Note pratiche e prossimi passi consigliati

+

{c.notePratiche.title}

    -
  • - Personalizzare il documento con il nome ufficiale della società (se diverso dal marchio - operativo), firme e riferimenti legali locali a Bangkok. -
    • -
  • - Allegare i template elencati come documenti separati e implementare i canali tecnici per - segnalazioni e bug bounty. -
    • -
  • - Predisporre un piano di formazione di 90 giorni per l’onboarding e formazione ricorrente - annuale. -
    • - {notePraticheDPIA.map((t) =>
  • {t}
    • )} + {c.notePratiche.items.map((item) =>
  • {item}
    • )} + {c.notePraticheDPIA.map((t) =>
  • {t}
    • )}
diff --git a/src/pages/cookies.astro b/src/pages/cookies.astro index f0d6348..8022116 100644 --- a/src/pages/cookies.astro +++ b/src/pages/cookies.astro @@ -1,252 +1,203 @@ --- import SubpageLayout from '../layouts/SubpageLayout.astro'; import { cookieConsentMeta } from '../data/cookie-consent'; +import type { SupportedLocale } from '../data/home/navigation'; +import { getCookies } from '../data/cookies'; + +const path = Astro.url.pathname; +const localeMatch = path.match(/^\/(en|th)(\/|$)/); +const currentLocale = (localeMatch?.[1] ?? 'it') as SupportedLocale; +const cookies = getCookies(currentLocale); +const { document: cookiesDocument, riferimenti, sections, page } = cookies; + +const localize = (href: string) => { + if (currentLocale === 'it') return href; + if (href.startsWith(`/${currentLocale}`)) return href; + if (href.startsWith('/#')) return `/${currentLocale}${href}`; + if (href.startsWith('/')) return `/${currentLocale}${href}`; + return href; +}; + +const resolveHref = (href: string) => + href.startsWith('mailto:') || href.startsWith('http') ? href : localize(href); const link = 'text-sky-400/90 underline-offset-2 hover:text-sky-300 hover:underline'; const tbl = 'mt-4 w-full border-collapse text-left text-sm'; const th = 'border border-nx-border bg-nx-surface/60 px-3 py-2 font-semibold text-nx-fg'; const td = 'border border-nx-border px-3 py-2 align-top text-nx-muted'; -const riferimenti = [ - { label: 'Informativa privacy', href: '/privacy' }, - { label: "Condizioni d'uso", href: '/terms' }, - { label: 'Diritti GDPR', href: '/gdpr' }, -] as const; +const indexTitle = (title: string) => title.replace(/^\d+\.\s*/, ''); ---

- Versione 1.1 + {page.versionLabel} {cookiesDocument.version} · - In vigore dal [DATA] + {page.inForceFromLabel} {cookiesDocument.inVigoreDal} · - Versione tecnica consenso{' '} + {page.consentVersionLabel}{' '} v{cookieConsentMeta.policyVersion}

- Documenti connessi:{' '} + {page.relatedDocsLabel}:{' '} { riferimenti.map((r, i) => ( {i > 0 && · } - {r.label} + {r.label} )) }

-

Indice

+

{page.indexLabel}

    -
  1. Premessa
    2. -
  2. Definizioni
    3. -
  3. Finalità dei cookie e categorie
    4. -
  4. Elenco dei cookie utilizzati
    5. -
  5. Base giuridica
    6. -
  6. Modalità di raccolta del consenso e registro
    7. -
  7. Gestione e revoca del consenso
    8. -
  8. Disabilitazione via browser e impatto
    9. -
  9. Cookie di terze parti e responsabilità
    10. -
  10. Conservazione e criteri di retention
    11. -
  11. Trasferimenti internazionali
    12. -
  12. Minori età
    13. -
  13. Misure di sicurezza
    14. -
  14. Consenso per scopi pubblicitari e profiling
    15. -
  15. Effetti di rifiuto o accettazione
    16. -
  16. Modifiche alla Cookie Policy
    17. -
  17. Diritti degli interessati e contatti
    18. + { + sections.map((s) => ( +
  18. + {indexTitle(s.title)} +
    19. + )) + }
-

1. Premessa

-

- Questa Cookie Policy descrive le tipologie di cookie e tecnologie simili utilizzate sul sito - web di NexStudio S.r.l. (di seguito «NexStudio», «noi»), con sede legale in Italia, - [INDIRIZZO_COMPLETO], e spiega come gestire le preferenze. Per il trattamento dei dati - personali e per i diritti degli interessati si rimanda all’Informativa privacy. -

-

- Per le cookie policy dei prodotti SaaS LexAura e MediAura, consultare le rispettive pagine sui - portali dedicati. -

+ { + sections.map((s) => ( +
+

{s.title}

-

2. Definizioni

-
    -
  • - Cookie: piccolo file di testo inviato dal sito al browser e memorizzato sul - dispositivo, re-inviato al sito alle visite successive. -
    • -
  • - Cookie di prima parte: impostati dal dominio del sito che l’utente visita. -
    • -
  • - Cookie di terze parti: impostati da domini diversi (fornitori esterni, - embed, CDN, strumenti di misura). -
    • -
  • - Tecnologie simili: web beacon, pixel, local storage, e in generale - identificatori lato client. -
    • -
+ {s.richParagraphs?.map((parts) => ( +

+ {parts.map((part) => { + if (part.t === 'text') return part.v; + if (part.t === 'em') return {part.v}; + if (part.t === 'strong') return {part.v}; + if (part.external) { + return ( + + {part.label} + + ); + } + return ( + + {part.label} + + ); + })} +

+ ))} -

3. Finalità dei cookie e categorie

+ {s.paragraphs?.map((p) => ( +

{p}

+ ))} -

3.1 Cookie strettamente necessari (essenziali)

-

- Finalità: navigazione, sicurezza, gestione sessione, memorizzazione delle - preferenze di consenso. Base giuridica: legittimo interesse del titolare - (Art. 6.1.f GDPR) a garantire il funzionamento del servizio richiesto dall’utente. -

+ {s.definitions && s.definitions.length > 0 ? ( +
    + {s.definitions.map((d) => ( +
  • + {d.term}: {d.definition} +
    • + ))} +
+ ) : null} -

3.2 Cookie di preferenza / funzionali

-

- Finalità: lingua, regione, tema o altre impostazioni di interfaccia.{' '} - Base giuridica: consenso (Art. 6.1.a GDPR). -

+ {s.subsections?.map((sub) => ( + <> +

{sub.title}

+

+ {sub.purposeLabel ? ( + <> + {sub.purposeLabel}: {sub.purpose}{' '} + + ) : null} + {sub.legalBasisLabel ? ( + <> + {sub.legalBasisLabel}: {sub.legalBasis} + + ) : null} +

+ + ))} -

3.3 Cookie di performance / analytics

-

- Finalità: statistiche aggregate su visite e percorsi per migliorare il sito.{' '} - Base giuridica: consenso (Art. 6.1.a GDPR). -

+ {s.bullets && s.bullets.length > 0 ? ( +
    + {s.bullets.map((b) => ( +
  • + {typeof b === 'string' ? ( + b + ) : 'before' in b ? ( + <> + {b.before} + {b.strong} + {b.after || ''} + + ) : ( + <> + {b.strong} + {b.after || ''} + + )} +
    • + ))} +
+ ) : null} -

3.4 Cookie per advertising e targeting

-

- Finalità: pubblicità mirata, remarketing, misura delle campagne.{' '} - Base giuridica: consenso esplicito. -

+ {s.paragraphsAfterBullets?.map((p) => + typeof p === 'string' ? ( +

{p}

+ ) : ( +

+ {p.map((part) => { + if (part.t === 'text') return part.v; + if (part.t === 'em') return {part.v}; + if (part.t === 'strong') return {part.v}; + if (part.external) { + return ( + + {part.label} + + ); + } + return ( + + {part.label} + + ); + })} +

+ ), + )} -

3.5 Cookie di terze parti e integrazioni social

-

- Finalità: video incorporati, pulsanti social, mappe, chat di terze parti. Il - trattamento da parte di terzi è regolato dalle rispettive policy. -

- -

4. Elenco dei cookie utilizzati

-

- Elenco in appendice tecnica (da mantenere aggiornato con scansione periodica). -

- - - - - - - - - - - - - - - - -
NomeProviderCategoriaDurataTipoBase giuridica
- Da compilare dopo scansione del sito in staging e produzione. -
- -

5. Base giuridica

-
    -
  • - Cookie tecnici essenziali: legittimo interesse del titolare (Art. 6.1.f GDPR). -
    • -
  • - Cookie analitici e di marketing: consenso libero, informato e revocabile (Art. 6.1.a GDPR). -
    • -
- -

6. Modalità di raccolta del consenso e registro

-

- Il sito utilizza una CMP first-party. Al primo accesso viene mostrato un banner con: -

-
    -
  • Rifiuta non essenziali
    • -
  • Personalizza (apertura pannello categorie)
    • -
  • Accetta tutto
    • -
-

- La prova della scelta è memorizzata nel browser in local storage. -

- -

7. Gestione e revoca del consenso

-
    -
  • Tramite il banner o il pannello Personalizza al primo accesso.
    • -
  • - In qualsiasi momento tramite Impostazioni cookie nel footer del sito. -
    • -
  • Cancellando i dati locali del sito dalle impostazioni del browser.
    • -
- -

8. Disabilitazione via browser e impatto

-

- È possibile bloccare o cancellare i cookie dalle impostazioni del browser (Chrome, Firefox, - Safari, Edge e altri). -

- -

9. Cookie di terze parti e responsabilità

-

- Il sito può integrare strumenti di terze parti (analytics, CDN, social). Le terze parti - possono impostare cookie propri e trattare dati secondo le loro policy. -

- -

10. Conservazione e criteri di retention

-

- Le durate dei singoli cookie seguono le tabelle pubblicate e le policy dei fornitori. Cookie - di consenso: 365 giorni, rinnovabili. Log di sicurezza: massimo 30 giorni. -

- -

11. Trasferimenti internazionali

-

- Alcuni fornitori possono trattare dati in Paesi terzi (es. Stati Uniti). Ove applicabile si - adottano garanzie come clausole contrattuali standard, decisioni di adeguatezza o altre basi - previste dalla legge. -

- -

12. Minori età

-

Il sito non è rivolto alla raccolta intenzionale di dati di minori.

- -

13. Misure di sicurezza

-

- Si applicano misure tecniche e organizzative appropriate: trasmissione su TLS, accesso - limitato ai log, principio di minimizzazione. -

- -

14. Consenso per scopi pubblicitari e profiling

-

- Profilazione e pubblicità comportano consenso esplicito e tracciabilità della scelta. -

- -

15. Effetti di rifiuto o accettazione

-

- Accettando le categorie opzionali si abilitano preferenze avanzate, analytics e funzioni di - marketing. Rifiutando i non essenziali il sito resta navigabile. -

- -

16. Modifiche alla Cookie Policy

-

- La Policy può essere aggiornata quando cambiano cookie, fornitori o norme. Sarà indicata la - data di revisione. -

- -

17. Diritti degli interessati e contatti

-

- Diritti: accesso, rettifica, cancellazione, limitazione, portabilità, opposizione e revoca del - consenso. Per esercitarli:{' '} - privacy@nexstudio.com - {' '}e tramite il form su nexstudio.ai. Autorità di controllo: Garante per la protezione dei - dati personali (www.garanteprivacy.it). -

+ {s.table ? ( + + + + {s.table.headers.map((h) => ( + + ))} + + + + + + + +
{h}
+ {s.table.emptyNote} +
+ ) : null} +
+ )) + }
diff --git a/src/pages/dove-siamo.astro b/src/pages/dove-siamo.astro index 5f3901e..35fd48f 100644 --- a/src/pages/dove-siamo.astro +++ b/src/pages/dove-siamo.astro @@ -1,22 +1,37 @@ --- import SubpageLayout from '../layouts/SubpageLayout.astro'; +import type { SupportedLocale } from '../data/home/navigation'; +import { getDoveSiamo } from '../data/dove-siamo'; + +const path = Astro.url.pathname; +const localeMatch = path.match(/^\/(en|th)(\/|$)/); +const currentLocale = (localeMatch?.[1] ?? 'it') as SupportedLocale; +const doveSiamo = getDoveSiamo(currentLocale); +const { page, sections } = doveSiamo; --- -

Sede

-

- Thailandia — Bangkok -

- -

Fusi orari e lingue

-

- Il sito e il supporto via web possono essere gestiti in italiano, inglese, - tedesco, francese, spagnolo e tailandese, con orari da concordare in base - al team e al fuso rispetto ai clienti in Europa e altre regioni. -

+ { + sections.map((s) => ( + <> +

{s.title}

+ {s.paragraphs.map((p) => + s.locationLine ? ( +

+ {p.split(' — ')[0]} + {' — '} + {p.split(' — ')[1]} +

+ ) : ( +

{p}

+ ), + )} + + )) + } diff --git a/src/pages/gdpr.astro b/src/pages/gdpr.astro index bba66ed..6b30a4c 100644 --- a/src/pages/gdpr.astro +++ b/src/pages/gdpr.astro @@ -1,49 +1,56 @@ --- import SubpageLayout from '../layouts/SubpageLayout.astro'; -import { - gdprCrossReferences, - gdprDocument, - gdprRiferimenti, - gdprSections, -} from '../data/gdpr'; +import type { SupportedLocale } from '../data/home/navigation'; +import { getGdpr } from '../data/gdpr'; + +const path = Astro.url.pathname; +const localeMatch = path.match(/^\/(en|th)(\/|$)/); +const currentLocale = (localeMatch?.[1] ?? 'it') as SupportedLocale; +const gdpr = getGdpr(currentLocale); +const { document: gdprDocument, riferimenti, sections, page } = gdpr; + +const localize = (href: string) => { + if (currentLocale === 'it') return href; + if (href.startsWith(`/${currentLocale}`)) return href; + if (href.startsWith('/#')) return `/${currentLocale}${href}`; + if (href.startsWith('/')) return `/${currentLocale}${href}`; + return href; +}; const link = 'text-sky-400/90 underline-offset-2 hover:text-sky-300 hover:underline'; -const lead = - "Diritti degli interessati e modalità di esercizio ai sensi del Regolamento (UE) 2016/679, in coerenza con l'informativa privacy quadro di NexStudio S.r.l. (Italia, [INDIRIZZO_COMPLETO]). " + - gdprCrossReferences.lead; ---

- Versione {gdprDocument.version} + {page.versionLabel} {gdprDocument.version} · - In vigore dal {gdprDocument.inVigoreDal} + {page.inForceFromLabel} {gdprDocument.inVigoreDal} · - Ultimo aggiornamento {gdprDocument.ultimoAggiornamento} + {page.lastUpdateLabel} {gdprDocument.ultimoAggiornamento}

- Documenti connessi:{' '} + {page.relatedDocsLabel}:{' '} { - gdprRiferimenti.map((r, i) => ( + riferimenti.map((r, i) => ( {i > 0 && · } - {r.label} + {r.label} )) }

-

Indice

+

{page.indexLabel}

    { - gdprSections.map((s) => ( + sections.map((s) => (
  1. {s.title}
    2. @@ -52,7 +59,7 @@ const lead =
{ - gdprSections.map((s) => ( + sections.map((s) => (

{s.title} diff --git a/src/pages/index.astro b/src/pages/index.astro index 2aabe3a..014f4eb 100644 --- a/src/pages/index.astro +++ b/src/pages/index.astro @@ -9,10 +9,10 @@ import { getSiteMeta, getNavigation, getHero, - stats, + getStats, getServices, getStackSection, - productsSection, + getProductsSection, getFaq, getCta, } from '../data/home'; @@ -23,8 +23,10 @@ const currentLocale = (localeMatch?.[1] ?? 'it') as 'it' | 'en' | 'th'; const navigation = getNavigation(currentLocale); const siteMeta = getSiteMeta(currentLocale); const hero = getHero(currentLocale); +const stats = getStats(currentLocale); const services = getServices(currentLocale); const stackSection = getStackSection(currentLocale); +const productsSection = getProductsSection(currentLocale); const faq = getFaq(currentLocale); const cta = getCta(currentLocale); const infrastructureCarouselItems = stackSection.infrastructureCarousel.items; diff --git a/src/pages/modello-organizzativo.astro b/src/pages/modello-organizzativo.astro index c124b73..81950bb 100644 --- a/src/pages/modello-organizzativo.astro +++ b/src/pages/modello-organizzativo.astro @@ -1,66 +1,66 @@ --- import SubpageLayout from '../layouts/SubpageLayout.astro'; -import { - modelloOrganizzativo, - modelloOrganizzativoRuoli, - modelloOrganizzativoGovernance, - modelloOrganizzativoResponsabilitaSintesi, - modelloOrganizzativoControlliLean, - modelloOrganizzativoKpi, - modelloOrganizzativoDocumentazione, - modelloOrganizzativoPiano30, - modelloOrganizzativoOutsourcing, - modelloOrganizzativoNote, - modelloOrganizzativoFlussiDecisionali, -} from '../data/modello-organizzativo'; +import { getModelloOrganizzativo } from '../data/modello-organizzativo'; + +const path = Astro.url.pathname; +const localeMatch = path.match(/^\/(en|th)(\/|$)/); +const currentLocale = (localeMatch?.[1] ?? 'it') as 'it' | 'en' | 'th'; +const m = getModelloOrganizzativo(currentLocale); +const { page } = m; + +const localize = (href: string) => { + if (currentLocale === 'it') return href; + if (href.startsWith(`/${currentLocale}`)) return href; + if (href.startsWith('/#')) return `/${currentLocale}${href}`; + if (href.startsWith('/')) return `/${currentLocale}${href}`; + return href; +}; const link = 'text-sky-400/90 underline-offset-2 hover:text-sky-300 hover:underline'; const tbl = 'min-w-[22rem] w-full border-collapse text-left text-sm'; const th = 'border border-nx-border bg-nx-surface/60 px-3 py-2 font-semibold text-nx-fg'; const td = 'border border-nx-border px-3 py-2 align-top text-nx-muted'; const tableWrap = 'mt-2 overflow-x-auto'; +const mark = (on?: boolean) => (on ? '●' : ''); ---

- {modelloOrganizzativo.introBox} + {m.introBox}

- {modelloOrganizzativo.perimetro} + {m.perimetro}

-

Indice

+

{page.indexTitle}

    -
  1. Ruoli e perimetro
    2. -
  2. Governance essenziale
    3. -
  3. Principali responsabilità (sintesi)
    4. -
  4. RACI per processi critici
    5. -
  5. Flussi decisionali rapidi
    6. -
  6. Controlli minimi obbligatori (lean)
    7. -
  7. KPI essenziali
    8. -
  8. Documentazione minima da mantenere
    9. -
  9. Primo piano operativo (30 giorni)
    10. -
  10. Outsourcing consigliato
    11. -
  11. Note pratiche e raccomandazioni
    12. + { + page.index.map((item) => ( +
  12. + + {item.label} + +
    13. + )) + }
-

1. Ruoli e perimetro

+

{page.sectionTitles.ruoli}

- Elenco sintetico delle funzioni e delle attese di impegno. Per allineare il dominio - prodotto (Legal Tech, Health Tech) a ruoli e consiglieri, fate riferimento anche a codice etico e, per i trattamenti di dati, a privacy policy e DPA. + {page.ruoliIntroBefore}{' '} + {page.codiceEticoLabel} + {' '} + {page.ruoliIntroAfter}

    { - modelloOrganizzativoRuoli.map((r) => ( + m.ruoli.map((r) => (
  • {r.label}: {r.text}
    • @@ -68,217 +68,85 @@ const tableWrap = 'mt-2 overflow-x-auto'; }
-

2. Governance essenziale

+

{page.sectionTitles.governance}

    { - modelloOrganizzativoGovernance.map((g) => ( + m.governance.map((g) => (
  • - {g.nome}: {g.partecipanti}. — {g.nota} + {g.nome}: {g.partecipanti}.{' '} + — {g.nota}
    • )) }
-

3. Principali responsabilità (sintesi)

+

{page.sectionTitles.responsabilita}

    - {modelloOrganizzativoResponsabilitaSintesi.map((l) =>
  • {l}
    • )} + {m.responsabilitaSintesi.map((l) =>
  • {l}
    • )}
-

4. RACI sintetico per processi critici

+

{page.sectionTitles.raci}

- Legenda: R = Responsible, A = Accountable, - C = Consulted, I = Informed. + {page.raciLegendBefore} {page.raciLegend}

-

Rilascio in produzione

-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
RuoloRACI
Lead engineer●
CTO●
Security lead, DPO, product advisor●
CEO, customer success●
-
+ { + m.raci.map((matrix) => ( + <> +

+ {matrix.title} +

+ {'note' in matrix && matrix.note ? ( +

+ {matrix.note}{' '} + + {matrix.noteLinkLabel} + + {'noteAfter' in matrix ? matrix.noteAfter : null} +

+ ) : null} +
+ + + + + + + + + + + + {matrix.rows.map((row) => ( + + + + + + + + ))} + +
+ {page.roleCol} + + R + + A + + C + + I +
{row.role}{mark(row.r)}{mark(row.a)}{mark(row.c)}{mark(row.i)}
+
+ + )) + } -

Incident response (violazione dei dati o incidente P0)

-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
RuoloRACI
Security lead●
CEO●
DPO, legal, CTO●
Clienti interessati, board (se impatto elevato)●
-
- -

Onboarding vendor (sub-processore)

-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
RuoloRACI
Operations●
Legal●
Security lead, DPO●
CTO, finance●
-
- -

DPIA (per perimetro: LexAura, MediAura, piattaforma)

-

- La matrice RACI non sostituisce il criterio legale (chi è titolare, chi responsabile) definito - in contratti e in §5.1 del codice etico. Qui: chi coordina l’esercizio interno della valutazione d’impatto. -

-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
RuoloRACI
DPO●
Legal●
Product advisor, CTO, security lead●
CEO●
-
- -

5. Flussi decisionali rapidi

+

{page.sectionTitles.flussi}

    { - modelloOrganizzativoFlussiDecisionali.map((f) => ( + m.flussiDecisionali.map((f) => (
  • {f.titolo}: {f.testo}
    • @@ -286,15 +154,15 @@ const tableWrap = 'mt-2 overflow-x-auto'; }
-

6. Controlli minimi obbligatori (lean)

+

{page.sectionTitles.controlli}

    - {modelloOrganizzativoControlliLean.map((c) =>
  • {c}
    • )} + {m.controlliLean.map((c) =>
  • {c}
    • )}
-

7. KPI essenziali

+

{page.sectionTitles.kpi}

    { - modelloOrganizzativoKpi.map((k) => ( + m.kpi.map((k) => (
  • {k.area}: {k.testo}
    • @@ -302,15 +170,15 @@ const tableWrap = 'mt-2 overflow-x-auto'; }
-

8. Documentazione minima da mantenere

+

{page.sectionTitles.documentazione}

    - {modelloOrganizzativoDocumentazione.map((d) =>
  • {d}
    • )} + {m.documentazione.map((d) =>
  • {d}
    • )}
-

9. Primo piano operativo (30 giorni)

+

{page.sectionTitles.piano30}

    { - modelloOrganizzativoPiano30.map((p) => ( + m.piano30.map((p) => (
  1. {p.quando}: {p.testo}
    2. @@ -318,10 +186,10 @@ const tableWrap = 'mt-2 overflow-x-auto'; }
-

10. Outsourcing consigliato (per restare snelli)

+

{page.sectionTitles.outsourcing}

    { - modelloOrganizzativoOutsourcing.map((o) => ( + m.outsourcing.map((o) => (
  • {o.titolo}: {o.testo}
    • @@ -329,9 +197,9 @@ const tableWrap = 'mt-2 overflow-x-auto'; }
-

11. Note pratiche e raccomandazioni

+

{page.sectionTitles.note}

    - {modelloOrganizzativoNote.map((n) =>
  • {n}
    • )} + {m.note.map((n) =>
  • {n}
    • )}
diff --git a/src/pages/news.astro b/src/pages/news.astro index a107b30..8750d46 100644 --- a/src/pages/news.astro +++ b/src/pages/news.astro @@ -1,37 +1,56 @@ --- import SubpageLayout from '../layouts/SubpageLayout.astro'; +import type { SupportedLocale } from '../data/home/navigation'; +import { getNews } from '../data/news'; + +const path = Astro.url.pathname; +const localeMatch = path.match(/^\/(en|th)(\/|$)/); +const currentLocale = (localeMatch?.[1] ?? 'it') as SupportedLocale; +const news = getNews(currentLocale); +const { page, statusBanner, sections, contact } = news; + +const localize = (href: string) => { + if (currentLocale === 'it') return href; + if (href.startsWith(`/${currentLocale}`)) return href; + if (href.startsWith('/#')) return `/${currentLocale}${href}`; + if (href.startsWith('/')) return `/${currentLocale}${href}`; + return href; +}; ---

- Stato editoriale: canale attivo. Le prossime pubblicazioni verranno aggiornate su questa pagina con frequenza periodica. + {statusBanner}

-

Programma editoriale

-
    -
  • Release tecniche: aggiornamenti su funzionalita, integrazioni e miglioramenti di stabilita.
    • -
  • Compliance: novita su policy, sicurezza applicativa e adempimenti normativi.
    • -
  • Case e risultati: note operative su adozione, scalabilita e impatti di business.
    • -
+ { + sections.map((s) => ( + <> +

{s.title}

+ {s.bullets && s.bullets.length > 0 ? ( +
    + {s.bullets.map((b) => ( +
  • + {b.title ? {b.title} : null} {b.text} +
    • + ))} +
+ ) : null} + {s.paragraphs?.map((p) => ( +

{p}

+ ))} + + )) + } -

Canali di distribuzione

-
    -
  • Questa pagina resta il punto di riferimento ufficiale per annunci e changelog sintetici.
    • -
  • La newsletter è attiva dal footer del sito (iscrizione con conferma email).
    • -
  • I contenuti long-form potranno essere pubblicati anche su canali esterni, con rimando qui.
    • -
- -

Archivio

-

- In questa fase il sito e in pre-lancio operativo. Il primo blocco di news verra pubblicato con il go-live ufficiale. -

- Per richieste stampa, partnership o approfondimenti tecnici e possibile usare il form nella sezione - Contatti. + {contact.before} + {contact.linkLabel} + {contact.after}

diff --git a/src/pages/privacy.astro b/src/pages/privacy.astro index 888c189..a411e48 100644 --- a/src/pages/privacy.astro +++ b/src/pages/privacy.astro @@ -1,50 +1,57 @@ --- import SubpageLayout from '../layouts/SubpageLayout.astro'; -import { - privacyCrossReferences, - privacyDocument, - privacyRiferimenti, - privacySections, -} from '../data/privacy'; +import type { SupportedLocale } from '../data/home/navigation'; +import { getPrivacy } from '../data/privacy'; + +const path = Astro.url.pathname; +const localeMatch = path.match(/^\/(en|th)(\/|$)/); +const currentLocale = (localeMatch?.[1] ?? 'it') as SupportedLocale; +const privacy = getPrivacy(currentLocale); +const { document: privacyDocument, riferimenti, sections, page } = privacy; + +const localize = (href: string) => { + if (currentLocale === 'it') return href; + if (href.startsWith(`/${currentLocale}`)) return href; + if (href.startsWith('/#')) return `/${currentLocale}${href}`; + if (href.startsWith('/')) return `/${currentLocale}${href}`; + return href; +}; const link = 'text-sky-400/90 underline-offset-2 hover:text-sky-300 hover:underline'; -const lead = - "Informativa quadro sul trattamento dei dati personali per il portale istituzionale NexStudio S.r.l., con sede legale in Italia, [INDIRIZZO_COMPLETO], e per i servizi SaaS LexAura e MediAura. " + - privacyCrossReferences.lead; ---

- Versione {privacyDocument.version} + {page.versionLabel} {privacyDocument.version} · - In vigore dal {privacyDocument.inVigoreDal} + {page.inForceFromLabel} {privacyDocument.inVigoreDal} · - Ultimo aggiornamento{' '} + {page.lastUpdateLabel}{' '} {privacyDocument.ultimoAggiornamento}

- Documenti connessi:{' '} + {page.relatedDocsLabel}:{' '} { - privacyRiferimenti.map((r, i) => ( + riferimenti.map((r, i) => ( {i > 0 && · } - {r.label} + {r.label} )) }

-

Indice

+

{page.indexLabel}

    { - privacySections.map((s) => ( + sections.map((s) => (
  1. {s.title}
    2. @@ -53,7 +60,7 @@ const lead =
{ - privacySections.map((s) => ( + sections.map((s) => (

{ + if (currentLocale === 'it') return href; + if (href.startsWith(`/${currentLocale}`)) return href; + if (href.startsWith('/#')) return `/${currentLocale}${href}`; + if (href.startsWith('/')) return `/${currentLocale}${href}`; + return href; +}; const link = 'text-sky-400/90 underline-offset-2 hover:text-sky-300 hover:underline'; -const lead = - "Si applicano alla navigazione e all'uso del sito informativo pubblico di NexStudio S.r.l., con sede legale in Italia, [INDIRIZZO_COMPLETO]. I contratti d'abbonamento o d'acquisto sui prodotti software restano retti da offerte, ordini o accordi separati. " + - termsCrossReferences.leadNote; ---

- Versione {termsDocument.version} + {page.versionLabel} {termsDocument.version} · - In vigore dal {termsDocument.inVigoreDal} + {page.inForceFromLabel} {termsDocument.inVigoreDal}

- Documenti connessi:{' '} + {page.relatedDocsLabel}:{' '} { - termsRiferimenti.map((r, i) => ( + riferimenti.map((r, i) => ( {i > 0 && · } - {r.label} + {r.label} )) }

-

Indice

+

{page.indexLabel}

    { - termsSections.map((s) => ( + sections.map((s) => (
  1. {s.title}
    2. @@ -45,7 +57,7 @@ const lead =
{ - termsSections.map((s) => ( + sections.map((s) => (

Date: Thu, 30 Jul 2026 11:39:27 +0200 Subject: [PATCH 2/3] Impedisce l'auto-traduzione del browser e fissa il locale TH/EN esplicito. Chrome traduceva il tailandese in inglese allo scroll; html translate=no e prop locale sulle route. Co-authored-by: Cursor --- src/layouts/BaseLayout.astro | 5 +++-- src/pages/en/index.astro | 2 +- src/pages/index.astro | 11 ++++++++++- src/pages/th/index.astro | 2 +- src/scripts/nx-nav-spy.ts | 7 +++++-- 5 files changed, 20 insertions(+), 7 deletions(-) diff --git a/src/layouts/BaseLayout.astro b/src/layouts/BaseLayout.astro index f7a5070..aa7be6c 100644 --- a/src/layouts/BaseLayout.astro +++ b/src/layouts/BaseLayout.astro @@ -20,11 +20,12 @@ const canonicalUrl = Astro.url.toString(); --- - + + @@ -46,7 +47,7 @@ const canonicalUrl = Astro.url.toString(); rel="stylesheet" /> - + diff --git a/src/pages/en/index.astro b/src/pages/en/index.astro index 8ed3bf2..aed5467 100644 --- a/src/pages/en/index.astro +++ b/src/pages/en/index.astro @@ -2,4 +2,4 @@ import Page from '../index.astro'; --- - + diff --git a/src/pages/index.astro b/src/pages/index.astro index 014f4eb..0ed2009 100644 --- a/src/pages/index.astro +++ b/src/pages/index.astro @@ -16,10 +16,19 @@ import { getFaq, getCta, } from '../data/home'; +import type { SupportedLocale } from '../data/home/navigation'; +interface Props { + /** Locale esplicito dalle route /en e /th (evita ambiguità se la page è importata come componente). */ + locale?: SupportedLocale; +} + +const { locale: localeProp } = Astro.props; const path = Astro.url.pathname; const localeMatch = path.match(/^\/(en|th)(\/|$)/); -const currentLocale = (localeMatch?.[1] ?? 'it') as 'it' | 'en' | 'th'; +const currentLocale = (localeProp ?? + (localeMatch?.[1] as SupportedLocale | undefined) ?? + 'it') as SupportedLocale; const navigation = getNavigation(currentLocale); const siteMeta = getSiteMeta(currentLocale); const hero = getHero(currentLocale); diff --git a/src/pages/th/index.astro b/src/pages/th/index.astro index 8ed3bf2..f393f31 100644 --- a/src/pages/th/index.astro +++ b/src/pages/th/index.astro @@ -2,4 +2,4 @@ import Page from '../index.astro'; --- - + diff --git a/src/scripts/nx-nav-spy.ts b/src/scripts/nx-nav-spy.ts index ac1e0aa..a1aebdb 100644 --- a/src/scripts/nx-nav-spy.ts +++ b/src/scripts/nx-nav-spy.ts @@ -75,8 +75,11 @@ function measureHeaderAndSync(): void { } function bind(): void { - const path = window.location.pathname; - if (path !== '/' && path !== '/index.html') return; + const path = window.location.pathname.replace(/\/$/, '') || '/'; + // Home IT (`/`) e home localizzate (`/en`, `/th`). + if (path !== '/' && path !== '/index.html' && path !== '/en' && path !== '/th') { + return; + } const header = document.querySelector('header'); measureHeaderAndSync(); -- 2.49.0 From b687bc8ac25f41a336e12b97a4635cde2882949d Mon Sep 17 00:00:00 2001 From: Javaxman Date: Thu, 30 Jul 2026 11:59:58 +0200 Subject: [PATCH 3/3] Riduce i micro-blocchi allo scroll alleggerendo canvas e spine SVG. Il canvas particelle era alto quanto tutto il documento e ridisegnava ogni frame; ora resta sul viewport e si ferma durante lo scroll. Co-authored-by: Cursor --- public/particle-bg.js | 130 ++++++++++++++++------------- src/components/DataflowSpine.astro | 22 ++--- src/styles/global.css | 12 ++- 3 files changed, 88 insertions(+), 76 deletions(-) diff --git a/public/particle-bg.js b/public/particle-bg.js index 3b886fd..29d6338 100644 --- a/public/particle-bg.js +++ b/public/particle-bg.js @@ -1,27 +1,28 @@ /** * Rete di particelle + linee (canvas #particleCanvas). - * Deve stare DENTRO il contenitore della pagina (es. .nx-grid-bg), non dietro body, - * altrimenti lo sfondo opaco della pagina lo copre. + * Limitato al viewport (non all’altezza documento): evita canvas giganti che + * bloccano lo scroll sulla home lunga. */ (function () { if (typeof window === 'undefined') return; var canvas = document.getElementById('particleCanvas'); if (!canvas) return; - var ctx = canvas.getContext('2d'); + var ctx = canvas.getContext('2d', { alpha: true }); if (!ctx) return; var reduced = window.matchMedia('(prefers-reduced-motion: reduce)').matches; - var particles = []; var mouse = { x: null, y: null, radius: 150 }; var raf = 0; + var running = false; + var cachedW = 0; + var cachedH = 0; + var scrollPauseTimer = 0; - function canvasSize() { - var p = canvas.parentElement; - if (!p) return { w: 0, h: 0 }; - var w = Math.max(1, Math.floor(p.clientWidth)); - var h = Math.max(1, Math.floor(p.clientHeight)); + function viewportSize() { + var w = Math.max(1, Math.floor(window.innerWidth || document.documentElement.clientWidth || 1)); + var h = Math.max(1, Math.floor(window.innerHeight || document.documentElement.clientHeight || 1)); return { w: w, h: h }; } @@ -29,8 +30,8 @@ this.x = Math.random() * w; this.y = Math.random() * h; this.size = Math.random() * 2 + 1; - this.speedX = (Math.random() - 0.5) * 1.5; - this.speedY = (Math.random() - 0.5) * 1.5; + this.speedX = (Math.random() - 0.5) * 1.2; + this.speedY = (Math.random() - 0.5) * 1.2; } Particle.prototype.draw = function () { @@ -58,46 +59,55 @@ var fx = dx / distance; var fy = dy / distance; var force = (mouse.radius - distance) / mouse.radius; - this.x -= fx * force * 5; - this.y -= fy * force * 5; + this.x -= fx * force * 4; + this.y -= fy * force * 4; } }; function init() { - var sz = canvasSize(); + var sz = viewportSize(); var w = sz.w; var h = sz.h; - if (w < 8 || h < 8) return; + cachedW = w; + cachedH = h; - var dpr = Math.min(window.devicePixelRatio || 1, 2); + var dpr = Math.min(window.devicePixelRatio || 1, 1.5); canvas.width = Math.floor(w * dpr); canvas.height = Math.floor(h * dpr); + canvas.style.width = w + 'px'; + canvas.style.height = h + 'px'; ctx.setTransform(dpr, 0, 0, dpr, 0, 0); particles = []; - var n = Math.floor((w * h) / 9000); - if (n > 130) n = 130; - if (n < 45) n = 45; + var area = w * h; + var n = Math.floor(area / 14000); + if (n > 80) n = 80; + if (n < 28) n = 28; + if (w < 768) { + n = Math.min(n, 40); + } for (var i = 0; i < n; i++) { particles.push(new Particle(w, h)); } } - function connect(w, h) { + function connect(w) { + var maxDist = w < 768 ? 110 : 140; var a; var b; var dx; var dy; var distance; var opacity; - for (a = 0; a < particles.length; a++) { - for (b = a + 1; b < particles.length; b++) { + var len = particles.length; + for (a = 0; a < len; a++) { + for (b = a + 1; b < len; b++) { dx = particles[a].x - particles[b].x; dy = particles[a].y - particles[b].y; distance = Math.sqrt(dx * dx + dy * dy); - if (distance < 150) { - opacity = (1 - distance / 150) * 0.22; - ctx.strokeStyle = 'rgba(59, 130, 246, ' + opacity + ')'; + if (distance < maxDist) { + opacity = (1 - distance / maxDist) * 0.2; + ctx.strokeStyle = 'rgba(59, 130, 246,' + opacity + ')'; ctx.lineWidth = 1; ctx.beginPath(); ctx.moveTo(particles[a].x, particles[a].y); @@ -109,9 +119,9 @@ } function frame() { - var sz = canvasSize(); - var w = sz.w; - var h = sz.h; + if (!running) return; + var w = cachedW; + var h = cachedH; ctx.clearRect(0, 0, w, h); var i; @@ -119,29 +129,33 @@ particles[i].update(w, h); particles[i].draw(); } - connect(w, h); + connect(w); raf = requestAnimationFrame(frame); } - function syncCanvasCssSize() { - var sz = canvasSize(); - canvas.style.width = sz.w + 'px'; - canvas.style.height = sz.h + 'px'; + function start() { + if (reduced || document.hidden || running || !particles.length) return; + running = true; + raf = requestAnimationFrame(frame); } - function onResize() { - cancelAnimationFrame(raf); - syncCanvasCssSize(); - init(); - if (!reduced && particles.length) { - raf = requestAnimationFrame(frame); + function stop() { + running = false; + if (raf) { + cancelAnimationFrame(raf); + raf = 0; } } + function onResize() { + stop(); + init(); + start(); + } + function setMouseFromEvent(e) { - var rect = canvas.getBoundingClientRect(); - mouse.x = e.clientX - rect.left; - mouse.y = e.clientY - rect.top; + mouse.x = e.clientX; + mouse.y = e.clientY; } window.addEventListener( @@ -152,22 +166,26 @@ { passive: true }, ); - var parent = canvas.parentElement; - if (parent) { - var ro = new ResizeObserver(onResize); - ro.observe(parent); - } + window.addEventListener( + 'scroll', + function () { + // Libera il main thread durante lo scroll; riprende subito dopo. + stop(); + if (scrollPauseTimer) window.clearTimeout(scrollPauseTimer); + scrollPauseTimer = window.setTimeout(function () { + start(); + }, 120); + }, + { passive: true }, + ); + + document.addEventListener('visibilitychange', function () { + if (document.hidden) stop(); + else start(); + }); window.addEventListener('resize', onResize, { passive: true }); - syncCanvasCssSize(); init(); - - if (reduced) { - return; - } - - if (particles.length) { - raf = requestAnimationFrame(frame); - } + start(); })(); diff --git a/src/components/DataflowSpine.astro b/src/components/DataflowSpine.astro index 542444f..ecdcf77 100644 --- a/src/components/DataflowSpine.astro +++ b/src/components/DataflowSpine.astro @@ -3,32 +3,20 @@ * Continuazione dei flussi dati dell'hero: dalla destra verso sinistra, * inclinazione verso il basso, fino alla fascia del titolo "Prodotti". * Dietro a testo e card (main ha stacking; questo blocco è z-0). + * Senza feGaussianBlur: il filtro SVG su un layer alto quanto il main + * rendeva lo scroll a scatti. */ ---