Privacy notice

Controller and contacts

The data controller is [[DA CONFERMARE: ragione sociale del titolare]], registered at [[DA CONFERMARE: sede legale completa]], [[DA CONFERMARE: P. IVA / C.F. / n. REA]].

For anything concerning your personal data, including exercising the rights described below, write to [[DA CONFERMARE: indirizzo email per le richieste privacy]].

[[DA CONFERMARE: if a Data Protection Officer is appointed, their contact details belong here.]]

What data we process

Only what we need to run the service:

• Email address. It is your identity on the platform: it signs you in and receives your report. Until you confirm it through the link we send, we treat it as unverified.
• Display name. So colleagues at your company can recognise you inside the product. Using your name to attribute an open answer to you is a different thing, and needs a separate consent.
• Company affiliation. The fact that you belong to a given company, and in which role (owner, admin, member), is itself personal data. Administrators at your company see the member list with names and emails; an ordinary member sees only how many people there are, not who they are.
• Questionnaire answers, including drafts saved before submission.
• Professional-profile data, described in the next section.
• Authentication events (successful and failed sign-ins, session refreshes and revocations), recorded so we can notice unauthorised access attempts.
• Consent record: which consent you gave or withdrew, when, and against which version of the text. It exists to demonstrate that the consent was actually given.

If you write to us through the site’s contact form, we receive your company name, your email address, optionally a phone number and website, and your message. None of it is stored in any repository: it becomes one email to our inbox and nothing else.

Professional-profile data

To make your result comparable with similar organisations, we ask about your role: the area you work in, and how far your work already involves artificial-intelligence tools.

These fields are optional and we process them only with your consent. Without it you can still use the service: the comparison with similar organisations is less precise, but nothing is withheld from you. Withdraw the consent and we delete the data.

We do not ask for — and we ask you not to enter — data revealing political or religious beliefs, trade-union membership, health, sexual orientation, or ethnic origin. The questionnaire is not designed to collect them and we have no lawful basis to process them.

Purposes and lawful bases

What we do	With what	Lawful basis
Sign you in and keep your session	Email, password, session token	Performance of a contract (Art. 6(1)(b))
Deliver your report and service messages	Email	Performance of a contract
Process your answers and produce the report	Questionnaire answers	Consent (Art. 6(1)(a))
Compare your result with similar organisations	Professional-profile data	Consent
Show your company an aggregated result	Answers, in aggregate	Consent
Let administrators read individual answers	Attributable answers	Separate consent
Attribute an open answer to you by name	Open answers, name	Separate consent
Defend the service against abuse	IP address, authentication events	Legitimate interests (Art. 6(1)(f))
Reply to people who use the contact form	Message details	Legitimate interests
Demonstrate that consents were obtained	Consent record	Legal obligation (Art. 7(1))

The consents are independent of one another: you can give one and refuse another, and you can withdraw any of them at any time from your account page. Withdrawal does not affect processing carried out beforehand. When you withdraw consent for questionnaire answers or professional-profile data, we delete that data, leaving the rest of your account untouched.

Who receives your data

Your company. This is the most sensitive part of the service and we want it clear before you answer, not after: your answers feed a company report. Exactly what your company sees, what it does not, and where aggregation stops protecting you when there are few of you, is set out in the dedicated notice for questionnaire respondents, which we ask you to read before you start.

A consulting firm, if your company involves one. An administrator at your company can request support from a consultant; from that moment that firm — named on screen before the click — has read-only access to the company report. That is a company decision, not yours, and the company can revoke it at any time.

Our technical suppliers, acting as processors on our instructions and never for their own purposes:

• Cloudflare — compute, database, file storage and site delivery, plus the anti-abuse check on public forms.
• Brevo — delivery of service emails. [[DA CONFERMARE: signed DPA and processing region.]]

We do not sell personal data, do not share it with advertisers, and do not use it for advertising. We load no fonts, scripts or images from third-party CDNs: everything your browser downloads comes from our own domain.

How long we keep it

Data	Retention
Account and its answers	As long as the account exists; you can delete it whenever you like
Accounts started and never completed	90 days after last activity, then deleted [[DA CONFERMARE]]
History of submitted responses	Indefinitely while the account exists, because it is the time series that makes your progress readable; deleted with the account
Authentication events	90 days [[DA CONFERMARE]]
Consent record	[[DA CONFERMARE: depends on the Art. 7(1) vs Art. 17 decision — see review notes]]
Contact-form messages	Not stored; they exist only in our mailbox [[DA CONFERMARE: mailbox clean-up policy]]

Transfers outside the EU

Our suppliers run on globally distributed infrastructure, and a transfer outside the European Economic Area cannot be excluded. Where one occurs, it relies on the standard contractual clauses approved by the European Commission and on the supplementary measures agreed with the supplier.

[[DA CONFERMARE: processing regions actually configured for each Cloudflare service and for the mail provider, and references to the signed DPAs.]]

Your rights

At any time you can:

• Access your data and obtain a machine-readable copy from your account page (access and portability, Arts. 15 and 20).
• Delete your account and the data attached to it, from the same page (Art. 17).
• Withdraw a consent without giving us a reason (Art. 7(3)).
• Object to processing based on legitimate interests (Art. 21).
• Ask for inaccurate data to be corrected (Art. 16). Some corrections currently require writing to [[DA CONFERMARE: indirizzo email per le richieste privacy]]: submitted answers are immutable by design, because they are a snapshot of a moment; to update the picture you complete a new assessment.
• Lodge a complaint with the Garante per la protezione dei dati personali (https://www.garanteprivacy.it) if you believe the processing breaches the law.

We respond within one month.

Cookies and local storage

We have no tracking cookies, no advertising, and no third-party analytics. That is why there is no consent banner: everything we store is technically necessary to run the service. The detail is in the cookie policy.

Automated decisions

The report contains scores and suggestions generated by automated rules, but it produces no automated decisions with legal effect concerning you: the results are working material, reviewed and contextualised by a person before they become a proposal. We do not profile people to assess individual performance.

Changes to this notice

Every version of this document carries a number and a date, shown at the top of the page. When a change materially alters what we do with your data, we do not simply publish it: we ask for your consent again, and the previous consent stops applying.