Privacy Policy

Who is the data controller

OSIAX S.R.L. is the data controller for the personal data described in this policy. For any question about this policy or to exercise your rights, contact TODO: privacy@osiax.com.

What we collect and why

We collect only what a specific interaction requires. We do not sell personal data and we do not use it for advertising profiling.

• Booking an interview: the name, email address, and any notes you enter into the Calendly scheduling form. Purpose: arranging and holding the call. Legal basis: steps taken at your request prior to entering a contract (art. 6(1)(b)).
• Contacting us on WhatsApp: your phone number, profile name, and the content of your messages. Purpose: answering your enquiry. Legal basis: our legitimate interest in responding to prospective clients (art. 6(1)(f)).
• Using the Architect workspace: the answers you give during the assessment interview and the resulting analysis. Purpose: delivering the assessment you commissioned. Legal basis: performance of a contract (art. 6(1)(b)).
• Language preference: a single functional cookie recording whether you are reading in English or Italian. Legal basis: strictly necessary for a service you requested, so no consent is required.

Processors and third parties

Some processing runs on infrastructure operated by others. Each acts as a processor under a data processing agreement, or as an independent controller where noted.

• Vercel Inc. — website hosting and request logs.
• Amazon Web Services (EU region) — the application backend and its database.
• OpenAI — generation of assessment content. Assessment inputs are sent to the model. We disable retention for training on our API traffic.
• Calendly LLC — interview scheduling. Calendly acts as an independent controller for its own cookies; see its own notice.
• Meta Platforms (WhatsApp) — where you choose to start a WhatsApp conversation, as an independent controller.

International transfers

Some of these providers process data outside the European Economic Area. Those transfers rely on the European Commission’s Standard Contractual Clauses, or on an adequacy decision where one applies.

How long we keep it

Enquiry correspondence is kept for up to 24 months from our last exchange. Client assessment records and deliverables are kept for the duration of the engagement and for 10 years after it, which is the retention period Italian law requires for accounting records. Server access logs are kept for up to 12 months.

Your rights

You have the right to access your data, to correct it, to have it erased, to restrict or object to processing, and to receive it in a portable format. Write to TODO: privacy@osiax.com and we will respond within one month. If you believe your data has been handled unlawfully you may lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Security

Traffic is encrypted in transit with TLS. Client access keys are stored only as salted hashes and are never recoverable in plain text. Access to client deliverables is restricted to the operator account.