Privacy Policy

Data controller and contact

OSIAX S.R.L. is the data controller for the processing described here. The identification details supplied to date appear above. For questions or to exercise a data-protection right, write to the registered office at Viale Villa Gavotti, 81/2, 16155 Genova (GE), Italia.

Data, purposes, and legal bases

We process only the data required for the interaction you choose. We do not sell personal data and we do not use client content to build advertising profiles.

• Site operation and security: IP address, request date and time, requested URL, browser and device information, response status, and security events. Purpose: deliver, secure, diagnose, and prevent abuse of the site. Legal basis: our legitimate interest in operating a secure service (art. 6(1)(f) GDPR).
• Language and interface preferences: the language cookie and local browser preferences described in the Cookie Policy. Purpose: remember choices and provide requested functionality. Legal basis: providing the service requested by the user and our legitimate interest in a usable site (art. 6(1)(b) and (f)); no consent is required for strictly necessary storage.
• Calendly booking: name, email address, chosen time, time zone, and answers or notes entered in the booking form. Purpose: arrange and hold the requested call. Legal basis: steps taken at your request before a contract (art. 6(1)(b)). Calendly also processes technical and cookie data under its own notice.
• WhatsApp contact: phone number, profile name, message content, and message metadata. Purpose: reply to the enquiry. Legal basis: steps requested by you and our legitimate interest in handling enquiries (art. 6(1)(b) and (f)). Meta also acts as an independent controller for WhatsApp.
• Live voice demos: after you actively start a demo, microphone audio, its live transcript, session events, and a pseudonymous safety identifier derived from the connection IP are processed to provide the conversation and prevent abuse. Legal basis: providing the demo you requested and our legitimate interest in service security (art. 6(1)(b) and (f)). Do not provide real names, contact details, health data, or confidential information in a public demo.
• Architect workspace: client identity and access data, interview answers, uploaded documents, generated analysis, and technical activity required to recover the work session. Purpose: provide the commissioned assessment and protect client access. Legal basis: performance of a contract (art. 6(1)(b)) and our legitimate interest in security (art. 6(1)(f)).
• Campaign measurement: only after consent, campaign parameters, advertising click identifiers, source and device category, booking-button placement, and conversion events are processed by Google Ads and the OpenAI advertising pixel. Purpose and legal basis: measure campaigns with your consent (art. 6(1)(a)). No advertising measurement SDK is loaded before consent.

Required and optional data

Browsing data is generated automatically when the site is requested. Fields marked as required by Calendly or a private client workspace are necessary to provide that service; without them we cannot schedule the call or deliver the workspace. WhatsApp, the public voice demos, optional booking notes, and advertising measurement are voluntary. Refusing advertising consent does not restrict the site or booking service.

Recipients and service providers

Access is limited to authorized Osiax personnel and providers that need the data to supply their service. Depending on the service and its contractual role, a provider acts as our processor or as an independent controller.

• Vercel Inc. — website delivery, hosting, and request logs.
• Amazon Web Services — application backend and database infrastructure.
• OpenAI — AI assessment generation and the optional live Realtime voice demos. API content is not used to train OpenAI models unless Osiax separately opts in.
• Calendly LLC — scheduling and the embedded booking page; Calendly manages its own cookie choices and controller activities under its notice.
• Google Ireland Limited — Google Ads campaign and booking-conversion measurement, only after consent.
• OpenAI — ChatGPT Ads campaign and booking-conversion measurement, only after consent.
• Meta Platforms — WhatsApp, when you choose to open a conversation.

International transfers

Some providers and their subprocessors may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, including the EU–US Data Privacy Framework for participating recipients, or on the European Commission’s Standard Contractual Clauses and appropriate supplementary safeguards. You may request information about the safeguard applicable to your data.

Retention

Enquiry correspondence is kept for up to 24 months after the last exchange. Osiax does not save public voice-demo recordings or transcripts; OpenAI may retain Realtime API abuse-monitoring data for up to 30 days under its API controls. Client workspace data is retained for the engagement and for the period set by the client agreement or needed to establish or defend a claim. Contracts, invoices, and accounting records are retained for 10 years where Italian law requires it. Security and access logs are retained for up to 12 months. Browser preferences remain for the periods listed in the Cookie Policy or until you clear them; consented attribution records expire after 30 days or are removed when consent is withdrawn.

Your rights

You may request access, correction, erasure, restriction, objection, and—where applicable—data portability. You may withdraw consent at any time, without affecting processing already carried out lawfully; use Cookie settings for advertising measurement. To exercise another right, write to the registered office at Viale Villa Gavotti, 81/2, 16155 Genova (GE), Italia. We normally respond within one month. You may also lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Automated decisions and security

The site does not make decisions based solely on automated processing that produce legal or similarly significant effects for visitors. AI-generated assessment material supports human and client decisions; it does not make them. We use TLS in transit, access controls, hashed client access keys, short-lived credentials for voice demos, rate limits, and restricted operator access. No internet service can guarantee absolute security.