Privacy Policy

A. Categories of data

a. Data collected automatically. The Microsoft Azure infrastructure records the technical data implicit in the use of Internet protocols: IP address, requested resource, date and time, response code, browser and operating system. To limit abuse, the email check and the resending of the personal link count attempts per IP address in hashed form, in temporary server files that clear themselves.

b. Questionnaire data. Contact email, company name or professional's name, answers to the questions (106 for NIST, 40 for the voucher) and optional free-text notes. For the voucher also the region of the premises, employee and turnover bands, estimated amounts per category, project objective and current IT supplier.

c. Offer request (voucher only). Telephone number and note, both optional, together with the questionnaire data.

d. Results and reports. Scores, requirements traffic light, estimated grant and, for NIST, the report generated with artificial intelligence at the request of AtWorkStudio staff (section E).

e. Cookies. No profiling, analytics or third-party cookies: only the technical cookie that remembers the language and, for staff, the Microsoft Entra ID authentication cookie. This is why there is no banner.

f. Analytics and external tools. No analytics service, no plugin, social button or external font: every resource is served by assessment.atworkstudio.it.

B. Data controller

The data controller is AtWorkStudio S.r.l., registered office in Corso Giuseppe Garibaldi 14, 29121 Piacenza (PC), Italy, VAT IT01356200335. The controller can be contacted through the contact form.

C. Source of the personal data

The data is collected directly from the data subject, while browsing and filling in the questionnaires.

D. Purposes and legal basis

Browsing data. Technical operation and security of the service. Legal basis: legitimate interest of the controller (art. 6(1)(f)).

Questionnaires, personal link and results. Score calculation, results page, sending of the personal link by email and its later editing. Legal basis: consent of the data subject, given by ticking the box before submission (art. 6(1)(a)), and pre-contractual measures taken at the data subject's request (art. 6(1)(b)). The date and version of the accepted policy are recorded with the submission.

Voucher check and offer request. Requirements assessment, starting point description and grant estimate; every new check generates an internal notification to AtWorkStudio staff. If the data subject asks for an offer, the data reaches the staff, who reply in writing. Legal basis: pre-contractual measures at the data subject's request (art. 6(1)(b)).

Report with artificial intelligence (NIST only). At the request of AtWorkStudio staff, company name, answers and notes are sent to Anthropic to generate the evaluation report, on the same legal basis as the service. Free-text notes must not contain personal data.

The data is not used for marketing or profiling and is not sold or passed on to third parties.

E. Recipients of the data

The data may be processed by authorised AtWorkStudio staff, through a restricted panel protected by Microsoft Entra ID, and by suppliers appointed as processors pursuant to art. 28 GDPR:

• Microsoft Corporation: hosting of the application (Azure App Service) and of the database (Azure Database for MySQL) in the Italy North region, and Microsoft Entra ID for staff access. It processes technical browsing data as part of the service.
• Anthropic Ireland, Limited: Claude generative AI models for the NIST report, only when staff request it. It receives company name, answers and notes; the data is not used to train the models, in accordance with the supplier's commercial terms.

Emails (personal links, confirmations, internal notifications) are sent by AtWorkStudio's own mail servers. The data is neither disclosed nor sold.

F. Transfers to third countries

Application and database data stay in the European Union (Italy North region). Microsoft Corporation adheres to the EU-U.S. Data Privacy Framework (DPF) and the contractual relationship is governed by the Microsoft Products and Services Data Protection Addendum, including the Standard Contractual Clauses (SCC) approved by the European Commission.

For the AI report, the data sent to Anthropic may be processed in the United States. The transfer complies with Chapter V of the GDPR, on the basis of the Standard Contractual Clauses (art. 46) included in the supplier's Data Processing Addendum.

G. Retention period

• Submissions, answers, results and reports: 12 months from the last change, then automatic deletion. The data subject can delete everything at any time with the function on the confirmation page and in the personal-link email.
• Offer request data and internal notifications: for the time needed to reply and, afterwards, within the limits of applicable law or for legal protection.
• Technical browsing logs: according to Microsoft Azure's standard retention policies, at most 90 days. Database backups: 7 days.

H. Rights of the data subject

The data subject may at any time exercise the rights under articles 15 and following of the GDPR:

• Right of access to their personal data
• Right to rectification or erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing
• Right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it)

Where processing is based on the controller's legitimate interest, as for technical browsing data, the data subject may object at any time; the controller then stops processing the data unless compelling legitimate grounds prevail.

Rectification and erasure are exercised directly with the personal link; for everything else the controller can be reached through the contact form.

I. Whether providing data is mandatory

Browsing data is necessary for the service to work. Filling in the questionnaires is optional: without an email and a company name the answers cannot be saved and no personal link can be sent. Telephone and note in the offer request are optional.

J. Processing methods and security

The data is processed with IT tools, with technical and organisational measures appropriate to the risk under art. 32 GDPR: HTTPS/TLS transmission, encryption of data at rest on Azure, restricted panel with Microsoft Entra ID, access by the data subject through a 64-character personal token, input validation and prepared statements, least privilege. The controller's management system is certified UNI CEI EN ISO/IEC 27001:2024 and UNI EN ISO 9001:2015, applying the ISO/IEC 27017:2015 and ISO/IEC 27018:2025 guidelines.

K. Automated decision-making

Scores, requirements traffic light and grant estimate are automatic calculations for information purposes, with no legal effect: eligibility for the voucher is decided by the Ministry during its review, and the AI report is a supporting text that AtWorkStudio staff read before any proposal. The controller does not take decisions based solely on automated processing, including profiling, under art. 22 GDPR.

L. Updates

This policy is provided for assessment.atworkstudio.it. The controller may update it in case of regulatory or technical changes; the latest version is always available on this page, with date and version number.