Privacy policy

Data controller

TecTrade di FC (trading as CAIO Lab), Via Venturini 71, 29121 Piacenza (PC), Italy, VAT no. 01741190332 — certified email tectrade@pec.it — email caiolab@aiassessment.it.

What this policy covers

This policy covers the processing for which CAIO Lab is the data controller: browsing the aiassessment.it website, back-office accounts, contact by email and public demos of the platform.

If you are taking part in an assessment run by an organisation (your employer, a professional body, a school), the controller of your data is that organisation, and CAIO Lab acts as a processor under art. 28 GDPR. The specific privacy notice is available from the opening screen of the questionnaire (link "Read the full privacy notice").

What data we process, and why

• Browsing data (IP address, access logs, timestamp): platform security and abuse prevention — legitimate interest (art. 6.1.f GDPR).
• Back-office accounts (email, hashed password, role) for administrators and for contacts at client organisations: delivery of the service — performance of a contract (art. 6.1.b GDPR).
• Contact requests by email: replying to the request — legitimate interest / pre-contractual measures.
• Public demos of the platform: any data you provide is processed on the basis of consent (art. 6.1.a GDPR), given before the answers are submitted.
• Usage statistics (page views, referrer, progress through the questionnaire, device type) collected with Google Analytics 4, with IP anonymisation and advertising signals switched off: improving the platform — consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code), collected through the cookie banner and withdrawable at any time. Without consent no analytics cookie is set. Details in the cookie policy.

Where the data is, and who processes it technically

Data is stored on infrastructure located in the European Union (Frankfurt). We rely on technical providers: Supabase (database), Vercel (application hosting), Amazon Web Services (processing with artificial intelligence systems via Amazon Bedrock, EU region — the data is not used to train the models), Google Ireland Ltd. (usage statistics via Google Analytics 4, only with prior consent), Automica (technical management and email delivery). Some providers belong to groups subject to United States jurisdiction: any transfers take place under the safeguards set out in Chapter V GDPR (EU-US Data Privacy Framework and/or standard contractual clauses).

Retention

Technical logs are kept for a maximum of 12 months. Back-office account data is kept for the duration of the contractual relationship with the client organisation. Data from public demos is kept for as long as the demonstration purposes require, and in any case no longer than 12 months. Google Analytics 4 statistical data is kept for 14 months, the shortest period the tool allows.

Your rights

You may exercise your rights of access, rectification, erasure, restriction, objection and portability (arts. 15–22 GDPR) and withdraw any consent by writing to caiolab@aiassessment.it. You also have the right to lodge a complaint with the Italian data protection authority (www.garanteprivacy.it) or with the supervisory authority of your country of residence.

Cookies

Information on the cookies used — including analytics cookies, which require your consent — is in the cookie policy. You can withdraw consent at any time from the «Cookie preferences» link at the bottom of every page.