This page sets out what we collect, why, who we share it with, and how you can exercise your rights. It is written to be read, not filed.
Iside Systems SRLS, Via Tortona 12, 20144 Milan, Italy. VAT IT14733480967.
For anything concerning personal data, write to alessandro@iside.systems.
We have not appointed a Data Protection Officer: none of the cases in Article 37 of Regulation (EU) 2016/679 (GDPR) applies.
The site is hosted by Vercel Inc. Its servers record, for as long as technically necessary, the information browsers send by their nature: IP address, date and time of the request, the page requested, browser type and operating system. This is used to serve the site, diagnose faults and defend it from abuse.
Legal basis: our legitimate interest in running and protecting the site (Art. 6.1.f GDPR).
If you write from the form on the About page we collect your name, email address and whatever you choose to put in the message, along with any organisation and topic. We use it to answer you and, if the enquiry becomes a project, to manage the engagement that follows.
The message is delivered through Mailjet (Sinch Email, based in the European Union), acting as a processor.
Legal basis: answering your request and pre-contractual steps (Art. 6.1.b GDPR).
The check can be taken without signing up and without leaving any personal data. The answers describe the organisation — size, sector, processes, tools — not the person giving them.
To produce the closing summary, the answers and the scores are sent to OpenAI, L.L.C. through its API, without your name or email: we ask for those afterwards, and only if you want the report. Requests are sent with storage disabled and, under OpenAI's API terms, are not used to train models.
If you fill in the form at the end, we collect your first name, last name and email and send you the report by email; a copy of the same report, together with the answers you gave, reaches us so we can reply on the substance. None of it is written to a database: it stays in the mailboxes.
The report is an indicative reading built from your answers. It is not an automated decision producing legal effects or similarly significantly affecting you under Art. 22 GDPR.
Legal basis: providing the service you asked for and pre-contractual steps (Art. 6.1.b GDPR).
The site uses Google Tag Manager and Google Analytics 4 to understand how many people visit and which pages they read. These tools write cookies on your device.
Technical cookies, needed to run the site and to remember your cookie choice, are used without consent because the site does not work without them. Measurement and advertising cookies are only switched on after you consent, which we ask for with the banner on your first visit and which you can refuse or withdraw at any time.
Until you consent, consent is set to "denied" for every purpose that requires it (Google Consent Mode): requests to Google carry no advertising identifiers.
Your choice is kept in your browser (local storage, key iside-consent) and is not sent to us. To withdraw it, clear the site data in your browser settings: the banner will appear again on your next visit.
Legal basis: consent for measurement and advertising (Art. 6.1.a GDPR and Art. 122 of the Italian Privacy Code); legitimate interest for technical cookies.
When we promote a page on Google or LinkedIn, the link may carry parameters telling us which campaign the visit came from. That is information about the campaign, not about you.
If you have consented to advertising cookies, Google and LinkedIn may use their own identifiers to measure campaign results under their own privacy notices.
Data is handled by the controller and by the suppliers that make the service possible, appointed as processors under Art. 28 GDPR: Vercel Inc. (hosting), Sinch Email / Mailjet (email delivery), Google Ireland Ltd. (measurement and advertising), OpenAI, L.L.C. (generating the AI Maturity Check summary), LinkedIn Ireland Unlimited Company (advertising, where running).
We do not sell or hand data to third parties for their own purposes. It may be disclosed to public authorities where the law requires it.
Some suppliers are based in the United States. Transfers rely on the applicable adequacy decisions — including the EU-U.S. Data Privacy Framework for suppliers certified under it — or on the standard contractual clauses adopted by the European Commission, together with the supplementary measures set out in the respective agreements.
Correspondence and contact details stay in our mailboxes for as long as it takes to handle the request and any engagement that follows, and in any case no longer than 24 months from the last contact, save for legal obligations (tax rules, for instance) that impose longer terms.
Measurement data is retained by Google Analytics according to the service settings, and appears in reports in aggregate form.
Server logs are kept for the period set by the hosting provider.
You may at any time request access to your data, its rectification or erasure, restriction of processing, portability, and you may object to processing based on legitimate interest (Arts. 15-22 GDPR). Where processing is based on consent, you may withdraw it at any time, without affecting what was done before the withdrawal.
To exercise them, write to alessandro@iside.systems. We answer within one month.
If you believe the processing infringes the Regulation you may lodge a complaint with the Italian data protection authority (garanteprivacy.it) or with the authority of the country where you live.
If the tools we use change, this page changes with them. The date below says when it was last updated.