Version dated May 24, 2026 · Under EU Regulation 2016/679 (GDPR)
1. Data Controller
Ai&volutions
VAT no. IT03316300601
Via Agnonello, 11/A — 03039 Sora (FR), Italy
Contact: info@aievolutions.it
2. Categories of Data Processed
This website collects and processes personal data only to the extent strictly necessary to provide its interactive services. The data categories include:
Browsing data: IP address, browser type, operating system, visited pages, and request date/time. This data is temporarily collected by hosting systems during normal browsing.
Data voluntarily provided for AI services (Chatbot and Digital Maturity Assessment):
Chatbot (Virtual Assistant): messages, questions and information entered by the user in the chat input field.
Digital Maturity Assessment: provided name or company name, organization profile, and answers selected in the 10-step questionnaire.
Technical cookies and localStorage: required for proper site operation (e.g., cookie consent storage and temporary storage of assessment answers for report generation). For details, see the Cookie Policy.
3. Purposes and Legal Bases
Technical operation of the website: legal basis — legitimate interest (Art. 6(1)(f) GDPR).
Use of chatbot and digital maturity services: data entered in chatbot or assessment forms is processed to deliver requested services (performance of pre-contractual measures / requested service, Art. 6(1)(b) GDPR).
Traffic analysis: legal basis — consent (Art. 6(1)(a) GDPR), expressed through the cookie banner where applicable.
Legal obligations: browsing data may be retained to investigate unlawful activity (Art. 6(1)(c) GDPR).
4. Data Recipients
Data is not sold or publicly disclosed. For service delivery, data may be communicated to:
Hosting technical providers appointed as data processors under Art. 28 GDPR.
Anthropic, PBC: to provide chatbot responses and digital maturity reports, user-entered text and questionnaire answers are temporarily sent via secure API to Anthropic AI models (Claude). According to Anthropic enterprise API policy, submitted API data is not used to train foundation models.
Google: to display the embedded contact map and load web fonts.
5. International Data Transfers
Personal data is primarily processed within the European Economic Area (EEA). For AI services (Anthropic Claude), user-entered data may be transferred to and processed in the United States. Such transfers are governed by safeguards under Chapter V GDPR, including Standard Contractual Clauses (SCCs).
6. Retention Periods
Browsing data is retained for up to 12 months, unless required for legal investigation. Data sent to chatbot and digital maturity tools is processed on demand and not permanently stored in controller-side databases. Assessment answers and cookie consent are stored locally in the user browser (`localStorage`) for up to 6 months, unless manually removed earlier.
7. Data Subject Rights
Under Arts. 15–22 GDPR, data subjects may:
access personal data (Art. 15);
request rectification (Art. 16) or erasure (Art. 17);
request processing restriction (Art. 18);
object to processing (Art. 21);
withdraw consent at any time, without affecting lawfulness of prior consent-based processing.