This notice describes how personal data is processed for users who register and use GRADO Academy, the LMS e-learning platform operated by GRADO TECH Srls, including live video lessons (virtual classrooms / synchronous distance learning) and related recordings. It is issued pursuant to Arts. 13 and 14 of EU Regulation 2016/679 (GDPR) and, for image and voice, takes into account Arts. 10 of the Italian Civil Code and 96–97 of Italian Law 633/1941.

How the service is used

GRADO Academy may be used in three distinct contexts, with different roles regarding personal data:

• Direct registration with GRADO Tech (Part A): the user registers through GRADO Tech; GRADO TECH Srls is the data controller and owner of the data.
• Enti service (Part B): registration takes place on the portal operated by AB INNOVATIVE S.R.L., commercially known as GRADO Hub; AB INNOVATIVE S.R.L. is the data controller and GRADO TECH Srls acts as data processor for platform delivery.
• Customer workspaces (Part C): an organisation has purchased or activated a dedicated Academy workspace; the organisation managing the workspace is the data controller and GRADO TECH Srls acts as data processor for the technical infrastructure.

In all three contexts the platform may deliver live video lessons. The rules on virtual classrooms, audio/video, chat, attendance and recordings are set out in the section Live video lessons. Controller and processor roles remain those in Parts A, B and C.

Live video lessons (virtual classrooms)

GRADO Academy includes live video lessons (virtual classrooms / synchronous distance learning) which teachers, enrolled learners and, if the organiser allows it, guests via a dedicated link may join. By entering the room you acknowledge that the lesson may be recorded and that audio, video, shared screen, chat and attendance data are processed for the training purposes set out in this notice. Recording is not necessarily automatic: it is started by the teacher or organiser; when it is on, a visual indicator («Recording in progress») is shown in the room.

The video call is delivered with self-hosted Jitsi Meet software on GRADO TECH Srls infrastructure, on its own domain (e.g. meet.gradotech.it), hosted in the European Union with Aruba S.p.A.. A public videoconferencing provider is not used (8x8 / meet.jit.si, Zoom, Microsoft Teams, Google Meet). Audio/video streams remain on the same infrastructure; access to the room is limited to users authenticated on the platform or guests holding a valid link and token. Automatic transcription and public livestreaming are not enabled as a rule.

Data processed during the lesson

During a live video lesson the following may be processed:

• In-room identity: name and surname (or the name chosen by the guest), role (organiser, teacher, participant, guest), email address associated with the account where present.
• Audio and video: voice and image if microphone and/or webcam are enabled. You may turn them off; if they remain off, no audio or video is transmitted from your device, without prejudice to attendance tracking.
• Screen sharing: whatever you voluntarily show to other participants (presentations, documents, desktop).
• Session chat: messages visible to other participants; if the lesson is recorded, they may appear in the file to the extent technically included in the capture.
• Attendance: date and time of join and leave, duration, user or guest identifier, association with the course/lesson. Teachers and administrators appear in the register even without course enrolment.
• Technical connection data: IP address, device and browser type, network quality strictly necessary for the room to function. No biometric identification or automated facial recognition is performed.

Recordings

The teacher or organiser may start a server-side recording of the lesson (video file, typically MP4). Learners and guests cannot start recording. The file is stored in the relevant Academy workspace storage.

• The recording may contain what is transmitted in the room: voices, faces, backgrounds visible on webcam, shared screens, chat and any other content shown or spoken by participants.
• Purposes: documentation of training delivery, proof of attendance, possible later viewing by authorised persons, quality checks, defence in the event of disputes, and legal obligations on mandatory training, where applicable.
• Recordings are not disclosed to third parties for marketing, not published on social networks or public websites, and not used for commercial profiling or biometric recognition systems.
• Image and voice are processed as ancillary to delivery of the lesson (Art. 6(1)(b), (c) and/or (f) GDPR; Arts. 10 Italian Civil Code and 96–97 of Italian Law 633/1941). Separate consent for advertising purposes is not required, because such use is excluded.
• The right to object to recording may be limited where recording is necessary to perform the training contract or to comply with legal obligations. You may always disable webcam and microphone. Erasure of the file may be refused or deferred where retention is necessary for other participants, legal obligations or the establishment, exercise or defence of legal claims.

GRADO TECH Srls is not responsible for content independently communicated by participants (statements, documents shown, third parties appearing in frame). Whoever starts or retains the recording in their workspace must use it only for training purposes and within the limits of this notice or of the controller's notice (Parts B and C).

Legal basis (Part A)

Where GRADO TECH Srls is the controller (Part A), processing of audio, video, chat, attendance and recordings is based on performance of the training contract (Art. 6(1)(b) GDPR), legal obligations on training documentation and occupational safety where applicable (Art. 6(1)(c)) and legitimate interest in proving delivery, preventing abuse and defending against disputes (Art. 6(1)(f)). The balancing test takes into account that this is a training event, that recording is signalled in the room, that webcam and microphone can be turned off, and that files are not intended for publication.

Roles in Parts B and C

In the Enti service (Part B) and in customer workspaces (Part C) GRADO TECH Srls acts as data processor (Art. 28 GDPR): it provides the Jitsi room, attendance logs and recording storage according to the controller's instructions. Whether to use video calls and whether to record is decided by the controller (AB INNOVATIVE S.R.L. or the workspace organisation), which must inform data subjects and have a legal basis. GRADO TECH Srls does not determine those choices and does not use recordings for its own purposes.

Participant obligations

Anyone who enters the room (learner, teacher, administrator or guest) must:

• control the environment in frame: do not film minors or other third parties without a lawful basis, nor confidential documents, health data or third-party information unrelated to the lesson;
• not communicate special categories of data (health, political opinions, trade-union membership, etc.) unless strictly necessary for the subject of the course;
• use webcam, microphone, chat and screen sharing lawfully and only as relevant; what you communicate is visible to other participants and may end up in the recording;
• if you join as a guest, provide a truthful name; entering the room constitutes acknowledgement of this notice and of possible recording.

GRADO TECH Srls is not responsible for participants' breach of these obligations, nor for damage arising from unlawful content or from third parties accidentally appearing in frame. The controller of the relevant workspace may take disciplinary measures or exclude anyone who abuses the room, within the limits of law and contract.

Who can access recordings

Files are accessible, within the relevant workspace, to workspace administrators and the lesson teacher, for playback, download or deletion. GRADO TECH Srls accesses them only within the limits already stated for technical support and security (Parts B and C) or, in Part A, as controller. Learners do not, as a rule, have independent download of recordings, unless the workspace controller allows it by other means.

Retention of attendance and recordings

Attendance logs and recording files follow the same periods as training documentation: in Part A, generally up to 10 years from course completion or termination of the relationship, unless different statutory periods or defence needs apply. In Parts B and C, periods are set by the controller; GRADO TECH Srls retains files for the contractual period and until deletion by the controller or orderly service termination. Deleting a live session as a rule also deletes the related recording files and attendance logs.

Part A — Direct registration with GRADO Tech

This section applies when you register for GRADO Academy directly through GRADO TECH Srls (website, commercial contract, or other direct channels).

Data controller

The data controller is GRADO TECH Srls, registered office at Corso Umberto I, 7 — 66050 San Salvo (CH), Italy. VAT IT02868240694. Email: info@gradotech.it — Phone: +39 378 421 3717.

Categories of personal data processed

To provide the GRADO Academy service we process the following categories of data:

• Identity data: name, surname, tax code.
• Contact and credentials: email address, phone number, password (stored exclusively as an irreversible hash; never accessible in plain text).
• Professional and training data: employer or organisation, role/job title, enrolled courses, assigned training paths.
• E-learning delivery data: module progress, viewing time, quiz and test results, scores, completion dates, attendance at live video lessons (join, leave, duration).
• Certificates: data shown on training certificates generated by the platform (name, surname, course, date, outcome).
• Technical access data: authentication logs, IP address, device and browser type, operation timestamps.
• Live video-lesson data: display name in the room, role (teacher, participant, guest), audio and video if microphone or webcam are enabled, screen sharing, chat messages, session recording files where started by the teacher. Details: Live video lessons.

Purposes of processing

• Creation and management of the user account and access to the GRADO Academy platform.
• Delivery of e-learning courses, training paths, quizzes, live video lessons (virtual classrooms / synchronous distance learning) and related tracking features.
• Generation, storage and delivery of training completion certificates.
• Compliance with mandatory training obligations under occupational health and safety law, where applicable.
• Technical support, service communications and contractual relationship management.
• IT security, abuse prevention and unauthorised access prevention.
• Recording of live video lessons, where started by the teacher or organiser, for training documentation, proof of delivery and attendance, possible later review by those who could not attend live, and defence in the event of disputes. Recordings are not used for marketing, commercial profiling or publication on public channels.

Legal basis

• Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR): registration, training delivery (including live video lessons), account management and, where part of the service, recording of the lesson.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR): retention of training documentation and occupational safety obligations, where applicable, including proof of attendance in synchronous distance learning.
• Legitimate interest of the controller (Art. 6(1)(f) GDPR): platform security, fraud prevention, quality of delivery and defence in the event of disputes (including through recordings and attendance logs).

Retention period

Profile data, training records, attendance logs for live video lessons and session recordings (where made) are retained for the duration of the contractual relationship and, thereafter, for the period required by applicable training and occupational safety law (generally up to 10 years from course completion or termination of the relationship, unless different statutory periods or defence needs apply). Technical access logs are kept for a maximum of 90 days, unless required to investigate offences or disputes.

Recipients of data

Data is not sold or shared with third parties for marketing purposes. It may be disclosed to: Aruba S.p.A. (Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy — VAT 01573850516), as provider of infrastructure services connected to the platform, including the infrastructure on which GRADO TECH Srls delivers live video lessons and synchronous distance learning with self-hosted Jitsi Meet (environment managed on its own domain, e.g. meet.gradotech.it; this is not the public 8x8 / meet.jit.si service); advisors, professionals or authorities to fulfil legal obligations. Recording files remain in the relevant workspace and are accessible only to authorised personnel (workspace administrators and the lesson teacher). Providers processing data on our behalf are bound by agreements under Art. 28 GDPR, where applicable. Aruba privacy and GDPR information: Aruba GDPR and Aruba privacy notice.

Transfers outside the EU

Data is processed primarily within the European Union, including through Aruba S.p.A. (Italy). More information: aruba.it/gdpr. Live video lessons, audio/video streams and recording files are delivered and stored on infrastructure managed by GRADO TECH Srls (self-hosted Jitsi Meet) and do not involve transferring data to an external videoconferencing provider (Zoom, Microsoft Teams, Google Meet and the public Jitsi service are not used). Any further transfers to third countries occur only where adequate safeguards are in place (Standard Contractual Clauses or adequacy decisions).

Your rights

As a data subject, you may exercise the following rights at any time pursuant to Arts. 15–22 GDPR:

• access to your personal data;
• rectification or erasure;
• restriction of or objection to processing;
• data portability;
• withdrawal of consent, where applicable;
• lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

To exercise your rights, please write to info@gradotech.it.

Part B — Enti service (GRADO Hub)

This section applies if you enrol in a training course through the application operated by AB INNOVATIVE S.R.L., commercially known as GRADO Hub. In this context GRADO TECH Srls does not determine the purposes of processing: it provides the GRADO Academy technology platform and delivers training on behalf of AB INNOVATIVE S.R.L.

Data controller and processor

Under the GDPR, the roles are as follows:

• Data controller: AB INNOVATIVE S.R.L., registered office at Via Domenico Spezioli 18 — 66100 Chieti (CH), Italy. VAT 02604850699. Email: info@abinnovative.it. AB INNOVATIVE S.R.L. collects data on its registration portal, manages the relationship with participants and determines the purposes of processing.
• Data processor: GRADO TECH Srls (address and contact details as stated in Part A). GRADO TECH Srls processes personal data received from AB INNOVATIVE S.R.L. exclusively on its behalf, to host data on the GRADO Academy platform and deliver e-learning services, under a data processing agreement pursuant to Art. 28 GDPR.

Data is not collected directly by GRADO TECH Srls on the Enti portal: it is transmitted by AB INNOVATIVE S.R.L. upon registration or synchronisation with the platform.

Categories of data processed by GRADO Tech (as processor)

On behalf of AB INNOVATIVE S.R.L., GRADO TECH Srls processes the following categories of participant data:

• Identity data: name, surname, tax code.
• Contact data: email address, phone number.
• Enrolment data: selected courses and paths, employer or organisation, identification codes assigned by the Enti portal.
• E-learning delivery data: progress, quiz and test results, attendance at live video lessons, completion dates.
• Certificates: data required to generate and store training certificates.
• Live video-lesson data: in-room identity, audio/video, chat, attendance logs and recording files, where the controller enables those features, as described in Live video lessons.

Purposes of processing (on behalf of AB INNOVATIVE S.R.L.)

GRADO TECH Srls processes data exclusively for the purposes specified by AB INNOVATIVE S.R.L. and limited to:

• Hosting and managing participant profiles on the GRADO Academy platform.
• Delivering e-learning courses, quizzes, live video lessons and tracking features.
• Generating, storing and making available training certificates.
• Providing reports and progress data to AB INNOVATIVE S.R.L. for service management.
• Ensuring platform security and proper operation.
• Hosting, on the controller's behalf, Jitsi rooms, attendance logs and live-lesson recordings, without using them for its own purposes.

Legal basis

Processing by GRADO TECH Srls, as data processor, is based on the performance of the data processing agreement with AB INNOVATIVE S.R.L. (Art. 28 GDPR). The legal basis vis-à-vis the data subject is determined by AB INNOVATIVE S.R.L. as controller (generally performance of the course enrolment contract or compliance with mandatory training obligations).

Retention period

Retention periods for data on the GRADO Academy platform are set by AB INNOVATIVE S.R.L. as controller and stated in the privacy notice on the Enti portal. GRADO TECH Srls retains data for the period contractually agreed with AB INNOVATIVE S.R.L. and, in any case, no longer than necessary to deliver the service and comply with applicable legal obligations.

Recipients of data

GRADO TECH Srls does not use Enti participant data for its own purposes. Data may be disclosed to technical sub-processors, in particular Aruba S.p.A. for the infrastructure services on which live video lessons (self-hosted Jitsi Meet) managed by GRADO TECH Srls also operate, as well as to AB INNOVATIVE S.R.L. itself as controller. Data is not sold or shared with third parties for marketing purposes.

Your rights

As a participant in the Enti service, your GDPR rights (access, rectification, erasure, restriction, objection, portability, complaint to the Authority) should primarily be exercised with the data controller:

• AB INNOVATIVE S.R.L. — info@abinnovative.it, or at its registered office, Via Domenico Spezioli 18, 66100 Chieti (CH). The e-learning privacy notice is published at /elearning/privacy on the Enti portal.
• You may also write to GRADO TECH Srls at info@gradotech.it for requests relating to data processed on the platform; we will forward the request to AB INNOVATIVE S.R.L. or respond within the limits of our role as data processor.
• You always have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

For completeness, AB INNOVATIVE S.R.L. is required to provide its own privacy notice to data subjects on the Enti portal, pursuant to Arts. 13 and 14 GDPR.

Part C — Customer-managed workspaces

GRADO Academy is a multitenant platform: in addition to the environments described in Parts A and B, an organisation (company, training provider, consultant) may purchase or activate a dedicated workspace with its own branding, courses and users. In that case the workspace is not owned by GRADO TECH Srls: responsibility for processing participants' personal data lies with the organisation that manages that workspace, which acts as data controller.

Where to find the applicable notice

If you access GRADO Academy through a workspace managed by a third-party customer, the sections of this notice relating to direct registration with GRADO Tech (Part A) do not apply to your case. You must refer to the privacy notice provided by the organisation managing the workspace, available via the «Privacy» link at the bottom right of the Academy dashboard page.

Data controller and processor

Under the GDPR, the roles are as follows:

• Data controller: the organisation that purchased or activated the workspace and manages its users, courses, enrolments and processing purposes.
• Data processor: GRADO TECH Srls (address and contact details as stated in Part A). GRADO TECH Srls processes personal data exclusively on the controller's behalf, to host it on the GRADO Academy platform and deliver the agreed technical services, under an agreement pursuant to Art. 28 GDPR.

Access to data by GRADO TECH Srls

GRADO TECH Srls does not freely access personal data held in third-party customer workspaces. It may view or process such data only where strictly necessary to deliver the technical service and only when duly authorised by the organisation managing the workspace (for example for support, maintenance or agreed interventions). Without authorisation, data remains segregated within the controller's workspace.

Live video lessons in customer workspaces

If the workspace enables live video lessons, the controller organisation decides whether to record, how long to keep the files and who may view them. It is the controller's duty to inform teachers, learners and guests (Arts. 13–14 GDPR) and to have a legal basis, including for image and voice. GRADO TECH Srls only provides the technical means (self-hosted Jitsi, storage, attendance logs) as data processor. Anyone who enters a room in a customer workspace acknowledges that the lesson may be recorded under the controller's rules and the section Live video lessons.

Your rights

As a participant in a workspace managed by a third-party customer, your GDPR rights (access, rectification, erasure, restriction, objection, portability, complaint to the Authority) should primarily be exercised with the data controller, as indicated in the workspace Privacy notice.

• Use the «Privacy» link at the bottom right of the Academy dashboard for the contact details and procedures set by the workspace controller.
• You may also write to GRADO TECH Srls at info@gradotech.it for requests relating to data hosted on the platform; we will forward the request to the controller or respond within the limits of our role as data processor.
• You always have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Security

GRADO TECH Srls implements appropriate technical and organisational measures to protect personal data processed on the GRADO Academy platform: irreversible password hashing, TLS-encrypted communications (including Jitsi rooms), least-privilege access control, room access tokens, regular backups, multitenant workspace segregation (including recordings and attendance logs), compliance with ISO/IEC 27001:2024 standards.

Changes to this notice

This notice may be updated to reflect regulatory, contractual or service changes. Any amendments will be published on this page with the date of the last update.