This notice describes how personal data is processed in connection with GRADO Assistant, the cloud platform for training providers (client companies, workers/learners, courses, teachers, enrolments, tests, registers and certificates) operated by GRADO TECH Srls. It is issued pursuant to Arts. 13 and 14 of EU Regulation 2016/679 (GDPR), supplements the general privacy notice published on the GRADO Tech website, and applies to the currently available DEMO version, whose data is intended for production use.

How the service works

GRADO Assistant is multi-tenant SaaS software: the training provider (or the party managing the workspace) enters and manages data relating to its training activity. The role of GRADO TECH Srls varies depending on context:

• Client company, worker and learner data (Part A): the client training provider (or, where applicable, the client company) is the data controller; GRADO TECH Srls acts as data processor under Art. 28 GDPR, solely for technical service delivery and hosting.
• Access to data by GRADO Tech (Part B): GRADO TECH Srls does not freely access uploaded content; access is permitted only in the cases and manner described therein, including operational access to the tenant where provided by contract.
• Contractual, account and DEMO data (Part C): for registration, DEMO activation, subscription, billing and management of platform operator accounts, GRADO TECH Srls is the data controller.
• Managed / ticket-based service (Part B and Part E): where the provider or company enters into a documented contract or agreement (not verbal) with GRADO TECH Srls for operational management of training (e.g. e-learning for its client companies), GRADO TECH Srls may access the relevant workspace and process data within the scope of the engagement, including via e-learning platforms such as GRADO Academy or, on a transitional basis, Soluzione FAD.

Part A — Data entered by the training provider / client companies

This section applies to personal data that the training provider (or a party authorised by it) enters, uploads or generates on GRADO Assistant in connection with client companies, workers/learners, courses and training documentation. Such data remains under the control and responsibility of the controller; GRADO TECH Srls only hosts, stores and makes it available according to the contract and received instructions.

Roles in processing

For the data described in this Part A:

• the data controller is, as a rule, the training provider managing the workspace (or, where different, the client company or another party that determines purposes and means of processing);
• GRADO TECH Srls (registered office Corso Umberto I, 7 — 66050 San Salvo (CH), Italy. VAT IT02868240694) acts as data processor, on the basis of the service contract / DEMO activation and the Art. 28 GDPR agreement, to host, store, technically organise and make data available on the platform; where a documented operational management contract or agreement is in place (e.g. ticket-based service), GRADO TECH Srls may also process tenant data as appointed operator, solely within the scope of the engagement;
• partners, external teachers or other parties authorised by the provider may act as independent controllers, processors or controller's appointees: GRADO TECH Srls does not determine their purposes, except as expressly provided in the operational management contract.

The controller must provide data subjects with a GDPR-compliant privacy notice (Arts. 13–14) and have a valid legal basis for each processing activity, including those relating to mandatory training and documentation required by applicable law (e.g. Italian Legislative Decree 81/2008 and State-Regions Agreement, where relevant).

Categories of data processed on the platform

Depending on activated features, the platform may process, among others, the following data entered or generated by the controller:

• Client company data: company name, VAT number, ATECO code, sites, addresses, contacts, representatives, logo and related documentation.
• Worker / learner data: name, surname, tax code, date and place of birth, residence, job role, email, phone, hiring/termination dates, work site and attachments.
• Identity documents and signatures: type, number, expiry date and digital copies uploaded during enrolment or records management; any electronic/graphic signatures collected in platform forms.
• Enrolments, courses and teachers: courses, editions, teachers, operators, schedule, online enrolments, training venues and participation metadata.
• Tests, outcomes and self-declarations: answers to verification tests, outcomes, any self-declarations and documents attached by the participant.
• Registers, certificates and dossiers: attendance registers, PDF certificates, activity dossiers, generated forms and training attachments.
• Customer satisfaction: responses to course feedback questionnaires and related feedback.
• Platform users (provider operators, teachers, administrators): access credentials, roles, permissions, authentication logs.
• Technical and audit logs: records of operations, change tracking, IP addresses and technical data required for security and service operation (including public enrolment/test flows, where applicable).

Purposes of processing (on behalf of the controller)

GRADO TECH Srls processes Part A data exclusively on behalf of the controller and limited to the following technical purposes:

• delivery, hosting and maintenance of the GRADO Assistant platform and its features (records, enrolments, courses, tests, registers, certificates, reports, notifications, etc.), including in DEMO environments;
• execution of the controller's documented instructions, including storage, backup, recovery and deletion of data as agreed;
• IT security, abuse prevention, operational continuity and compliance with legal obligations applicable to the processor;
• technical support within the limits of Part B. GRADO TECH Srls does not use client company / provider data for its own marketing, commercial profiling, resale or independent analysis not strictly necessary for service delivery.

Legal basis

The legal basis for processing by the controller is determined by the controller. Processing by GRADO TECH Srls as processor is based on performance of the service contract / DEMO activation and the Art. 28 GDPR agreement (Art. 6(1)(b) GDPR), and where necessary on legitimate interest in platform security (Art. 6(1)(f) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

Retention

Retention periods for Part A data are determined by the controller, in compliance with applicable law (including mandatory training documentation obligations). Because data entered in DEMO is intended for production use, it is retained for the duration of the relationship and thereafter according to the controller's instructions and legal obligations; upon termination, data is returned or deleted as provided in the contract and Art. 28 agreement, unless otherwise documented or required by law.

Part B — Access to data by GRADO TECH Srls

GRADO TECH Srls does not freely access, consult or use content entered on GRADO Assistant without a lawful and documented basis. Access by authorised personnel to the tenant / workspace is permitted only in the following cases:

• Explicit delegation or authorisation by the controller: upon written request, email, ticket or other official documentable communication; verbal authorisations are not sufficient for ongoing operational access to the tenant;
• Strictly necessary technical assistance: interventions limited in time and scope to what is indispensable to diagnose malfunctions, configure the DEMO, restore service or respond to reports;
• Legal obligations: court orders or mandatory legal obligations, with notification to the controller where permitted;
• Platform security: aggregated monitoring or technical metadata without the purpose of consulting substantive content, except as strictly necessary to manage security incidents;
• Documented operational management contract or agreement: where GRADO TECH Srls is engaged, under a written contract or agreement (not verbal), to perform operator functions on the tenant — for example ticket-based management of e-learning training for the client's companies — access and processing are permitted within the scope and duration of the engagement.

Any access is limited to authorised staff, subject to confidentiality, logged where technically possible and limited to the duration of the intervention or engagement. GRADO TECH Srls does not sell data and does not disclose it to third parties for its own marketing or profiling purposes.

Managed service and e-learning platforms

Under a documented contract or agreement, GRADO TECH Srls may manage training for the client's related companies on a ticket-based or other agreed operational basis. Related data may be processed and hosted on GRADO TECH Srls e-learning platforms, in particular GRADO Academy and, on a transitional basis, Soluzione FAD. Access to the Assistant tenant and linked e-learning platforms is always subject to written documentation of the engagement and the limits set out therein.

Access logging

The platform records relevant operations (audit logs, user access, changes) to enable the controller to monitor activities. Technical assistance and operational management logs are retained for the time necessary for the contractual/DEMO relationship, security and traceability, generally no longer than 12 months unless disputes or legal obligations require otherwise.

Part C — Data for which GRADO TECH Srls is controller

This section applies to personal data collected directly by GRADO TECH Srls in connection with registration, DEMO, subscription, billing, commercial and contractual communications and management of platform administrative accounts.

Data controller

The data controller for Part C data is GRADO TECH Srls, registered office Corso Umberto I, 7 — 66050 San Salvo (CH), Italy. VAT IT02868240694. Email: info@gradotech.it — Phone: +39 378 421 3717.

Categories of data

• Identification and contact data: name, surname, email, phone, company name, VAT number of the requesting provider or company.
• DEMO activation and contractual data: trial requests, plan/subscription, payments, invoices, order history and activation terms.
• Credentials and access: username, password (irreversible hash), roles, any DEMO flags and access logs.
• Communications: information requests, commercial support, assistance and newsletters where subscribed.

Purposes

• Management of registration, DEMO and contractual relationship.
• Billing, payment collection and tax and administrative compliance, where applicable.
• Service communications, platform updates and, where consent is required, commercial communications.
• Security, fraud prevention and management of complaints or disputes.

Legal basis

Performance of contract or pre-contractual measures (Art. 6(1)(b) GDPR); compliance with legal obligations (Art. 6(1)(c) GDPR); legitimate interest in security and relationship management (Art. 6(1)(f) GDPR); consent for optional marketing activities (Art. 6(1)(a) GDPR), revocable at any time.

Part D — Rights of data subjects

Data relating to workers, learners and other parties entered by the provider on GRADO Assistant is processed by the data controller (the provider or workspace manager). Therefore:

• data subjects must exercise rights under Arts. 15–22 GDPR primarily with the controller indicated in the relevant privacy notice;
• they may write to info@gradotech.it for requests relating to data hosted on the platform: GRADO TECH Srls, as processor, will forward the request to the controller or respond within the limits of its role;
• the right to lodge a complaint with the Italian Data Protection Authority always remains (www.garanteprivacy.it).

The controller is responsible for providing data subjects with a complete and up-to-date privacy notice on processing carried out via GRADO Assistant.

Part E — DEMO, e-learning and sub-processors

DEMO nature of the service

GRADO Assistant is currently offered as a DEMO version. In particular: (i) features, interfaces and configurations may still evolve; (ii) the DEMO environment may be updated or migrated to production without interrupting continuity of the controller's data; (iii) data entered is intended for production use and must therefore be treated by the controller as real data (lawful, relevant and not excessive); (iv) white-label or partner instances may have their own notices. This notice covers the GRADO Assistant product delivered by GRADO TECH Srls.

Linked e-learning delivery

Where the managed service includes distance learning, data necessary to deliver courses may be processed on the e-learning platforms used by GRADO TECH Srls. The reference platform is GRADO Academy (dedicated notice available on the GRADO Tech website). On a transitional basis, the Soluzione FAD platform may also be used until migration or integration to GRADO Academy is completed. Use of such environments occurs only within the limits of the documented contract or agreement with the client and the training purposes set out therein.

Soluzione FAD — provider / sub-processor (transitional use)

For transitional use of the Soluzione FAD e-learning platform, Soluzione FAD S.r.l. (Via Caduti di Nassiriya, 158/D — 75100 Matera (MT), Italy — VAT 01408710778 — Soluzione FAD Privacy) acts as a technical provider / sub-processor appointed by GRADO TECH Srls for hosting and technical delivery of courses, to the extent strictly necessary and under the applicable arrangements. Soluzione FAD S.r.l. is not the controller of client data and does not determine the purposes of processing. Once transitional use ends and processing migrates to GRADO Academy, that involvement ceases for new processing, unless otherwise agreed in writing.

Sub-processors and recipients

Data may be processed by appointed processors or sub-processors bound by Art. 28 GDPR agreements or equivalent contractual safeguards where applicable, including: Aruba S.p.A. (Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy — VAT 01573850516), as provider of infrastructure services connected to the platform — Aruba GDPR, Aruba privacy notice; on a transitional basis where used, Soluzione FAD S.r.l. (VAT 01408710778) as e-learning platform provider/sub-processor — Soluzione FAD Privacy; email services; any operational notification channels activated for service alerts, to the extent strictly necessary; professional advisors or authorities where required by law. An updated list of relevant sub-processors is available on request at info@gradotech.it or attached to the contract.

Transfers outside the EU

Data is processed primarily within the European Economic Area, including through Aruba S.p.A. (Italy). More information: aruba.it/gdpr. Any transfers to third countries occur only where adequate safeguards under the GDPR are in place (adequacy decisions, Standard Contractual Clauses or other lawful instruments).

Security measures

GRADO TECH Srls implements appropriate technical and organisational measures to protect data processed on GRADO Assistant: multi-tenant segregation, TLS encryption, irreversible password hashing, role-based access control, session timeout, backups, monitoring and compliance with ISO/IEC 27001:2024 standards. In the event of a personal data breach affecting data processed on behalf of the controller, GRADO TECH Srls will inform the controller without undue delay, as required by Art. 33 GDPR and the contract.

Liability and controller obligations

The controller warrants that data entered on GRADO Assistant is lawful, relevant, accurate and not excessive; that it has the rights and authorisations required; and that it correctly configures roles and permissions. Because DEMO data is intended for production use, the controller must enter only information suitable for real operational processing. GRADO TECH Srls is not responsible for the controller's organisational or training decisions, the substantive or legal accuracy of entered content, or the privacy notice the controller must provide to data subjects. This notice does not constitute legal advice.

Changes to this notice

This notice may be updated to reflect regulatory, contractual or service changes, or the transition from DEMO to production. Any amendments will be published on this page with the date of the last update.