Privacy Policy

1. Data controller

The data controller is AIXEL Solutions S.r.l.:

Company

AIXEL Solutions S.r.l., limited liability company with a single member (società a responsabilità limitata a socio unico)

Registered office

Via Polidoro da Caravaggio 30B, 20156 Milano (MI), Italy

Tax code and VAT no.

14884460966 (EU VAT IT14884460966)

Companies Register

Milano Monza Brianza Lodi, no. 14884460966 - REA MI-2813180

Share capital

€1,000.00 fully paid in

Email

hello@aixel.solutions

PEC

aixel.solutions@pec.it

For anything about your data, write to hello@aixel.solutions or, by certified email, to aixel.solutions@pec.it. We have not appointed a Data Protection Officer: the GDPR does not require one for our activities.

2. What we process and why

For each activity: the data involved, the purpose and the legal basis under Article 6 GDPR.

• Visiting the website. Our hosting provider processes technical data such as IP address, browser, requested page and time, to deliver the site and keep it secure. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f)).
• Statistics without cookies. Vercel Web Analytics and Speed Insights measure visits and page speed without cookies and report aggregated figures only. Private links lose their access code before anything is recorded. Legal basis: our legitimate interest in understanding how the site is used (Art. 6(1)(f)).
• Google Analytics, only with your consent. If you allow statistics cookies, Google Analytics 4 records how you use the site: pages viewed, approximate location, device and browser. If you reject or ignore the banner, it is not loaded and Google receives nothing. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time from Cookie settings at the bottom of every page. Details in the Cookie Policy.
• Contact and demo requests. The contact form asks for your name, work email, company, company size, industry, the systems you use, the process you want to improve, your timeline and how you found us. The request reaches our mailbox by email and you receive an automatic confirmation; it is not stored in a database. Your IP address is held briefly in memory to block abuse. Legal basis: steps taken at your request before a possible contract (Art. 6(1)(b)) and our legitimate interest in protecting the form (Art. 6(1)(f)).
• AI & Digital Readiness assessment. The request form asks for your name, work email, company and website and, if you choose, your role, company size, markets, systems, a self-assessment, notes and a phone number (only if you ask us to contact you); we also store a hash of your IP address and your browser type. To prepare the report we analyse public sources about your company - its website, web archives, domain records, public registers, news and job postings - including the business contact details and the names and roles of officers published there. An AI model helps us draft the analysis. If your team completes the follow-up questionnaire, we also process each respondent's name and role, their answers and any recordings or files they upload. Legal basis: providing the assessment you asked for (Art. 6(1)(b)); for public information about your company's officers and staff, our legitimate interest in an accurate assessment (Art. 6(1)(f)). This policy is how we inform them (Art. 14).
• Correspondence, calls and meetings. When you write to us, book a call through our scheduling page on Calendly or meet us online, we process your contact details and what you share with us. Legal basis: pre-contractual steps or performance of a contract (Art. 6(1)(b)) and our legitimate interest in managing business relationships (Art. 6(1)(f)).
• Business contacts and clients. We keep a record of business contacts, prospects and clients in our CRM, which runs on our own servers in the EU. Legal basis: our legitimate interest in managing business relationships (Art. 6(1)(f)) and performance of a contract (Art. 6(1)(b)).
• AIXEL CRM customers. When you buy AIXEL CRM we process the purchase and billing data: name, company name, email, billing address, VAT number, Italian tax code, SDI code or PEC, the plan chosen, the acceptance of the terms and the payment status. Card details are collected by Stripe and never reach us. To create your instance we use the first administrator's name and email. We also process your support, cancellation and withdrawal requests; for the online withdrawal we keep name, email, contract code, message, date and time and, to block abuse, a hash of the IP address. Legal basis: performance of the contract (Art. 6(1)(b)), tax and accounting obligations (Art. 6(1)(c)) and our legitimate interest in defending our rights (Art. 6(1)(f)). The data you enter in your CRM is not covered by this policy: we process it on your behalf, as processor, under the AIXEL CRM Data Processing Agreement.
• Legal obligations. Contracts, invoices and accounting records are kept as Italian tax and civil law requires. Legal basis: legal obligation (Art. 6(1)(c)).

We do not send marketing newsletters, we do not sell personal data and we do not use it for advertising.

3. Is providing data mandatory?

Fields marked as required in our forms are needed to answer your request or prepare your assessment; without them we cannot proceed. Everything else is optional. To buy AIXEL CRM we need your billing details: without them we cannot make the contract or issue the invoice.

4. Who receives the data

Personal data is handled by our team and by the service providers that support us: website hosting, the assessment database, our own servers, email delivery, our mailbox, call scheduling, payments, creating and updating AIXEL CRM instances, analytics (only with consent) and the AI model used for assessments. They act on our behalf under data processing agreements, except the AI model provider described in section 5, which processes data under its own terms, and Stripe, which processes payment data as an independent controller for fraud prevention and its own legal obligations. Each provider is listed by name, with purpose and location, on our Subprocessors page.

Billing data is shared with our accountant for bookkeeping and sent to the Italian Revenue Agency through the Exchange System (SDI). We disclose data to public authorities only when the law requires it.

5. Transfers outside the EU

Our website functions, the assessment database and our own servers run in the EU. Some providers, however, are companies based outside the European Economic Area, mainly in the United States, and may access data from there. These transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, for certified recipients, or on the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR).

AI & Digital Readiness analyses are drafted with Anthropic's Claude models under Anthropic's own terms. For the European Economic Area the data is received by Anthropic Ireland, Limited, which transfers it to the United States under Standard Contractual Clauses. We send the model only what the analysis needs; the email address and phone number you give us are not included.

6. How long we keep data

• Contact and demo requests and the related correspondence: 24 months after our last exchange, unless a contract follows.
• AI & Digital Readiness requests, reports and questionnaire answers: 24 months after the last activity on the request.
• Contracts, invoices and accounting records: 10 years, as required by Article 2220 of the Italian Civil Code.
• AIXEL CRM subscription data, including cancellation and withdrawal requests: for the term of the contract and 10 years after it ends, for legal obligations and the defence of legal claims.
• Hash of the IP address sent with the withdrawal form: 7 days, only to block abuse.
• Google Analytics data (only with consent): no more than 14 months.
• Hosting logs: the short period set by the hosting provider for security.

When these periods end, the data is deleted or anonymised.

7. Your rights

You can ask us for access to your data, rectification, erasure, restriction of processing and a copy in a portable format, and you can object to processing based on our legitimate interest (Articles 15-21 GDPR). Where processing relies on consent, you can withdraw it at any time without affecting what happened before; for statistics cookies, use Cookie settings at the bottom of any page. Write to hello@aixel.solutions or aixel.solutions@pec.it: we reply within one month.

You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the EU country where you live or work.

8. Automated processing

The preliminary AI & Digital Readiness report is generated automatically, with an AI model, from public sources and your answers, and is labelled as such. The final roadmap is reviewed by our team before we publish it. Both are informative assessments of an organisation, not decisions about a person, and have no legal or similarly significant effects, so Article 22 GDPR does not apply. How we use AI is explained on the AI transparency page.

9. Security

We protect data with access controls, encryption in transit and providers with recognised security certifications. Private report links contain a long random access code: please do not share them outside your organisation.

10. Minors

Our services are meant for businesses and professionals and, with AIXEL CRM Starter, also for private individuals aged 18 or over. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

We update this policy when our processing changes. The date at the top shows the version in force.