Privacy Policy

1. Introduction

This Privacy Policy describes how blendX (hereinafter "blendX", "we") collects, uses and protects the personal data of users who visit the website blendx.io or use the blendX platform.

Processing is carried out in compliance with Regulation (EU) 2016/679 (GDPR), Legislative Decree (D.Lgs.) 196/2003 (the Italian Privacy Code) and any other applicable legislation.

2. Data Controller

The Controller of personal data processing is blendX S.r.l., with registered office at Via della Balduina 96, 00136 Roma (RM), VAT no. (P.IVA) 15299231009, registered with the Rome Companies Register under number RM-1581087.

Email: [email protected]

DPO (Data Protection Officer): [email protected]

3. Data collected

We collect the following categories of data:

• Identification data: first name, last name, business email, role, employer organization.
• Account data: login credentials (email + encrypted password), preferences, settings.
• Usage data: access logs, actions performed within the platform, time spent, features used.
• Technical data: IP address, browser type, operating system, referrer.
• Contact data: email and information provided in forms (demo, contact, newsletter).
• Project data: content uploaded to the platform (needs, challenges, scouting results, documents).
• Connected calendar data (Google Calendar, Microsoft 365): only if the user chooses to connect their calendar for the "1-to-1 Meetings" feature: the email address of the connected account, access credentials (OAuth tokens) issued by the provider, the calendar's free/busy intervals, and the identifier and video-call link of the events created by blendX.

4. Purposes of processing

Purpose	Legal basis	Retention
Provision of the service	Performance of a contract (Art. 6.1.b)	Contract term + 10 years
Account management and authentication	Performance of a contract (Art. 6.1.b)	Account lifetime + 2 years
Service communications	Performance of a contract (Art. 6.1.b)	Contract term + 2 years
1-to-1 meetings through a connected calendar	Consent (Art. 6.1.a)	Until the calendar is disconnected
Marketing (newsletter, webinars)	Consent (Art. 6.1.a)	Until withdrawal + 2 years
Analytics and product improvement	Legitimate interest (Art. 6.1.f)	26 months
Legal and tax obligations	Legal obligation (Art. 6.1.c)	10 years
Security and fraud prevention	Legitimate interest (Art. 6.1.f)	12 months

5. Legal basis

We will process your data only where a valid legal basis exists among those provided for by Art. 6 GDPR: performance of a contract, consent, legal obligation, legitimate interest. The specific legal basis for each purpose is indicated in the table above.

Consent to marketing is revocable at any time by writing to [email protected] or by using the unsubscribe link included in every email.

6. Recipients

Your data may be disclosed to:

• blendX employees and collaborators, upon appointment as persons authorized to process data.
• Technology providers appointed as Data Processors (Art. 28 GDPR): cloud hosting, email, analytics, CRM, customer support.
• Professional advisors (accountant, legal counsel, auditor) for legal obligations.
• Competent authorities in the event of a legal obligation or official request.

The up-to-date list of Data Processors is available by writing to [email protected].

Connected calendar data is exchanged only with the calendar provider chosen by the user (Google LLC or Microsoft), acting as an independent controller for its own service. The authorization redirect passes through our connect.blendx.io service (Cloudflare, one of our sub-processors), which stores nothing. This data is not transferred to any other third party, is not used for advertising, and is not processed by any artificial-intelligence feature or provider.

Some platform features (NIXIE, assisted idea drafting, scouting, content review) rely on artificial-intelligence models provided by OpenAI and Anthropic through their commercial APIs, whose terms exclude the use of data for training, and on open-source models run on blendX infrastructure within the EU. These features process only the content entered by users in the platform and have no access to connected calendar data.

7. Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, according to the periods indicated in the purposes table. Upon expiry, data is deleted or irreversibly anonymized, unless different legal obligations apply.

Connected calendar credentials are kept until the user disconnects the calendar or deletes their account, and are deleted on disconnection. Free/busy intervals are processed on the fly and not stored. The event identifier and link remain associated with the meeting booking for as long as the booking is retained.

8. Your rights

As a data subject, you have the right to:

• Access (Art. 15 GDPR): obtain confirmation and a copy of your data.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17): request the removal of your data ("right to be forgotten").
• Restriction (Art. 18): temporarily restrict processing.
• Portability (Art. 20): receive your data in a structured, readable format.
• Objection (Art. 21): object to processing based on legitimate interest.
• Complaint: lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

To exercise your rights: [email protected]. We respond within 30 days.

You can disconnect your calendar at any time from Settings & Privacy → Connectors; you can also revoke blendX's access directly from your Google account (myaccount.google.com/permissions) or Microsoft account.

9. Transfers outside the EU

Data is primarily processed within the European Union. Should certain providers (e.g. analytics, some cloud services) transfer data to third countries, blendX ensures adequate safeguards through:

• Standard Contractual Clauses approved by the European Commission (SCC).
• Adequacy decisions (e.g. UK, Switzerland).
• Supplementary technical and organizational measures where necessary.

10. Security

We adopt technical and organizational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Role-based access control (RBAC) and two-factor authentication.
• Daily encrypted backups with 30-day retention.
• Periodic security audits and penetration testing.
• Staff training on data protection.
• Data breach management procedure (notification within 72 hours).

Technical details: Trust Center.

11. Minors

blendX services are intended for professionals and organizations. We do not knowingly collect data from minors under 16. If you believe a minor has provided us with data, contact us and we will delete it.

12. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy at any time. Material changes will be communicated by email to registered users at least 30 days in advance. The current version is always published on this page with its date and version number.

13. Google API Services

blendX uses the Google Calendar API (calendar.events and calendar.freebusy scopes) exclusively for the "1-to-1 Meetings" feature described above. No staff member accesses this data, except for security reasons or at the user's explicit request for support. The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

14. Contact

For any questions about privacy and data processing:

• Privacy email: [email protected]
• DPO email: [email protected]
• Address: blendX S.r.l., Via della Balduina 96, 00136 Roma (RM)