Privacy Policy

1. Introduction

This Privacy Policy describes how blendX (hereinafter "blendX", "we") collects, uses and protects the personal data of users who visit the website blendx.io or use the blendX platform.

Processing is carried out in compliance with Regulation (EU) 2016/679 (GDPR), Legislative Decree (D.Lgs.) 196/2003 (the Italian Privacy Code) and any other applicable legislation.

2. Data Controller

The Controller of personal data processing is blendX S.r.l., with registered office at Via della Balduina 96, 00136 Roma (RM), VAT no. (P.IVA) 15299231009, registered with the Rome Companies Register under number RM-1581087.

Email: [email protected]

DPO (Data Protection Officer): [email protected]

3. Data collected

We collect the following categories of data:

• Identification data: first name, last name, business email, role, employer organization.
• Account data: login credentials (email + encrypted password), preferences, settings.
• Usage data: access logs, actions performed within the platform, time spent, features used.
• Technical data: IP address, browser type, operating system, referrer.
• Contact data: email and information provided in forms (demo, contact, newsletter).
• Project data: content uploaded to the platform (needs, challenges, scouting results, documents).

4. Purposes of processing

Purpose	Legal basis	Retention
Provision of the service	Performance of a contract (Art. 6.1.b)	Contract term + 10 years
Account management and authentication	Performance of a contract (Art. 6.1.b)	Account lifetime + 2 years
Service communications	Performance of a contract (Art. 6.1.b)	Contract term + 2 years
Marketing (newsletter, webinars)	Consent (Art. 6.1.a)	Until withdrawal + 2 years
Analytics and product improvement	Legitimate interest (Art. 6.1.f)	26 months
Legal and tax obligations	Legal obligation (Art. 6.1.c)	10 years
Security and fraud prevention	Legitimate interest (Art. 6.1.f)	12 months

5. Legal basis

We will process your data only where a valid legal basis exists among those provided for by Art. 6 GDPR: performance of a contract, consent, legal obligation, legitimate interest. The specific legal basis for each purpose is indicated in the table above.

Consent to marketing is revocable at any time by writing to [email protected] or by using the unsubscribe link included in every email.

6. Recipients

Your data may be disclosed to:

• blendX employees and collaborators, upon appointment as persons authorized to process data.
• Technology providers appointed as Data Processors (Art. 28 GDPR): cloud hosting, email, analytics, CRM, customer support.
• Professional advisors (accountant, legal counsel, auditor) for legal obligations.
• Competent authorities in the event of a legal obligation or official request.

The up-to-date list of Data Processors is available by writing to [email protected].

7. Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, according to the periods indicated in the purposes table. Upon expiry, data is deleted or irreversibly anonymized, unless different legal obligations apply.

8. Your rights

As a data subject, you have the right to:

• Access (Art. 15 GDPR): obtain confirmation and a copy of your data.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17): request the removal of your data ("right to be forgotten").
• Restriction (Art. 18): temporarily restrict processing.
• Portability (Art. 20): receive your data in a structured, readable format.
• Objection (Art. 21): object to processing based on legitimate interest.
• Complaint: lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

To exercise your rights: [email protected]. We respond within 30 days.

9. Transfers outside the EU

Data is primarily processed within the European Union. Should certain providers (e.g. analytics, some cloud services) transfer data to third countries, blendX ensures adequate safeguards through:

• Standard Contractual Clauses approved by the European Commission (SCC).
• Adequacy decisions (e.g. UK, Switzerland).
• Supplementary technical and organizational measures where necessary.

10. Security

We adopt technical and organizational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Role-based access control (RBAC) and two-factor authentication.
• Daily encrypted backups with 30-day retention.
• Periodic security audits and penetration testing.
• Staff training on data protection.
• Data breach management procedure (notification within 72 hours).

Technical details: Trust Center.

11. Minors

blendX services are intended for professionals and organizations. We do not knowingly collect data from minors under 16. If you believe a minor has provided us with data, contact us and we will delete it.

12. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy at any time. Material changes will be communicated by email to registered users at least 30 days in advance. The current version is always published on this page with its date and version number.

13. Contact

For any questions about privacy and data processing:

• Privacy email: [email protected]
• DPO email: [email protected]
• Address: blendX S.r.l., Via della Balduina 96, 00136 Roma (RM)