Privacy notice

Privacy Policy

Last updated: 1 July 2026

This notice describes the processing of personal data collected through www.leavenconsulting.com, in accordance with EU Regulation 2016/679 («GDPR») and Italian Legislative Decree 196/2003 as amended («Italian Privacy Code»).

1. Data controller

Leaven Consulting S.r.l.
Via Torri Bianche, 3/C — 20871 Vimercate (MB), Italy
VAT: 14252940961
Email: m.sanguin@leavenconsulting.com

2. Categories of data processed

2.1 Data submitted via the contact form

When you use the contact form we collect:

  • First and last name (mandatory)
  • Email address (mandatory)
  • Phone number (optional)
  • Company (optional)
  • Subject (mandatory)
  • Message body (mandatory)

2.2 AI Maturity Assessment (anonymous)

The online questionnaire at /assessment is anonymous: it does not request or store your name, email or any identifying data. Only your questionnaire answers and the computed score/level are processed, on an anonymous basis, and the result is shown immediately on screen.

2.3 Browsing data and security logs

To ensure the security and correct delivery of the service we record access logs (IP address, timestamps, outcome of access attempts to the admin area). These data are not used for profiling.

2.4 Data submitted via the demo request

When you fill in the «Book a demo» form we collect:

  • Name (mandatory)
  • Email address (mandatory)
  • Company and phone (optional)
  • Solution of interest and message (optional)

3. Purposes of processing

  1. To respond to your enquiries and provide the information you request via the contact form.
  2. To organise and deliver the demos requested via the dedicated form.
  3. Subsequent commercial follow-up, strictly connected to your original enquiry.
  4. Contractual, tax and legal obligations arising from any resulting professional relationship.
  5. Information security and prevention of unauthorised access.

4. Legal basis

  • Consent (Art. 6.1.a GDPR): for submission of the contact form, expressed by ticking the relevant box before sending.
  • Pre-contractual measures (Art. 6.1.b GDPR): to follow up on requests for information or demos connected to a possible professional relationship.
  • Legitimate interest (Art. 6.1.f GDPR): for security logs and follow-up communications strictly connected to your original enquiry.
  • Compliance with legal obligations (Art. 6.1.c GDPR): for contractual, tax and record-keeping obligations.

5. Retention periods

  • Contact form data: 24 months from the last interaction, unless a contractual relationship is established.
  • Anonymous assessment data: 36 months.
  • Security logs: 12 months.
  • Contractual and invoicing records: 10 years, as required by Italian civil and tax law.

6. Recipients

Your data are processed by authorised personnel of Leaven Consulting S.r.l. We do not sell, share or transfer your data to third parties for marketing or profiling purposes.

The following entities may access the data as data processors under Art. 28 GDPR, bound by confidentiality:

  • Hosting infrastructure providers (servers and database) located within the European Union.
  • The email service provider used to send internal notifications about the enquiries received.
  • Professional advisors (accountants, legal counsel) where necessary for specific obligations.

7. Transfer outside the European Economic Area

Your personal data are processed within the European Economic Area (EEA). Where a provider (for example the email service) also processes data outside the EEA, such transfer only takes place to countries covered by an adequacy decision or under appropriate safeguards pursuant to Articles 44-49 GDPR (Standard Contractual Clauses / EU-US Data Privacy Framework).

8. Security measures

We adopt technical and organisational measures appropriate to the nature of the data processed, including:

  • Encryption of data in transit (HTTPS/TLS)
  • Access control and strong authentication for the admin area
  • Security logs with limited retention
  • Regular backups and disaster-recovery procedures
  • Regular updates to the system and software dependencies

9. Your rights

Under Articles 15-22 GDPR you have the right to:

  • Access your personal data and obtain a copy (Art. 15)
  • Request correction of inaccurate or incomplete data (Art. 16)
  • Request erasure («right to be forgotten», Art. 17)
  • Request restriction of processing (Art. 18)
  • Receive your data in a structured, portable format (Art. 20)
  • Object to processing based on legitimate interest (Art. 21)
  • Withdraw consent at any time, without prejudice to the lawfulness of prior processing (Art. 7.3)
  • Lodge a complaint with the Italian Data Protection Authority — www.garanteprivacy.it

To exercise your rights, write to m.sanguin@leavenconsulting.com. We will respond within one month of receiving your request.

10. Automated decision-making and profiling

We do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR. The AI Maturity Assessment provides an indicative score based on your answers, with no binding legal effect.

11. Changes to this notice

This notice may be updated to reflect regulatory or organisational changes. The date of the latest update is shown at the top. In the event of substantial changes we will inform you through our usual channels.