Privacy &
Cookie Policy

1. Data Controller

The data controller for personal data collected through this website is:

2. Data Collected and Purpose

This website collects personal data through the forms available on its pages and through the EXPAND™ Pre-Scan service. Specifically:

Strategic call booking form
We collect your name and email address solely to manage the requested booking. Data is stored in a Google Sheets spreadsheet accessible only to the data controller.

Lead magnet download form
We collect your name and email address solely to provide the requested material and, with your explicit consent, to send informational communications. Data is stored in a Google Sheets spreadsheet accessible only to the data controller.

EXPAND™ Pre-Scan
We collect full name, business email address, phone number, company name, annual revenue range, and answers to the assessment questionnaire. Data is processed using artificial intelligence to generate a personalised report and stored in Google Sheets. For full details please refer to Section 9 of this policy.

We do not use behavioural analytics tools and we do not create user profiles for advertising purposes.

3. Legal Basis for Processing

Data processing is based on the following legal bases: consent expressed by the user (Art. 6(1)(a) GDPR); performance of a service requested by the data subject or pre-contractual measures (Art. 6(1)(b) GDPR); legitimate interest of the Controller for commercial contact and service improvement purposes, to the extent that the fundamental rights and freedoms of the data subject do not override such interest (Art. 6(1)(f) GDPR).

4. Data Retention

Data is retained for the time strictly necessary for the purposes for which it was collected, and in any case no longer than 24 months from the last interaction. After this period, data is deleted or anonymised. For data collected through the EXPAND™ Pre-Scan, the maximum retention period is 24 months from the date of completion.

5. Data Processors and Sharing with Third Parties

Collected data is not sold, transferred, or shared with third parties for commercial purposes. For the technical operation of the website and services, data passes through the following platforms, which act as data processors pursuant to Art. 28 GDPR:

• Netsons Srl — hosting provider and server infrastructure on which the website and PHP processing files reside. Address: Corso Belgio 23, 10153 Turin, Italy. Privacy: netsons.com/privacy-policy
• Google LLC (Mountain View, USA) — data storage via Google Sheets and email delivery via Google Workspace where applicable. Google adheres to the EU-US Data Privacy Framework and operates under Standard Contractual Clauses. Privacy: policies.google.com/privacy
• Anthropic PBC (San Francisco, USA) — provider of the artificial intelligence system used to generate the EXPAND™ Pre-Scan report. Transfer to the USA is based on Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR). Privacy: anthropic.com/privacy
• TidyCal — external booking platform. Should the user choose to book the free Strategic Call by clicking the relevant button, they will be redirected to TidyCal, which operates under its own privacy policy: tidycal.com/privacy

6. Your Rights

As a data subject, you have the right to:

• Access your personal data (Art. 15 GDPR)
• Request rectification (Art. 16 GDPR)
• Request erasure (Art. 17 GDPR)
• Request restriction of processing (Art. 18 GDPR)
• Object to processing, in particular where based on legitimate interest (Art. 21 GDPR)
• Request data portability (Art. 20 GDPR)
• Withdraw consent at any time, without affecting the lawfulness of prior processing

To exercise these rights write to: info@raisingstar.it. The Controller will respond within 30 days of receiving the request.

You also have the right to lodge a complaint with your local data protection authority. In Italy: garanteprivacy.it

The Controller has assessed that, given the nature and scale of the processing carried out, the conditions for the mandatory appointment of a Data Protection Officer (DPO) under Art. 37 GDPR are not met.

---

7. Cookie Policy

This website uses only technical cookies necessary for page functionality. No profiling, analytics, or advertising cookies are used.

Main website (raisingstar.it)
No cookies of any kind are installed. The website consists of static HTML pages and does not require user sessions.

Blog (raisingstar.it/blog)
The blog runs on WordPress. WordPress may install strictly necessary technical session cookies required for platform functionality. These cookies do not track users and are deleted when the browser is closed. Comments are disabled: no data is collected through the blog.

Should analytics or advertising tools be introduced in the future, this policy will be updated and appropriate consent will be requested before installing any non-technical cookies.

8. Changes to This Policy

This policy may be updated at any time. Changes will be published on this page with the updated date. Continued use of the website following publication of changes constitutes acceptance of the updated policy.

9. Data Processing Related to the EXPAND™ Pre-Scan Service

The Controller informs you that the free EXPAND™ Pre-Scan service available at raisingstar.it involves the processing of the following personal data in the manner described below, in addition to what is stated in the preceding sections of this policy.

Data collected

During the completion of the Pre-Scan, the following personal data is collected: full name, business email address, phone number, company name, annual revenue range, and answers provided to the 10 assessment questions. The answers may contain commercial and strategic information relating to the data subject's company.

Purposes and legal basis for processing

(a) Provision of the Pre-Scan service and generation of the personalised report — legal basis: performance of a service requested by the data subject (Art. 6(1)(b) GDPR). (b) Subsequent commercial contact for the purpose of proposing RaisingStar® services — legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR). (c) Service improvement and aggregated statistical analysis — legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR).

Automated processing using artificial intelligence

The answers provided in the questionnaire are processed using artificial intelligence systems to generate the personalised report. The report constitutes a support analysis and not a binding decision: the data subject is free to disregard its indications. The Controller does not make automated decisions with legal or similarly significant effects within the meaning of Art. 22 GDPR. Upon completion of the Pre-Scan, the report is sent to the email address provided by the data subject via the hosting provider's mail server.

Transfer of data to third countries

For the provision of the service, personal data is transferred to: Anthropic PBC (San Francisco, USA), provider of the artificial intelligence system, with transfer based on Standard Contractual Clauses (Art. 46(2)(c) GDPR); Google LLC (Mountain View, USA), provider of Google Sheets for data storage, adhering to the EU-US Data Privacy Framework and Standard Contractual Clauses. Should the data subject choose to book the Strategic Call by clicking the relevant button in the report, they will be redirected to TidyCal, which operates under its own privacy policy available at tidycal.com/privacy.

Retention period

Data collected through the Pre-Scan is retained for a maximum period of 24 months from the date of completion, unless otherwise requested by the data subject or required by law. To exercise the right to early erasure, please write to info@raisingstar.it.