Privacy & Cookie Policy

1. Data Controller

The Controller of the personal data collected through this website is:
Francesco De Sario (Athena AI)
Registered office: Bologna, Italy
VAT no.: 03819481205
Contact email: francesco.desario@athena-aisolutions.com

2. Zero Cookies & Tracking

This site is designed for the utmost respect of your privacy.
In compliance with the ePrivacy Directive and with Provision no. 231 of 10 June 2021 of the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), we inform you that this website does not use any cookies (neither technical, nor analytical, nor profiling) and does not track users in any way (no Google Analytics, Facebook Pixel or similar). The fonts used are hosted directly on our servers to prevent your IP address from being transmitted to third-party providers (such as Google Fonts).

As a result, we don’t show you any annoying cookie consent banner: quite simply, we don’t collect any.

3. Types of Data Collected and Legal Basis

We collect personal data only when you voluntarily choose to fill in and submit the contact forms on the site (e.g. on the Contact page or to request an Assessment).

• Data collected: Name, email, message/company situation and any other data voluntarily entered in the text of the message.
• Purpose: To respond to your contact requests, assess your situation and offer you an assessment or a consultation.
• Legal basis: Performance of pre-contractual measures taken at your request (Art. 6, para. 1, letter b of the GDPR). Consent is expressed by ticking the appropriate box in the form.

4. AI Readiness Quiz and personalised AI Governance Report

The site hosts an "AI Readiness Quiz" (6 questions) which, at the end, generates a personalised AI Governance Report sent by email within a few minutes. This is a separate processing operation, based on the explicit consent collected when the form is submitted.

• Data collected: name, business email, company name, company website (mandatory to personalise the analysis), answers to the quiz.
• Processing carried out: (a) analysis of the public information on the declared company website; (b) generation of a hypothetical report by means of artificial intelligence (Anthropic’s Claude, run on AWS Bedrock); (c) sending of the report by email to the declared contact; (d) subsequent commercial contact, if authorised.
• Legal bases (Art. 6 GDPR): explicit consent (Art. 6.1.a) for the generation and sending of the report; separate explicit consent (Art. 6.1.a) for the related commercial contact.
• Retention: lead data and the generated report are kept for 24 months from the date the quiz was completed, then deleted. Withdrawal of consent and erasure: privacy@athena-aisolutions.com.
• Declared AI output: the report is transparently labelled as generated by artificial intelligence (badge on the cover, generator meta tag, data-ai-generated attribute), consistent with the transparency principle of the AI Act (Art. 50) and with our brand stance.

5. Data Recipients and Data Processors

Your data will in no way be sold, exchanged or disclosed to third parties other than the following Data Processors, bound by DPAs (Data Processing Agreements) and by appropriate technical and organisational clauses.

• Railway Corp. (USA): hosting of the entire site www.athena-aisolutions.com, including qualification call requests, the AI Readiness Quiz and the AI Vision Check. It generates and serves the personalised reports; it stores the report files and the technical log of submissions for the retention period.
• Amazon Web Services EMEA (Luxembourg / Ireland / USA, depending on the active inference region): infrastructure of the AWS Bedrock service used to run the artificial intelligence model that generates the personalised report. Bound by the AWS GDPR DPA. Inference preferably uses EU regions (eu-west-1, eu-central-1); where model availability requires US regions, the transfer is covered by the AWS SCCs.
• Anthropic, PBC (USA, via AWS Bedrock): provider of the Claude model run through AWS Bedrock. Under the Bedrock terms, inputs and outputs are not used to train the models and do not leave the AWS perimeter towards Anthropic in identifiable form.
• Resend, Inc. (USA): transactional email delivery service (sending of the report). Bound by the Resend DPA.
• IONOS SE (Germany): registrar and DNS management for the domain athena-aisolutions.com and for the email aliases (including privacy@athena-aisolutions.com).

6. Data Transfers outside the EU

Some Processors (Railway, AWS — on US regions where applicable, Anthropic, Resend) are based in or operate servers in the United States. The transfer of data is covered by Standard Contractual Clauses (SCCs) approved by the European Commission and/or by the providers’ adherence to the EU-US Data Privacy Framework (DPF), together with supplementary technical measures (TLS 1.2+ encryption in transit, encryption at rest on services that provide it by default, credential-based access controls).

If AI inference is run in an EU region (the default preference), the personal data processed to generate the report does not leave EU territory.

7. Retention Period

Personal data sent through forms (Contact, AI Readiness Quiz) will be kept for the time strictly necessary to handle your request and, in any case, for a maximum period of 24 months from the last active contact, unless a subsequent contract is concluded (in which case it will be kept for the periods required by law) or you explicitly request earlier erasure.

8. Your Rights (Arts. 15-22 GDPR)

As a data subject, you have the right to:

• Request access to your personal data;
• Obtain its rectification or erasure ("right to be forgotten");
• Request the restriction of processing;
• Object to processing;
• Request data portability;
• Withdraw at any time the consent given for the generation of the report or for commercial contact, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, you can contact the Controller at the dedicated email address: privacy@athena-aisolutions.com (or francesco.desario@athena-aisolutions.com). Reply within 30 days.

You also have the right to lodge a complaint with the competent Supervisory Authority: the Garante per la Protezione dei Dati Personali (garanteprivacy.it), the Italian Data Protection Authority, if you believe that the processing infringes the GDPR.