Privacy Policy

2. Data We Collect

When you use our services, we may collect the following categories of personal data:

• Contact information: name, email address, job title
• Company information: company name, industry, size, and other business details you provide
• Service inputs: your responses, submissions, and any information you provide during the assessment process
• Payment data: transaction records and purchase history. Payment card details are processed by a certified third-party provider and never stored on our servers.
• Technical data: browser type, language preference, session data

3. Purpose of Processing

We process your data for the following purposes:

• Service delivery: providing the services you have requested, including generating your personalized report
• Payment processing: handling purchase transactions securely
• Service communication: sending confirmations, reports, and service updates
• Platform improvement: understanding usage patterns to improve our service

4. Legal Basis

We process your data under the following legal bases as defined by the General Data Protection Regulation (GDPR):

• Consent: you explicitly agree to data processing when using our services (Art. 6(1)(a) GDPR)
• Contract: processing is necessary to deliver the services you requested (Art. 6(1)(b) GDPR)
• Legitimate interest: aggregated analytics to improve our platform (Art. 6(1)(f) GDPR)

5. Service Providers

We use trusted third-party service providers to operate our platform. Each provider is bound by a data processing agreement. Categories include:

• Infrastructure: hosting, database, and content delivery services, primarily within the EU
• Service processing: specialized providers that assist in delivering our core services. Where providers are located outside the EU, Standard Contractual Clauses (Art. 46 GDPR) are in place.
• Payment processing: a certified payment processor handles transactions. Your card details are processed directly by this provider and never stored on our servers.
• Communication: email delivery and contact management services
• Analytics: a privacy-focused, cookie-free analytics service. No personal data is collected.

We do not sell or share your personal data with any third parties for marketing purposes.

6. Data Retention

We retain your personal data for 24 months from the date of creation. After this period, your data is automatically deleted. You may request earlier deletion at any time via our contact form.

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: request a copy of your personal data
• Right to rectification: correct inaccurate personal data
• Right to erasure: request deletion of your personal data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to restriction: limit the processing of your data
• Right to object: object to processing based on legitimate interest

To exercise any of these rights, please use our contact form. We will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority.

8. Cookies

Strados.ai does not use advertising or cross-site tracking cookies, and our analytics provider is privacy-focused and cookie-free. We use two kinds of first-party cookies, readable only by us. (1) Strictly necessary: language preference and authentication. (2) Campaign measurement: when you arrive through a link we published (a social post, a referral link, or an email we sent you) we store which campaign brought you, for up to 90 days. This records the campaign, not you: it holds no name, email address or advertising identifier, is never read by a third party, and is never used to build a profile or to target advertising. Our legal basis is our legitimate interest in understanding which of our own channels work (GDPR Article 6(1)(f)); you may object at any time by contacting us. No consent banner is shown for the strictly necessary cookies, which are exempt under Article 5(3) of the ePrivacy Directive. If you prefer not to be measured at all, block cookies for this site in your browser. The assessment and your report will continue to work normally.

9. International Data Transfers

Some of our service providers operate outside the European Union. These transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection in compliance with GDPR Chapter V.

10. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.

11. Contact

If you have questions about this privacy policy or how we handle your data, please use our contact form.

Entity: Bodhi8 Ltd, Nicosia, Cyprus