This page explains how Thrive-O S.r.l. processes the personal data of people who take part in its consulting and courses. It applies to all consulting engagements and all courses. The quote and the general terms of supply refer to this page.
[Art 12 and Art 13 – Regulation (EU) 2016/679]
1. Who the data controller is
Thrive-O S.r.l.
Via Goffredo Mameli 23/25, 21049 Tradate (VA)
VAT no. IT 04032170120
Email for privacy matters: [email protected]
Privacy requests: privacy request form
PEC (certified email): [email protected]
No Data Protection Officer (DPO) has been appointed. The contact person for data protection is the legal representative, currently Fabio Cocchi, Founder.
[Art 13 par. 1 letters a) and b) – Regulation (EU) 2016/679]
2. Who this notice is for
- Client’s contacts and signatories: those who deal with us on the quote, the contract and invoicing.
- Client’s people involved in the activities: employees and collaborators who take part in interviews, work meetings and sessions to diagnose the flows of work.
- Course participants: those who enrol in and attend the courses.
For the site and the contact form, the general privacy policy applies; for the newsletter, the newsletter privacy notice applies.
When we access the Client’s systems, documents or archives to carry out the assignment, the controller of that data is the Client and we act as its data processor. In that case the Client’s instructions and its notice apply. This page concerns the data we collect directly.
[Art 4 points 7 and 8 and Art 28 – Regulation (EU) 2016/679]
3. What data we process
Client’s contacts and signatories
- first name, last name, role and contact details (email, PEC);
- tax code and signature of the signatory;
- billing data of the client company.
Client’s people involved in the activities
- first name, last name and role;
- information about the work done and about the flows of work, provided orally or in writing;
- audio, video and transcripts of the meetings, when we record them.
Course participants
- first name, last name, company, role and contact details;
- attendance and contributions during the sessions;
- evaluations, scores and certificates or certifications obtained;
- audio, video and transcripts of the sessions, when we record them.
We do not ask for special categories of data (health, opinions, memberships and the like). We ask you not to provide them.
[Art 5 par. 1 letter c) and Art 9 – Regulation (EU) 2016/679]
4. Why we process it, on what basis and for how long
| Purpose | Legal basis | Retention |
|---|---|---|
| Quotes, contracts, operational communications with the Client | Performance of the contract or pre-contractual measures, for those who are party to the contract (art. 6.1.b). Legitimate interest, for the contacts who act on behalf of the client company (art. 6.1.f). | 10 years from the end of the relationship |
| Administrative, accounting and tax obligations | Legal obligation (art. 6.1.c) | 10 years from the end of the relationship |
| Provision of the consulting: interviews, work meetings, analysis of the flows of work | Legitimate interest of Thrive-O and of the Client in carrying out and properly documenting the assignment (art. 6.1.f) | Recordings and transcripts: up to 2 years from the end of the supply. Other working materials containing personal data: 24 months from the end date of the consulting |
| Course enrolment and attendance | Performance of the contract or pre-contractual measures, for those who are party to the contract (art. 6.1.b). Legitimate interest, for those who take part on the company’s enrolment (art. 6.1.f). | 10 years from the end of the relationship, for enrolment and billing data. Attendance: 24 months from the end date of the consulting |
| Evaluation of participants and issue of certificates and certifications | Performance of the contract (art. 6.1.b) or legitimate interest in issuing and verifying the certificate (art. 6.1.f) | Evaluation forms: up to 2 years from the end of the supply. Register of certificates issued: 24 months from the end date of the consulting |
| Audio and video recording of calls, workshops and course sessions, and transcription | Consent (art. 6.1.a), when we record for purposes other than the consulting. Otherwise legitimate interest (art. 6.1.f). We always inform those present before recording. | Up to 2 years from the end of the supply |
| Use of artificial intelligence tools to support the activities above | The same basis as the purpose the activity serves. Details in the artificial intelligence notice. | Same as the original data |
| Defence of a right, including in court | Legitimate interest (art. 6.1.f) | For the duration of the dispute |
At expiry we delete the data or make it anonymous, unless required by law.
[Art 5 par. 1 letter e), Art 6 par. 1, Art 7, Art 13 par. 1 letters c) and d) and par. 2 letter a) – Regulation (EU) 2016/679]
5. Where the data comes from
The data comes directly from you or from the Client (for example the list of people involved in the activities or enrolled in a course). Some we produce ourselves during the activities: notes, summaries, evaluations.
[Art 14 par. 2 letter f) – Regulation (EU) 2016/679]
6. Who receives the data
- Authorised people at Thrive-O: the legal representative and the employees or members of the board of directors who review the materials, all bound by confidentiality.
- Suppliers who process data on our behalf, as data processors: Anthropic (artificial intelligence tools), Google (Workspace: storage, mail, calendar, video calls), Notion and Miro (management of contacts, certifications and work boards).
- Tax advisers and providers of invoicing and banking services, for administrative and accounting obligations.
- The Client, who receives the results of the work. These may contain information about the people involved, within the limits of what the assignment requires.
We do not sell the data and we do not disseminate it.
[Art 13 par. 1 letter e), Art 28 – Regulation (EU) 2016/679; Art 2-quaterdecies – Legislative Decree 196/2003]
7. Transfers outside the European Union
Some suppliers may process data outside the European Economic Area. We allow this only if there is an adequacy decision of the European Commission or if the supplier offers adequate safeguards, such as standard contractual clauses. You can ask us for a copy of the safeguards by sending a request with the privacy request form.
[Art 44, Art 45, Art 46 and Art 13 par. 1 letter f) – Regulation (EU) 2016/679]
8. Automated decisions
We do not take decisions based solely on automated processing. Participant evaluations start from a draft written by us, are processed with artificial intelligence tools and are then fully verified by Fabio Cocchi. On particularly sensitive topics, a second person at Thrive-O also reviews them.
[Art 22 and Art 13 par. 2 letter f) – Regulation (EU) 2016/679]
9. How we protect the data
- data encryption;
- limited, named access;
- strong authentication;
- regular backups.
If a personal data breach occurs, we assess the risk, notify it to the Garante when required and inform the people involved in the cases provided for.
[Art 32, Art 33 and Art 34 – Regulation (EU) 2016/679]
10. Your rights
You can ask us at any time to exercise your rights. Click a card to read what it means and how to ask.
- Art. 15 GDPRAccess to your data
- Art. 16 GDPRRectification of inaccurate data
- Art. 17 GDPRErasure of data
- Art. 18 GDPRRestriction of processing
- Art. 20 GDPRData portability
- Art. 21 GDPRObjection to processing
- Art. 7 GDPRWithdrawal of consent
- Art. 22 GDPRHuman intervention and challenge
Art. 15 GDPR
Access to your data
You have the right to know whether we process your data and to receive a copy of it.
1. What you can ask us
You can ask us whether we process data about you. If we do, you can receive a copy.
Which data we collect and where it comes from is explained in the privacy notice.
[Art 15 – Regulation (EU) 2016/679]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 16 GDPR
Rectification of inaccurate data
You have the right to have inaccurate or incomplete data about you corrected.
1. What you can ask us
You can ask us to correct inaccurate or incomplete data.
The data we process is listed in the privacy notice.
[Art 16 – Regulation (EU) 2016/679]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 17 GDPR
Erasure of data
You have the right to ask us to erase your data when it is no longer needed or when the processing is unlawful.
1. What you can ask us
You can ask us to erase the data when it is no longer needed or when the processing is unlawful.
At the end of the retention periods we delete the data or make it anonymous, unless required by law. The periods are in the table of the privacy notice.
[Art 17 and Art 5 par. 1 letter e) – Regulation (EU) 2016/679]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 18 GDPR
Restriction of processing
You have the right to ask us to restrict the processing of your data in the cases provided for by law.
1. What you can ask us
You can ask us to restrict the processing of your data in the cases provided for.
The purposes for which we process the data are in the privacy notice.
[Art 18 – Regulation (EU) 2016/679]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 20 GDPR
Data portability
You have the right to receive the data you have given us and to transfer it to another controller.
1. What you can ask us
You can ask us to receive the data you have given us in a structured format and to transmit it to another controller.
It applies if the processing is based on contract or consent and is automated. The legal basis of each purpose is in the table of the privacy notice.
[Art 20 – Regulation (EU) 2016/679]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 21 GDPR
Objection to processing
You have the right to object to the processing of your data based on legitimate interest.
1. What you can ask us
You can object to processing based on legitimate interest, on grounds relating to your situation.
The purposes based on legitimate interest are indicated in the table of the privacy notice. You can also object to the use of artificial intelligence on your data: it is explained in the artificial intelligence notice.
[Art 21 – Regulation (EU) 2016/679; Art 4 – Law 132/2025]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 7 GDPR
Withdrawal of consent
You can withdraw your consent at any time.
1. What you can ask us
Withdrawal does not affect processing that has already taken place.
We ask for consent for audio and video recordings, when we record for purposes other than the consulting. You can also ask not to be recorded or for the recording to be stopped: we carry on without recording your part.
[Art 7 par. 3 and Art 21 – Regulation (EU) 2016/679]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 22 GDPR
Human intervention and challenge
You have the right to ask for a person to intervene, to express your view and to challenge an evaluation.
1. What you can ask us
We do not take decisions based solely on automated processing.
Participant evaluations start from a draft written by us, are processed with artificial intelligence tools and are then fully verified by Fabio Cocchi. On particularly sensitive topics, a second person at Thrive-O also steps in.
How we use artificial intelligence is explained in the artificial intelligence notice.
[Art 22 par. 3 – Regulation (EU) 2016/679; Art 4 – Law 132/2025]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Privacy request
Fill in the form and choose the subject. The request goes directly to the person in charge, Fabio Cocchi.
Exercising your rights
Send the request with the privacy request form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge. If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
The request goes directly to the person in charge, Fabio Cocchi.
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 12, Art 15, Art 16, Art 17, Art 18, Art 20, Art 21, Art 7 par. 3, Art 22 par. 3, Art 77 – Regulation (EU) 2016/679; Art 2-bis and Art 141 – Legislative Decree 196/2003]
11. If you don’t give us the data
Contact and billing data are needed to conclude and perform the contract and to fulfil legal obligations: without them we cannot provide the service. For recordings you can ask not to be recorded or for the recording to be stopped: we carry on without recording your part.
[Art 13 par. 2 letter e) and Art 21 – Regulation (EU) 2016/679]
12. Updates
We update this page when the processing changes. The version in force is shown at the top.