Privacy Policy
This Privacy Policy is applicable to the Cardo AI joint controllers, which collectively determine the purposes and means of processing personal data. The Joint Controllers are:
- Cardo AI Corporation (US)
- Cardo AI Corporation – Italy Branch, with its registered office at Francesco Assisi 15, CAP 20122, Milan (MI), Italy
- Softics Data Science (Albania)
- Cardo AI Ltd (UK)
- Cardo ShPK (Kosovo)
Together, these joint controllers are referred to as Cardo AI throughout this Privacy Policy.
General contact information: support@cardoai.com
Contact Information Data Protection and Privacy: DPO@cardoai.com
1) Whose personal data do we process?
Cardo AI processes Personal Data of different categories of data subjects, and possibly does so under different capacities.
Cardo AI as the Joint Data Controller
- Professional Contacts
- B2B Marketing Contacts
- Visitors of our Website
- (Former) Employees
Cardo AI as the Data Processor
- Our End Users
- Stakeholders from our Clients (employees, customers, etc.)
This Privacy Policy is only applicable to End Users, Professional Contacts, B2B Marketing Contacts and Visitors of our Website. It is not applicable to Cardo AI’s staff.
2) Types of personal data we collect and process
Cardo AI processes the following categories of personal data:
- Identification Information: e.g. First and Last Name, Date of Birth, Usernames, etc.
- Contact Information: e.g. Email, Phone Number, Address, etc.
- Professional Information: e.g. Organization, Job or Function, Professional Email, etc.
- Usage Data: e.g. the way you use Cardo AI, the pages you visit on our website and the activity in your account, etc.
- Browser and Session Information: e.g. Device Information, IP addresses, browser type, operating system, session statistics, etc.
More details on each type of Personal Data collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed prior to the Data collection.
3) For what purposes and on what legal basis do we process your personal data?
Cardo AI only collects and processes your personal data on the basis of legitimate legal grounds and for specified and documented purposes as described in this Privacy Policy.
3.1 Based on a legal obligation, Cardo AI is obligated to process your personal data in specific circumstances and for certain purposes in the context of our activities, such as:
| Purposes | Processed Personal Data | Data Subjects |
| Obligation to respond to legal processes or enforceable requests from government authorities; |
|
|
| To comply with administrative and accounting obligations; |
|
|
3.2 Based on the performance of an agreement or prior to the conclusion of an agreement with Cardo AI, we can process:
| Purposes | Processed Personal Data | Data Subjects |
| Create an account and set the correct levels of access; |
|
|
| Provide our requested services; |
|
|
| To ensure the security of our services; |
|
|
| To improve the service; |
|
|
| To provide you with support when you encounter problems or have questions related to our services; |
|
|
| Processing invoices, payments and billings; |
|
|
| Account management and renewal notifications; |
|
|
3.3 On the basis of our legitimate interest, your personal information will be processed for:
| Purposes | Processed Personal Data | Data Subjects |
| The technical and functional management of our website (cfr. the cookie policy) |
|
|
| Sending commercial information, invitations to events and webinars, invitations to orientation and demo sessions, and other marketing purpose events. |
|
|
3.4 Based on your permission, we process personal data for:
| Purposes | Processed Personal Data | Data Subjects |
| Analyzing the behavior of website users through cookies (cfr. the cookie policy); |
|
|
4) Who does Cardo share your personal data with?
4.1 Data Processors
Cardo AI has carefully selected third parties and their services to help us provide, improve, protect and promote our Services. These trusted third parties will have access to (some of) your personal data. We will only share the strictly necessary personal information w
We use the following categories of third parties:
- IT services,
- Software suppliers,
- Advertising and communication services,
- Accounting, tax or legal advisors,
- Customer management software,
- Compliance software.
To ensure compliance throughout our entire supply chain, we will always conclude an agreement laying down rules and obligations related to the protection of personal data.
4.2 Authorities
We may share your personal data with relevant authorities, but only in response to official requests that are legally binding and backed by sufficient legal justification. We are committed to ensuring that any disclosure complies with applicable data protection laws and will only release the minimum information necessary to fulfill such requests.
5) Data Retention at Cardo AI
Personal data will be processed only for as long as necessary to fulfill the purposes for which it was collected, unless we are legally or judicially obliged to store your personal data for a longer period. In the latter case, your personal data will be deleted as soon as the legally determined period has passed.
- Personal data collected for purposes related to our Services will be kept at least until those Services have been fully executed and ended.
- For data used to send newsletters or for direct marketing, it will be kept as long as you remain subscribed.
Once the retention period expires, personal data shall be deleted and/or destroyed within a reasonable period of time.
6) Security and safety of your personal data
To ensure the security and safety of your personal data, we adhere implemented the principles and measures as stated in SOC 2 and hold a SOC 2 Certification. This certification reflects our commitment to maintaining high levels of security, availability and privacy in managing your personal data.
The SOC 2 compliance means we follow a robust set of technical and organizational controls and best practices, including regular security audits, vulnerability assessments and encryption protocols. For instance, we employ advance firewalls, implemented intrusion detection systems, etc.
SOC 2 is widely recognized as a leading standard for data security for service providers that manage and store personal data and information. It focuses on ensuring high levels of security, availability, processing integrity, confidentiality and privacy.
7) What are your rights
You can always contact us to exercise the following rights:
- Access to and inspection of your Personal Data and all information regarding their processing.
- Deletion of your Personal Data.
- Restriction of the processing of your Personal Data.
- Object to all or certain purposes in order for us to stop processing for this purpose.
- Withdrawal of your consent, however this does not affect the lawfulness of processing based on your consent before its withdrawal.
- Transfer of your Personal Data.
Cardo AI will always facilitate the exercise of your rights, taking into account the legal possibilities and limits in this regard.
You will be informed within one month at the latest of what action will be taken on your request. In the case of complex or frequent requests, this period may be extended by a further two months, of which you will be notified.
You can exercise your rights by sending a request via e-mail to dpo@cardoai.com.
It is always possible to submit a complaint to your national data protection authority.
8) Adjustments to this Privacy Policy
Cardo AI reserves the right to review and adapt this Privacy Policy at any time in accordance with applicable laws and regulations.
9) Change Register
- 11/2024: complete revision of old Privacy Policy
- 06/2025: revision of entity names