Privacy notice on the processing of personal data for taking the test

Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)

1. Contact details of the data controller and the data protection officer

Data controller (the “Company” or the “Controller”)	W Executive S.r.l. Registered office: Corso Venezia 48, 20121 Milan, Italy VAT no. 04216420986 · Tax code 04310290988 E-mail: privacy@wexecutive.eu Certified e-mail (PEC): info@pec.w-executive.it
Data protection officer (DPO)	EUCS S.r.l.s. Unipersonale VAT no. 04709650289 Telephone: +39 049 8764539 E-mail: info@eucs.it Certified e-mail (PEC): info@pec.eucs.it

2. Categories of data processed and source of the data

2.1 The data processed are identification data, including but not limited to first name, surname, citizenship, sex, landline and mobile telephone numbers and e-mail address, as well as data relating to the answers given when taking the test online.

2.2 The above data are collected directly from you as the data subject.

3. Purposes of the processing, legal bases and retention periods

Why is your data processed?	What makes the processing lawful?	How long do we keep your data?
For purposes relating to the administration of the test, the preparation of the behavioural profile and the delivery of the personalised report.	Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR).	For 6 months from the date on which the test is completed.
To establish, exercise or defend the Controller’s rights out of court and/or in court.	The Company’s legitimate interest in protecting and defending its rights in the appropriate forums (Art. 6(1)(f) GDPR).	For the entire duration of the dispute, until the time limits for appeals have expired.
For purposes relating to commercial activities, specifically telephone calls by our staff or the sending, by newsletter, e-mail or fax, of information material, in both cases concerning our services and initiatives, as well as market research and commercial communications.	Consent of the data subject and private databases (Art. 6(1)(a) GDPR).	For 6 months from the date on which the test is completed.

Once the above retention periods have expired, all data will be deleted from the databases or anonymised, and paper records will be destroyed.

4. Mandatory provision of data and methods of processing

4.1 The provision of the data required to administer the test, process the answers and produce the final report is mandatory. If you refuse to provide these data, the related processing, and therefore the provision of the services by the Company, will not be possible.

4.2 Your personal data will be processed using IT, electronic and automated tools, including tools capable of storing, managing or transmitting the data, which in all cases are suitable for ensuring the security and confidentiality of the data, in accordance with logic strictly related to the purposes set out in this notice. Personal data are processed in compliance with the principles of fairness, lawfulness and transparency on which the GDPR is based.

5. Categories of recipients of the data

5.1 The data may be disclosed to parties acting as independent controllers, including but not limited to the companies of W Group Holding S.p.A., public bodies, etc., subject to your explicit consent, or for purposes connected with pre-contractual and contractual obligations under the law.

5.2 Your data may be processed on behalf of the Company by parties appointed as data processors or by persons authorised to process the data.

6. Behavioural profiling and logic of the test

6.1 In administering the test, the Controller carries out profiling within the meaning of Art. 4(4) GDPR, in order to produce and return to the data subject a personalised behavioural profile.

6.2 Profiling is based on the answers given by the data subject to the questionnaire and is carried out by applying statistical models and deterministic mathematical formulas developed on the basis of approaches and methodologies derived from neuroscience and the behavioural sciences. The purpose of this processing is to identify and describe specific behavioural characteristics of the data subject, such as, by way of example, prevailing learning styles, the factors that activate and drive the use of personal energy, cognitive and behavioural preferences, and ways of reacting to pressure or change.

6.3 The results are not generated using artificial intelligence systems, machine learning or models that change autonomously over time. The assessments generated derive exclusively from the application of predefined and predetermined criteria, calculation rules and correlations, which are identical for all users who take the test.

6.4 The outcome of the profiling is a personalised report for the data subject, intended to increase awareness of their own behavioural characteristics and of their learning and interaction styles. Profiling is not used to take automated decisions that produce legal effects concerning the data subject or similarly significantly affect them within the meaning of Art. 22 GDPR.

7. Location and transfer of data

7.1 To process personal data, W Executive S.r.l. uses an IT infrastructure located in the European Union.

7.2 If suppliers based outside the European Union are used, the consistency of the security measures and compliance with the safeguards required by the GDPR will be verified in advance.

8. Rights of the data subject

8.1 You may ask the Controller for access to the data concerning you, their rectification or erasure, the completion of incomplete data and the restriction of processing in the cases provided for by Art. 18 GDPR; you may also receive the data in a structured, commonly used and machine-readable format and, where technically feasible, have them transmitted to another controller without hindrance, where the conditions for exercising the right to data portability under Art. 20 GDPR are met (the processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and is carried out by automated means).

8.2 You have the right to object, on grounds relating to your particular situation, to processing carried out for purposes based on the Company’s legitimate interest.

8.3 You have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

8.4 These rights may be exercised by writing to privacy@wexecutive.eu or by contacting the DPO, EUCS S.r.l.s. Unipersonale, at the contact details given above.

8.5 Data subjects who consider that the processing of their personal data by the Controller infringes the GDPR have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Art. 77 GDPR) or to bring proceedings before the competent courts (Art. 79 GDPR).

Last updated: November 2026