PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
OriginalSkills services and related features

pursuant to Articles 12, 13 and 14 of Regulation (EU) 2016/679 (GDPR) - Version 02/2026 - last updated: 29 July 2026

Contents

1. Scope and definitions

2. Privacy roles: Client and OriginalSkills

3. Categories of data processed

4. Purposes and legal bases

5. Tests, profiling and AI systems

6. Research, validation and anonymous datasets

7. Recipients, providers and authorised access

8. Retention and deletion

9. Security and personal data breaches

10. Data subject rights

11. Minors

12. Cookies and communications

13. Amendments and contacts

___________________________________________________________________________

1. Scope and definitions

This notice applies to software, platforms, websites and features made available by OriginalSkills S.r.l., including, by way of example, OriginalSkills, IntegrityView, Skill View®, Chat AI Mind and any other related services.

• “Data subject” means the natural person whose personal data are processed, including candidates, employees, contractors, students, professionals, users, respondents and direct beneficiaries of the services.
• “Client” or “Third-party entity” means the organisation or professional using an OriginalSkills account to administer questionnaires, collect applications, carry out assessment, guidance, training, coaching, recruitment, development or other lawful activities.
• “Individual output” means reports, profiles, indicators, scores, processing results, summaries and other results relating to an individual data subject.

2. Privacy roles: Client and OriginalSkills

2.1 Services provided through a Client

Where the service is offered by a Client, the Client determines the purposes of the processing, identifies the legal basis, decides which data to request, determines who may access individual outputs and defines the retention periods. In this scenario, the Client generally acts as data controller pursuant to Article 4(7) GDPR.

OriginalSkills processes data on behalf of the Client and generally acts as data processor pursuant to Article 28 GDPR, on the basis of a Data Processing Agreement (DPA) and the Client’s documented instructions.

The Client must provide the data subject with its own privacy notice, stating at least the identity and contact details of the controller, the purposes, legal bases, retention periods, recipients and methods for exercising rights.

2.2 Services provided directly by OriginalSkills

Where OriginalSkills provides a service directly to a natural person and independently determines the purposes and means of processing, OriginalSkills acts as data controller. In this case, rights may be exercised directly by writing to info@originalskills.com.

2.3 Inability to identify the Client independently

OriginalSkills does not necessarily hold information enabling it to determine, solely from the data subject’s name or email address, for which Client the person completed a questionnaire, submitted an application or carried out a self-assessment. The data subject is therefore invited to contact the Client identified in the invitation, communication received or page through which access to the service was obtained.

If the data subject is unable to identify or contact the Client, they may write to info@originalskills.com and provide any available technical details, such as the invitation link, approximate date, questionnaire code or name of the organisation. OriginalSkills will carry out reasonable checks, within the limits of the information available and its contractual obligations, without disclosing data to unauthorised persons.

3. Categories of data processed

Depending on the service and the settings selected by the Client, the following categories of data may be processed:

• identification and contact data, such as first name, surname, email address, telephone number and technical identifiers;
• professional and educational data, such as role, experience, educational qualifications, skills, curriculum vitae and professional preferences;
• responses to questionnaires, tests and self-assessment forms;
• psychometric, cognitive, aptitude or organisational results and processing outputs;
• technical and security data, such as access logs, device, browser, IP address and actions performed;
• any additional data voluntarily entered by the data subject or lawfully requested by the Client.

OriginalSkills and the Client must apply the principle of data minimisation. Data that are irrelevant or excessive in relation to the stated purposes must not be requested.

Special categories of data

Unless the service expressly provides for this and there is a valid legal basis under Articles 9 and 10 GDPR, the data subject must not enter data concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life, sexual orientation, genetic or biometric data, or data relating to criminal convictions and offences.

4. Purposes and legal bases

Failure to provide the data marked as necessary prevents the requested service from being provided.

5. Tests, profiling and artificial intelligence systems

Responses to questionnaires and relevant data may be processed through automated procedures, statistical models, psychometric algorithms and, where applicable, artificial intelligence systems. Processing may generate reports, indicators and descriptive profiles concerning skills, characteristics, preferences, fit with roles or other aspects specified by the Client.

Individual outputs are made visible exclusively to the Client holding the account and to users authorised by the Client, according to their respective access profiles. OriginalSkills does not use individual outputs for its own purposes and does not disclose them to other Clients. Authorised personnel of OriginalSkills or its technical providers may exceptionally access individual data only where necessary for assistance, maintenance, security or scientific support requested by the Client, subject to confidentiality obligations, documented instructions and access controls.

Outputs are support tools. They must not be used as the sole basis for solely automated decisions that produce legal effects or similarly significantly affect the data subject. Decisions concerning recruitment, exclusion, assessment, promotion, assignment of tasks or termination of the relationship must be subject to effective human oversight and to the safeguards required by applicable law.

The Client and OriginalSkills apply the obligations relevant to their respective roles, including transparency, instructions for use, human oversight, data quality, traceability, monitoring and risk management (Regulation (EU) 2024/1689).

6. Research, validation and anonymous datasets

OriginalSkills may improve statistical norms, benchmarks, test validity and scientific methodologies exclusively by using aggregated and anonymised datasets. Before being used for research or improvement, the data undergo processes that remove identifying elements and reasonably prevent the re-identification of an individual data subject. Datasets used for these purposes do not contain individual outputs attributable to identified or identifiable persons.

Once anonymisation is effective and irreversible, the information no longer constitutes personal data under the GDPR. Any subsequent deletion of the account or individual record cannot remove the contribution already included in anonymous aggregate statistics, because that contribution can no longer be linked to the data subject.

OriginalSkills does not use Clients’ personal data or individual outputs to train generative artificial intelligence models for its own purposes or those of third parties.

7. Recipients, providers and authorised access

Personal data may be processed, within the limits of their respective functions, by:

• the Client holding the account and persons authorised by the Client;
• authorised OriginalSkills personnel, to the extent necessary;
• cloud infrastructure, maintenance, hosting, email, security and technical support providers appointed, where necessary, as sub-processors;
• professional advisers, partners and persons subject to confidentiality obligations;
• public authorities and other authorised parties, where required by law.

The updated list of categories of providers and sub-processors is available at the Client’s request or in accordance with the arrangements set out in the DPA. Data are processed using server services located within the European Economic Area. Any transfers of data outside the European Economic Area will be carried out in compliance with Chapter V GDPR, through adequacy decisions, standard contractual clauses or other applicable safeguards.

8. Retention and deletion

8.1 Data processed on behalf of the Client

The Client decides and documents the retention period for personal data and individual outputs held in its account, consistently with the stated purposes, the storage limitation principle and its own privacy notice.

The OriginalSkills platform provides the Client with functions to view, export, correct and delete data and results. OriginalSkills follows the Client’s instructions and, upon termination of the service, returns or deletes the data as provided for in the contract and the DPA, unless legal retention obligations apply.

8.2 Data processed directly by OriginalSkills

Where OriginalSkills acts as controller, it retains data for the time necessary to provide the service and comply with legal obligations, defining specific periods or criteria in the notice relating to the individual service.

8.3 Backups and logs

Backup copies and technical logs may remain for limited additional periods in accordance with security procedures and overwrite cycles, without being used for incompatible purposes.

9. Security and personal data breaches

OriginalSkills adopts technical and organisational measures appropriate to the risk, including access control, segregation of roles, credential protection, logging, backups, system updates, incident-management procedures and confidentiality obligations for authorised personnel.

Passwords must be protected using non-reversible cryptographic techniques and changed by users in accordance with security rules. The Client is responsible for properly managing its credentials and secondary accounts.

In the event of a personal data breach, OriginalSkills informs the Client without undue delay when acting as processor and provides the available information to enable the Client to comply with Articles 33 and 34 GDPR. Where it acts as controller, OriginalSkills directly carries out the assessments and notifications required by law.

10. Data subject rights

Where applicable, the data subject may exercise the rights provided for in Articles 15–22 GDPR, including:

• access to personal data;
• rectification of inaccurate data;
• erasure;
• restriction of processing;
• data portability, as defined by the Client;
• objection to processing based on legitimate interests;
• withdrawal of consent, for processing based on consent, without affecting the lawfulness of prior processing;
• the right not to be subject to solely automated decisions in the cases provided by law and the right to obtain human intervention, express their point of view and contest the decision.

For data processed through a Client’s account, the request must be addressed directly to the Client, which is able to identify the purpose, the context of the application or self-assessment and the applicable retention period.

OriginalSkills assists the Client in handling requests within the limits set out in the DPA. Since OriginalSkills is not necessarily able to identify the relevant Client independently, a request sent to OriginalSkills must contain sufficient details to identify the account concerned. Without such details, OriginalSkills cannot access or disclose individual data without risking a breach of the confidentiality of other users or Clients.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority in the Member State where they reside, work or believe the infringement occurred.

11. Minors

The services may be used by minors exclusively in the context of school, training or guidance activities organised by schools, training bodies or other authorised parties (for example, psychologists or counsellors certified for the specific activities). In such cases, the Client is the data controller and must verify the applicable legal basis, provide an understandable privacy notice and adopt enhanced safeguards in view of the age and vulnerability of the data subjects.

Where the law requires authorisation or consent from the person exercising parental responsibility, the Client must obtain and document it before use of the service. Minors’ data must be limited to what is strictly necessary and outputs must be interpreted by qualified persons.

12. Cookies, browsing data and communications

The website www.originalskills.com and the OriginalSkills platform collect technical browsing data necessary for operation and security. The use of cookies or other non-technical tools is governed by the cookie policy and the related consent-management system, to which reference is made. Technical and service communications necessary for the account may be sent without marketing consent.

13. Amendments and contacts

OriginalSkills may update this notice to reflect regulatory, technical or organisational changes. The updated version is made available on the platform or relevant websites. Material changes are communicated to Clients and, where OriginalSkills acts as controller, to data subjects through appropriate means.

OriginalSkills S.r.l.
VAT No. 02477180513
Registered office: Loc. Vallone C.S. Ossaia 39/b, 52044 Cortona (AR), Italy
Email: info@originalskills.com

___________________________________________________________________________

Key legal references

• Regulation (EU) 2016/679, in particular Articles 5, 6, 9, 12–14, 15–22, 24, 28, 32–35 and 44–49;
• Italian Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101 of 10 August 2018;
• Regulation (EU) 2024/1689 on artificial intelligence;
• Italian Law No. 132 of 23 September 2025, provisions and delegated powers concerning artificial intelligence;
• National guidelines for the implementation of artificial intelligence in the workplace, adopted by Ministerial Decree No. 180 of 17 December 2025.