Privacy Policy

1. Controller

The controller is ISOdodo, the operator of the Platform, which can be contacted for any request concerning personal data at info@isododo.com.

2. Data we process

• Account data — name, email address, password (stored only in hashed form), company name, country, telephone number, VAT number, business classification code, business sector, number of employees and preferred language.
• Purchase data — the path purchased, its plan and dates, the country used to determine the price, the payment identifiers issued by Stripe and, for a purchase made by a professional for a client, the client's email address. Card details are collected by Stripe and never reach us.
• Company profile — the company information entered to prepare the documents, including the names of the persons who sign them.
• Documentation — the documents uploaded to the Platform, including those submitted for review by the Certification Body, with the outcome and the notes of each review, and the certificate the Certification Body issues.
• AI assistant — the messages and files sent to the assistant "Isotta", and the account and company profile data used to fill in documents.
• Technical data — IP address, browser and device information, and access logs.

For the personnel of Certification Bodies who review documentation on the Platform, we process the name and email address provided by the Certification Body and the reviews carried out.

3. Purposes and legal bases

• Providing the Service — account, paths, document templates and their filling, storage of the uploaded documentation, reviews by the Certification Body, purchases, support and service communications. Performance of the contract, Art. 6(1)(b) GDPR.
• Accounting and tax obligations. Legal obligation, Art. 6(1)(c).
• Security of the Platform and prevention of abuse. Legitimate interest, Art. 6(1)(f).
• Organising the reviews with the Certification Bodies, as regards their personnel. Legitimate interest, Art. 6(1)(f).
• Running the referral programme, as regards the accounts registered through a User's referral link. Legitimate interest, Art. 6(1)(f).
• Establishing or defending legal claims. Legitimate interest, Art. 6(1)(f).
• Analytics cookies. Consent, Art. 6(1)(a).

The data requested at registration and purchase is necessary to provide the Service: without it, the Service cannot be provided.

4. Recipients

Data is processed by staff authorised by ISOdodo and by providers acting as processors: hosting and storage, payment processing, the AI model, email delivery and the Google services described in Section 7. Stripe acts as an independent controller for the payment data it collects.

The documentation submitted for review is made available to the Certification Body, which acts as an independent controller, together with the User's account and company data and the plan and purchase date of the path. A User who shares a referral link can see how many accounts registered through it. A User who earns commissions on the paths purchased by those accounts, and by the accounts registered through their links, can also see for each payment the path, the date, the amount paid and the commission, together with the company name of the account that paid or, for an account registered through another account's link, the company name of that other account, which is also shown whenever the User earns on the accounts registered through that account's link. Where a referral link carries a discount, whoever opens it sees the company name of the User who shared it. Data may also be disclosed to public authorities where required by law.

5. Transfers outside the European Economic Area

Some providers process data outside the European Economic Area, including in the United States. Such transfers are based on an adequacy decision of the European Commission or on the Standard Contractual Clauses it has adopted (Art. 46 GDPR), a copy of which can be requested at the address given in Section 1.

6. Retention

• Account data and company profile — until the account is deleted.
• Documentation and reviews — for the duration of the path and up to 90 days after its expiry.
• Accounting records of purchases — ten years, as required by tax law.
• Conversations with the assistant — until the User deletes them or the account.
• Analytics data — for the period set in Google Analytics, not longer than 14 months.
• Technical logs — for a limited period, for security purposes.

7. Cookies

• Technical cookies, which do not require consent: actoken (15 minutes) and reftoken (7 days) for authentication, cookie_consent (12 months) to record the choice on cookies, i18n_redirected (12 months) for the language and referral_code (31 days) to associate a registration with the referral link through which the visitor arrived. The theme preference is kept in the browser's local storage.
• Analytics cookies — Google Analytics 4 (_ga and _ga_*, up to 2 years), used only with consent. When the User is signed in, Google Analytics also receives the account's pseudonymous identifier.
• Third-party services — Google reCAPTCHA protects the registration, login and account forms against automated use.

Consent can be given or withdrawn at any time from the cookie preferences . Google's processing is described in its privacy policy.

8. Your rights

Under Articles 15 to 22 GDPR you may request access to your data, its rectification or erasure, the restriction of its processing and its portability, and object to processing based on legitimate interest, by writing to info@isododo.com. Consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out before. You may also lodge a complaint with the supervisory authority: in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

9. Data about third parties entered by Users

For the personal data of third parties that a User enters on the Platform, such as the names of the signatories or data contained in the documentation, the User is the controller and ISOdodo processes the data on its behalf, as set out in the Terms and Conditions. If a professional purchases a path for you, we receive your email address from them in order to give you access.

10. Changes

The current version of this policy is published on this page with the date of its last update. Significant changes are communicated to registered Users.

Last updated: 9 October 2026