This Privacy Policy governs the processing of personal data of users who access the website www.how-r.com and the platform www.howar.cloud (collectively, the “Site” and the “Platform”), register for the Services, or share personal information through HOWAR’s contact channels (the “Users”).
This Policy has been drafted in compliance with the obligations arising from:
The processing of personal data is carried out in compliance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, integrity and confidentiality, as set out in Article 5 GDPR.
The Services are intended exclusively for professional B2B users. Use by consumers or for personal or domestic purposes is not permitted.
HOWAR S.R.L.
Registered office: Via Bagutta 13, 20121 Milan (MI), Italy
VAT no.: IT13879470964 | REA: MI-2749678
PEC: howar@arubapec.it
For any matter concerning the processing of personal data:
HOWAR acts as Data Controller within the meaning of Article 4(7) GDPR for:
When a consultant or consulting firm uses the Services on behalf of a third-party organisation, HOWAR acts as Data Processor within the meaning of Article 4(8) GDPR with respect to the organisational data and test responses concerning that organisation. The consultant or consulting firm remains the Data Controller for the data of the assisted organisation. HOWAR operates in accordance with the contractual instructions of the Data Controller.
For the provision of its services, HOWAR uses the following sub-processors, with whom appropriate agreements pursuant to Article 28 GDPR have been concluded:
Processing is necessary for the performance of a contract to which the data subject is party. This legal basis covers:
Processing is necessary for compliance with a legal obligation. This legal basis covers:
Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller, except where such interests are overridden by the interests or fundamental rights of the data subject. HOWAR has carried out the relevant balancing of interests, documented internally. This legal basis covers:
The data subject may object at any time to processing based on legitimate interest pursuant to Article 21 GDPR by writing to info@how-r.com. In the event of objection to direct marketing, HOWAR shall cease processing immediately and without the need for justification.
For marketing activities not falling within soft spam, processing is based on the data subject’s express consent, which may be freely withdrawn at any time without prejudice to the lawfulness of processing prior to withdrawal.
Collected directly from the data subject at the time of registration or order:
These data relate to the organisation being analysed:
Test responses are retained for 30 days from completion of the assessment (see section 10). Data processed for the regeneration of the Report is retained for the duration of the account.
Collected automatically during use of the Site and the Platform:
These data are not collected for the purpose of being associated with identified persons, but by their nature may allow identification in specific cases (e.g. investigations into computer crimes). They are used exclusively to ensure the functioning of the Platform, identify anomalies and for security purposes.
HOWAR does not collect data belonging to the special categories referred to in Article 9 GDPR (health, genetic, biometric data, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, trade union membership). Should such data be inadvertently entered into the questionnaires, HOWAR shall process them with the same security measures applied to other data and shall delete them upon expiry of the relevant retention period.
In compliance with Regulation (EU) 2024/1689 (AI Act) and Italian Law 132/2025, HOWAR informs Users that its Platform uses generative artificial intelligence systems provided by Anthropic PBC (Claude model, accessed through direct commercial API) for:
⚠️ The content of the Reports is generated in part by generative AI systems. The analyses produced by the Platform do not constitute professional legal, tax or psychological advice, nor clinical or diagnostic assessments, nor automated decisions producing legal effects within the meaning of Article 22 GDPR.
HOWAR does not make decisions based solely on automated processing which produce legal effects or similarly significant effects on the data subject within the meaning of Article 22 GDPR. The Reports are advisory and informational in nature only. Responsibility for organisational decisions remains entirely with the Customer.
HOWAR’s AI system is classified as a Limited Risk system within the meaning of Article 52 of Regulation (EU) 2024/1689 (AI Act). It does not fall within the categories of high-risk systems set out in Annex III of that Regulation.
HOWAR ensures human oversight of the Report generation process through:
Users are strongly advised not to rely exclusively on AI-generated content and to subject the results to qualified professional critical evaluation.
Anthropic PBC processes data transmitted via API exclusively for the provision of the requested service and does not use it to train its models (direct commercial API configuration, training opt-in not applicable).
Anthropic API logs are retained for 30 days from transmission, after which they are automatically deleted from Anthropic’s systems.
Processing is governed by a GDPR-compliant Data Processing Agreement, automatically incorporated into Anthropic’s Commercial Terms of Service, which includes Standard Contractual Clauses (SCCs) for the transfer of data from the EU to the USA pursuant to Article 46(2)(c) GDPR.
Further information: https://trust.anthropic.com | https://www.anthropic.com/legal/privacy
HOWAR serves three categories of customers, as defined in the Terms and Conditions (see www.how-r.com/legal/):
This section applies to Individual Consultants and Consulting Firms that use the Services on behalf of third-party organisations. The Individual Consultant and the Consulting Firm — the latter also in relation to the activities of its authorised consultants — are responsible for:
The Consulting Firm is jointly liable with its authorised consultants for entries made by the latter on the Platform. By entering the name or identifying data of the assisted organisation, the Individual Consultant or Consulting Firm declares and warrants that the necessary authorisations have been obtained. HOWAR does not verify the existence of such authorisations.
When an Individual Consultant or Consulting Firm enters data relating to a third-party organisation, such data is not collected directly from the organisation itself. In such cases, Article 14 GDPR applies. The Individual Consultant or Consulting Firm, as Data Controller for those data, is required to provide the assisted organisation with the information required by Article 14 GDPR, including the indication that HOWAR acts as its Data Processor.
The third-party assisted organisation may exercise its GDPR rights either through the Individual Consultant or Consulting Firm or by contacting HOWAR directly at info@how-r.com.
Personal data may be shared exclusively with:
HOWAR does not sell, transfer or disclose personal data to third parties for third-party marketing purposes.
Data is processed predominantly within the European Union / European Economic Area.
Anthropic PBC (USA): data transmitted via API is processed on cloud infrastructure (AWS) with multi-region routing that may include European and US servers. HOWAR has activated the EU-first configuration available for EU API customers, in order to prioritise processing within European territory. Data storage takes place in the USA. The transfer is covered by Standard Contractual Clauses (SCCs) pursuant to Article 46(2)(c) GDPR, included in the Data Processing Agreement with Anthropic PBC.
Register S.p.A. (Italy/EU): Register S.p.A. is an Italian company based in Florence, part of the team.blue group. It voluntarily adheres to the CISPE Code of Conduct (Cloud Infrastructure Services Providers in Europe), which ensures that data is processed and stored exclusively within the EU/EEA. No extra-EU transfers.
PayPal: any transfers to third countries are covered by Standard Contractual Clauses or Adequacy Decisions of the European Commission. Further information: https://www.paypal.com/webapps/mpp/ua/privacy-full
Test responses are anonymised and transferred in aggregated form to a separate statistical database within 30 days of completion of the assessment, on the basis of HOWAR’s legitimate interest pursuant to Article 6(1)(f) GDPR (improvement of services and development of methodological standards), for:
Anonymised and aggregated data remains the exclusive property of HOWAR and is not sold, transferred or shared with third parties.
Once anonymised, the data is no longer attributable to individual users or organisations and falls outside the scope of the GDPR. Deletion requests cannot therefore be accepted for data that has already been anonymised.
HOWAR retains personal data for the time strictly necessary to achieve the purposes for which it was collected, in compliance with the limitation periods established by applicable law.
| Data category | Retention period | Legal basis |
|---|---|---|
| Test responses | 30 days from completion | Performance of contract |
| Data processed for Report regeneration | Duration of active account | Performance of contract |
| Registration and billing data | Duration of contract + 10 years | Legal obligation (Italian Civil Code Art. 2220) |
| Anthropic API logs | 30 days from transmission | Contract with sub-processor |
| Support communications | 3 years from closure of the matter | Legitimate interest (defence in legal proceedings) |
| Technical browsing data | 25 months from collection | Legitimate interest (IT security) |
| Marketing data (soft spam) | Until objection or 3 years from last purchase | Legitimate interest |
| Marketing data with consent | Until withdrawal of consent | Consent |
Upon expiry of the specified periods, data is deleted or irreversibly anonymised.
In the event of account closure, data processed for Report regeneration is deleted within 30 days of closure. Registration and billing data is retained exclusively for mandatory tax and accounting purposes.
HOWAR adopts appropriate technical and organisational measures to ensure a level of security commensurate with the risk, in accordance with Article 32 GDPR.
Technical measures:
Infrastructure:
Organisational measures:
No IT system is immune from risk. Users are responsible for maintaining the confidentiality of their access credentials. Any unauthorised access or compromise of the account must be reported promptly to info@how-r.com.
Pursuant to Articles 15-22 GDPR, you have the right to exercise the following rights vis-à-vis HOWAR at any time:
Right of access (Article 15 GDPR)
You may request confirmation that HOWAR is processing personal data concerning you and, where this is the case, obtain a copy of such data together with information relating to the purposes, categories of data, recipients and retention periods.
Right to rectification (Article 16 GDPR)
You may request the correction of inaccurate personal data, or the completion of incomplete data concerning you.
Right to erasure (Article 17 GDPR)
You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where you object to processing in the absence of overriding legitimate grounds. This right does not apply to data whose retention is required by law (e.g. billing data) nor to data that has already been anonymised.
Right to restriction of processing (Article 18 GDPR)
You may request the temporary suspension of processing, for example while the accuracy of contested data is being verified or pending the outcome of an objection to processing.
Right to data portability (Article 20 GDPR)
You may request to receive your personal data in a structured, commonly used and machine-readable format, and to transmit it to another controller, in cases where processing is based on contract or consent and is carried out by automated means.
Right to object (Article 21 GDPR)
You may object to processing based on legitimate interest, including direct marketing. In the event of objection to direct marketing, HOWAR shall cease processing immediately and without the need for any justification on your part.
Withdrawal of consent (Article 7(3) GDPR)
You may withdraw at any time consent previously given, without prejudice to the lawfulness of processing carried out prior to withdrawal.
Absence of automated decision-making (Article 22 GDPR)
HOWAR does not make decisions based solely on automated processing which produce legal effects or similarly significant effects on the data subject. The Reports are advisory and non-binding in nature.
You may exercise your rights by sending a request to:
HOWAR shall respond within 30 days of receipt. This deadline may be extended by a further 60 days in the case of complex or numerous requests, with reasoned notice given within the initial deadline. The service is free of charge, save in the case of manifestly unfounded or excessive requests.
You always have the right to lodge a complaint with the competent supervisory authority pursuant to Article 77 GDPR:
Garante per la Protezione dei Dati Personali (Italian Data Protection Authority)
Piazza Venezia 11, 00187 Rome, Italy
Tel: +39 06 696771 | Web: www.gpdp.it | Email: garante@gpdp.it
You also have the right to pursue judicial remedy pursuant to Article 79 GDPR, independently of any complaint to the supervisory authority.
HOWAR reserves the right to amend this Privacy Policy at any time, in order to reflect regulatory developments, technological evolution or organisational changes. Amendments take effect from the date of publication on the website, as indicated at the foot of the document.
In the event of substantial changes to the purposes of processing, the legal basis or the recipients of data, HOWAR shall inform registered users and, where required by the GDPR, obtain renewed consent.
HOWAR uses technical cookies necessary for the functioning of the Platform and, subject to consent, analytical and profiling cookies.
Consent is managed through Consent Management Platform no. 92, in compliance with the IAB Europe Transparency & Consent Framework. You may modify your preferences at any time through the dedicated icon on the website.
For detailed information on the cookies used, the purposes and the methods of consent management, please refer to the Cookie Policy available at www.how-r.com.