Privacy Policy

1. PURPOSE OF THIS PRIVACY POLICY 

1. It is intended to provide transparent information to website visitors, platform users, enterprise customer users, customer representatives, administrators, learners, team leaders, content authors, support contacts and other individuals whose personal data may be processed through Asendio. 

2. This Privacy Policy should be read together with the Asendio Cookie Policy, any applicable customer Data Processing Agreement, and any specific notice displayed inside the platform or browser-extension functionality. 

2.WHO WE ARE AND HOW TO CONTACT US 

1. Asendio provides a workforce readiness platform designed to support learning, assessment, simulations, coaching, analytics, knowledge management, readiness validation, Digital Twin scenarios and enterprise training workflows. 

2. For questions about this Privacy Policy, you may contact us at: 

1. Email: contact@asendio.io and dpo@asendio.io; 

2. Website: www.asendio.io; 

3. Physical address at: Tirana Str., Prishtina 10000, Republic of Kosova. 

3. If you use Asendio through your employer or another enterprise customer, that organization may also be responsible for deciding how your personal data is used within its tenant and for what employment, training or operational purposes 

3. WHEN THIS PRIVACY POLICY APPLIES 

1. This Privacy Policy applies when personal data is processed through or in connection with: 

1. the Asendio website; 

2. the Asendio platform and user accounts; 

3. learning, training, courses, quizzes, flashcards, tasks and assessments; 

4. skills, skill-gap, KPI, coaching, gamification and leaderboard features; 

5. AI Assistant, AI voice features, AI call simulations, Knowledge Base/RAG, AI scenario generation and AI-generated content; 

6. Digital Twin browser-extension functionality, scenarios, screenshots and HTML snapshots; 

7. Workflow Studio, Readiness & Worlforce 

8. support, customer success, security, audit, logs and troubleshooting; 

9. customer contracting, sales, marketing, events and communications. 

2. This Privacy Policy does not replace customer-specific privacy notices issued by enterprise customers to their own employees, contractors or users. Where your employer or organization controls how Asendio is used, you should also consult that organization’s privacy information. 

4. ASENDIO’S ROLE AS A CONTROLLER OR PROCESSOR 

1. Asendio may act as either a controller or a processor depending on the processing activity. 

2. Where Asendio acts as a processor, requests relating to access, deletion, correction or objection may need to be addressed through the relevant enterprise customer acting as controller. 

5. PERSONAL DATA WE COLLECT 

1. The exact data processed depends on how Asendio is configured and used by a customer. The categories below reflect the types of data that may be processed through the platform and related services. 

6. HOW WE COLLECT PERSONAL DATA 

1. Personal data may be collected from: 

1. you directly, when you create an account, use the platform, complete training, answer quizzes, submit messages, use AI features, participate in simulations or contact us; 

2. your employer or organization, when it creates users, assigns roles, uploads CSV files, configures teams, assigns content or manages its tenant; 

3. platform usage, logs, cookies and similar technologies; 

4. uploaded documents, files, recordings and knowledge-base content; 

5. Digital Twin browser-extension functionality when a scenario author starts and controls a recording; 

6. third-party providers that support authentication, hosting, security, AI, communications, analytics or other service functions. 

2. Asendio does not currently rely on a native HRIS or CRM connector as a standard platform import. Where data is bulk uploaded, this may occur through manual or file-based methods, such as KPI CSV uploads matched against users by email. Customer-specific API integrations may be assessed and implemented where authorised and technically feasible. 

7. PURPOSES AND LAWFUL BASES 

1. Where FDAP, GDPR or UK GDPR applies and Asendio acts as controller, Asendio relies on the relevant lawful basis for the purpose concerned. Where Asendio acts as processor, processing is carried out on the instructions of the customer/controller and under the applicable customer contract or Data Processing Agreement. 

8. COOKIES AND SIMILAR TECHNOLOGIES 

1. Asendio uses cookies and similar technologies to operate the website and platform, keep sessions secure, remember preferences, measure performance, support analytics where permitted, and provide certain platform functions. 

2. Some browser-based technologies, including local storage, session storage and IndexedDB, may be used in platform or Digital Twin functionality. These are not always traditional cookies, but they may store information on a user’s device and are described in the Asendio Cookie Policy for transparency. 

3. Non-essential cookies are used only where legally permitted and, where required, after consent. Users may manage cookie preferences through the cookie settings tool or through browser settings. 

9. AI-ENABLED FEATURES AND TRANSPARENCY 

1. Asendio includes or may include AI-enabled functionality such as AI Assistant, AI voice features, Knowledge Base/RAG search, AI tool calling, AI call simulations, AI scenario generation, AI-generated coaching, quiz result suggestions, generated courses, flashcards, questions, content moderation and audio transcription. 

2. AI features may process prompts, messages, uploaded content, knowledge-base materials, audio, transcripts, simulation outputs, coaching data, quiz data, screenshots or other platform information, depending on the feature used. 

3. AI outputs are intended to support learning, training, coaching and workforce readiness. Asendio does not itself make automated employment decisions such as promotion, discipline, suspension or termination. However, customer organizations may use platform outputs as part of their own human-led training, coaching, performance or operational processes. Customers remain responsible for ensuring that such use is lawful, fair, transparent and subject to appropriate human review. 

4. Customer data is not to be used to train, fine-tune or improve AI models unless this is expressly authorised, contractually permitted and legally assessed. 

5. AI-generated content should be reviewed by authorized users before being published or relied upon, especially where it affects learners or employee-related outcomes. 

6. Users should not enter unnecessary sensitive information, secrets, credentials or confidential third-party data into AI features. 

7. Where AI-generated or AI-assisted content is used, Asendio applies transparency, security, vendor and retention controls appropriate to the relevant feature. 

10. DIGITAL TWIN BROWSER EXTENSION AND LOCAL STORAGE 

1. Digital Twin functionality allows authorised scenario authors to record, review, edit, save, replay and practise interactive user-flow scenarios. While a recording is active, the browser extension captures information about actions in the recorded tab, including their timing, page addresses and titles, and technical details used to identify page elements and reproduce the recorded steps. It also captures form-field values, copies of webpage content, screenshots of the visible tab and any screen or window the user chooses to capture, and information about the browser, page layout and recording status. 

2. The extension replaces values in password fields and fields whose names indicate passwords, secrets, tokens, social security numbers or one-time codes with placeholders. Other form-field values are retained as entered. Scripts are removed from captured copies of webpage content, but this does not mean that personal data is removed. Screenshots are captured without automatic redaction and may therefore contain personal, confidential or sensitive information visible at the time of capture. Automatic field masking should not be relied upon to prevent all sensitive information from being recorded. 

3. Captured recording data is stored locally in the user’s browser and is transmitted to Asendio’s servers only when the user opens or saves a scenario. 

4. Screenshot previews are image captures and may contain visible sensitive data even where fields or HTML content are masked. Users and customers should avoid recording pages containing credentials, secrets, payment information, special categories of data or other information that should not be captured. 

11. UPLOADED CONTENT, KNOWLEDGE BASE AND RAG PROCESSING 

1. Customers and users may upload documents, training materials, readings, scripts, QA forms, customer scenarios, images, videos, audio files and other files into Asendio. Uploaded files may be stored, parsed, extracted, indexed or used by the Knowledge Base/RAG layer to support search, learning and AI-assisted responses. 

2. Where uploaded content includes personal data, confidential information or sensitive content, the customer and authorised users are responsible for ensuring that upload is permitted and appropriate for the intended training or workforce readiness purpose. Asendio applies access, security, retention and vendor controls to uploaded content according to its classification and contractual obligations. 

12. WHO WE SHARE PERSONAL DATA WITH 

1. Asendio may share personal data with the following categories of recipients where necessary and lawful: 

1. enterprise customers and their authorised administrators, team leaders and users within the relevant tenant; 

3. AI service providers and model providers used to support AI-enabled features; 

4. security, authentication, bot-protection and monitoring providers; 

5. email, communication, support and customer relationship providers; 

6. professional advisers, auditors, legal advisers and compliance consultants; 

7. public authorities, courts, regulators or law enforcement where legally required; 

8. successors or counterparties in a corporate transaction, subject to appropriate safeguards. 

2. Where third parties process personal data on behalf of Asendio, Asendio assesses them as vendors or subprocessors and applies appropriate contractual and security safeguards. Customer-specific subprocessor disclosures are handled through the applicable customer contract, DPA or subprocessor notice process. 

13. INTERNATIONAL TRANSFERS 

1. Asendio may process personal data in different countries depending on hosting, support, infrastructure, AI, database, analytics, security and customer configuration. Where personal data from the European Economic Area, United Kingdom or Switzerland is transferred internationally, Asendio applies appropriate safeguards where required by applicable law. 

2. These safeguards may include adequacy decisions, Standard Contractual Clauses, UK transfer mechanisms, Swiss transfer safeguards, transfer risk assessments, contractual commitments, vendor due diligence, encryption, access controls and customer-specific transfer terms. 

14. HOW LONG WE KEEP PERSONAL DATA 

1. Asendio retains personal data only for as long as necessary for the purposes described in this Privacy Policy, to provide the service, comply with legal obligations, meet contractual commitments, resolve disputes, maintain security, preserve audit records and support legitimate business operations. 

2. Where Asendio processes personal data as processor, deletion or return after contract termination will normally be governed by the relevant customer contract or DPA. Where no specific period is agreed, Asendio will apply a reasonable retention period based on necessity, security, audit, legal and operational requirements. 

15. SECURITY OF PERSONAL DATA 

1. Asendio uses technical and organizational measures designed to protect personal data and customer information against unauthorised access, disclosure, alteration, loss or misuse. These measures may include access control, role-based permissions, encryption where appropriate, secure development, logging, monitoring, vulnerability management, backup and recovery, vendor assessment, incident response and staff training. 

2. No system can be guaranteed to be completely secure. Users must protect their credentials, use the platform only as authorised, avoid uploading unnecessary sensitive information and promptly report suspected security incidents or misuse. 

16. AUTOMATED DECISION-MAKING AND HUMAN OVERSIGHT 

1. Asendio does not itself use the platform to make solely automated employment decisions with legal or similarly significant effects on individuals. The platform may generate scores, feedback, recommendations, rankings, skill-gap insights, coaching outputs, simulation evaluations or readiness-related indicators that enterprise customers may use as decision-support information. 

2. Where customer organizations use Asendio outputs for employment, training, QA, performance, task allocation or workforce decisions, they are responsible for ensuring appropriate lawful basis, transparency, human review, contestability and fairness measures. 

17. YOUR PRIVACY RIGHTS 

1. Depending on where you are located and which law applies, you may have rights to: 

1. request access to your personal data; 

2. request correction of inaccurate or incomplete data; 

3. request deletion of personal data; 

4. object to certain processing; 

5. request restriction of processing; 

6. withdraw consent where processing is based on consent; 

7. request data portability where applicable; 

8. challenge or seek review of certain automated or AI-supported outputs where applicable; 

9. lodge a complaint with a competent data protection authority. 

2. If you use Asendio through your employer or another organization, that organization may be the controller for much of your platform data. In that case, you should normally submit rights requests to that organization. Asendio will support the customer as required by the applicable contract and data protection law. 

18. CHILDREN AND INAPPROPRIATE USE 

1. Asendio is designed primarily for enterprise workforce readiness and professional training environments. It is not intended for unauthorised use by children. Customers are responsible for ensuring that platform use is appropriate for their users and lawful in their jurisdiction. 

2. Users must not upload, record or process data that they are not authorised to use, including unnecessary sensitive data, credentials, secrets, third-party confidential information or content that violates law or customer policy. 

19. CHANGES TO THIS PRIVACY POLICY 

1. Asendio may update this Privacy Policy to reflect changes in law, product functionality, AI features, cookies, vendors, subprocessors, data practices, security controls or customer requirements. The latest version will be published on the Asendio website with the applicable date. 

20. CONTACT AND COMPLIANS 

1. If you have questions about this Privacy Policy or Asendio’s data protection practices, please contact at: 

1. Email: contact@asendio.io; dpo@asendio.io;  

2. Website: www.asendio.io; 

3. Physical address at: Tirana Str., Prishtina 10000, Republic of Kosova. 

2. If you use Asendio through your employer or another organization, you may also contact that organization for questions about how it uses your data in Asendio