Last updated: 13 November 2026.
1. Data controller
The data controller is Jaewa srl, with registered office at Via del Lavoro 55, 50041 Calenzano (FI), Italy, VAT no. 06376430481 (the "Controller").
For any communication concerning the processing of personal data, including the exercise of the rights set out in section 10, users may write to info@jaewa.com.
2. Scope of this notice
This notice covers the processing carried out through the jaewa.com website and through the free online survey for assessing the risk of software projects. The survey is not completed on the website, but on a web application of the Controller that is separate from the website and is reached through the links on the website's pages; its address may vary from one survey to another.
The survey requires no registration and no identifying data such as name, company or telephone number, and contains no free-text fields.
For the use of cookies, please refer to the Cookie Policy.
3. Categories of personal data processed
3.1 Browsing data
The servers hosting the website and the survey application record, in their normal operation, technical data about the requests received: IP address, date and time, requested resource and browser type.
3.2 Survey answers
The options selected by the user, the stated project size, the date and time of submission and the result of the analysis computed from the answers are processed. The answers do not in themselves make it possible to identify the user; they constitute personal data when they are associated with the email address referred to in section 3.3.
3.3 Email address
The email address is provided by the user on an optional basis, after completing the survey, for the sole purpose of receiving the full report. It is stored together with the answers of the survey to which it relates.
3.4 Data processed to prevent abuse
To limit the number of surveys that can be submitted from the same IP address, the application does not store the IP address in clear, but a value derived from it by means of a cryptographic function with a secret key (pseudonymisation), together with the time of submission. This value is not associated with the survey answers.
3.5 Data communicated by email
Where the user writes to the Controller, the sender's email address and any other personal data contained in the message are processed.
4. Purposes and legal bases of the processing
| Purpose | Legal basis |
|---|---|
| Provision of the survey: processing of the answers and display of the summary of the analysis | Performance of a service requested by the data subject, who completes and submits the survey in order to obtain the analysis (Article 6(1)(b) GDPR) |
| Sending, once, the automatically generated risk report to the email address provided | Performance of a service requested by the data subject, who provides their email address in order to receive the report (Article 6(1)(b) GDPR) |
| Security of the website and of the survey and prevention of abusive or automated use (data referred to in sections 3.1 and 3.4) | Legitimate interest of the Controller in protecting the service and ensuring its security (Article 6(1)(f) GDPR) |
| Replying to requests sent by email | Pre-contractual measures taken at the request of the data subject (Article 6(1)(b) GDPR) or, for requests of a different nature, the legitimate interest of the Controller in replying (Article 6(1)(f) GDPR) |
The email address is not used for any purpose other than sending the report; in particular, it is not used for marketing communications, newsletters or further contact. The data are not subject to profiling and are not transferred to third parties for their own purposes.
5. Whether providing the data is mandatory
Providing the answers is necessary to obtain the analysis; without them the survey cannot be processed. Providing the email address is optional: failure to provide it does not prevent the summary of the analysis from being displayed, but only the full report from being sent.
6. Automated decision-making
The risk analysis is computed automatically from the answers and is indicative in nature. It concerns the project described, not the user as a person, and does not constitute a decision based solely on automated processing producing legal effects or similarly significantly affecting the data subject within the meaning of Article 22 GDPR.
7. Recipients of the data
The data are processed by the Controller's authorised staff and, on behalf of the Controller, by the following providers, appointed as processors pursuant to Article 28 GDPR: Google Cloud Italy S.r.l. (email service) and IONOS SE (hosting and cloud services).
The data are not disseminated.
8. Transfers of data to third countries
The data are processed within the European Economic Area and are not transferred to third countries.
9. Retention period
| Data | Retention period |
|---|---|
| Survey answers, result of the analysis and email address | 12 months from submission of the survey, after which they are deleted automatically |
| Pseudonymised value derived from the IP address (section 3.4) | 24 hours, after which it is deleted automatically |
| PDF report | Not stored: it is generated at the time of sending |
| Browsing data (section 3.1) | 12 months |
| Copy of the sent email, held by the email service provider | 12 months |
10. Rights of the data subject
The data subject has the right to obtain from the Controller, where applicable, access to their personal data, rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interest (Articles 15 to 21 GDPR).
Requests may be sent to the address given in section 1, stating the email address used in the survey, which is the only element that makes it possible to identify it. Surveys submitted without an email address cannot be attributed to any data subject and therefore cannot be identified on request (Article 11 GDPR).
The data subject also has the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), pursuant to Article 77 GDPR.
11. Security measures
The Controller adopts appropriate technical and organisational measures to protect the data, including: transmission exclusively over an encrypted connection (HTTPS), pseudonymisation of IP addresses, access to the application restricted to authorised staff with personal credentials, and automatic deletion of the data at the end of the periods set out in section 9.
After the survey has been completed, the summary of the analysis can be accessed through a link containing an unpredictable random code: users are advised not to share it with third parties.
12. Changes to this notice
The Controller may amend this notice, in particular in the event of changes to the processing or to the applicable legislation. The date of the last update is shown at the top of the page.