Privacy policy.

The data controller is H-FARM S.p.A., with registered office at Tenuta Ca’ Tron, Via Sile 41, 31056 Roncade (Treviso), Italy. Tax code and VAT number 03944860265.

Contact for data protection matters: dpo@h-farm.com (Data Protection Officer) · legal@h-farm.com (legal team).

• Identity & contact: first name, middle name, last name, email address, country of residence, date of birth.
• Programme-specific operational data: visa status, passport country (when applicable), English fluency, ability to commit to the in-person residency in Venice.
• Application content: the seven written answers to the Stage 1 questionnaire (most significant build, prompt, daily AI routine, OPCA sentence, two resilience launchpads).
• Uploaded files: CV (PDF) and, where applicable, an evidence file for question G3 (PDF/PNG/JPG/WEBP).
• Technical data: timestamps of read/write actions on your record, IP address, user-agent, audit log of operations performed by you and by the admissions team. This audit trail is required for GDPR accountability.

We do not knowingly collect data from minors (under 18). If you are under 18, do not submit an application.

• Run the selection process for the nAItive fellowship cohort 2026 — review of your application, scheduling of interviews, communication of the outcome.
• Onboard you to the programme if admitted (visa hand-off to the visa provider, programme administration).
• Comply with legal obligations and respond to lawful requests from authorities.
• Defend H-FARM’s rights in the unlikely event of disputes related to the admissions process.

• Article 6.1.a GDPR — explicit consent: you give your consent at the moment of submission. You can withdraw it at any time by writing to the data controller; withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Article 6.1.b GDPR — pre-contractual measures: for the steps necessary to evaluate your application before any onboarding contract.
• Article 6.1.c GDPR — legal obligation: for accountability, record-keeping and any obligations arising from applicable laws.

Your data is accessible only to authorised members of the admissions team (Programme Director, Admission Director, Venture Track Lead, Faculty Lead). We engage the following external sub-processors to operate the platform:

• WePlan S.r.l. — software provider, technical operations and maintenance of the admissions platform on behalf of H-FARM.
• SMTP email provider (currently authsmtp.securemail.pro) for transactional notifications.
• Anthropic, Inc. (USA) — your CV and written answers may be sent to the Anthropic API to support the human reviewers (summary of your record, consistency checks). Anthropic is a sub-processor under a Data Processing Addendum; transfer outside the EU/EEA is governed by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and your explicit consent under article 49.1.a GDPR.
• Visa provider — only for admitted candidates, and only the data strictly necessary for the visa process.

Final selection decisions are taken by humans (Programme Director, Admission Director and the Admission Committee). AI is used to support reviewers, not to take automated decisions on individuals within the meaning of article 22 GDPR.

We retain application data for 18 months from the moment the decision is communicated, after which it is deleted automatically. Anonymised aggregate metrics may be kept beyond this period for programme improvement. Retention may be extended where required by law or by an ongoing dispute.

Under articles 15–22 GDPR you have the right to: access your data; rectify inaccurate data; erase your data (“right to be forgotten”); restrict processing; data portability; object to processing; withdraw consent at any time. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

To exercise these rights, write to dpo@h-farm.com or to the registered office of H-FARM S.p.A.

We apply technical and organisational measures appropriate to the risk: encryption in transit (TLS), authentication (one-time magic links for candidates, password + JWT session for staff), access logging on every read/write to candidate records, isolation of uploads on encrypted storage, principle of least privilege within the admissions team.

This site uses only technical cookies that are strictly necessary for its operation. See the cookie policy for the full list.

This notice may be updated. The version and date are shown at the top of the page. Substantial changes will be communicated by email to active applicants.