Privacy Policy

1. Data Controller

The Data Controller is {{nome_titolare_trattamento}}, with registered office at {{sede_legale_titolare}}, Tax Code / VAT No. {{partita_iva}}.

• Email: {{email_privacy}}
• Certified email (PEC): {{pec_privacy}}
• Telephone: {{telefono_titolare}}

2. Data Protection Officer (DPO)

The Controller has appointed a Data Protection Officer, who may be contacted at the following addresses:

• Name: {{dpo_nome}}
• Email: {{dpo_email}}
• Certified email (PEC): {{dpo_pec}}

3. Categories of data processed

Through the forms made available on the Website, the Controller collects the personal data that the data subject provides voluntarily by completing the relevant fields. The categories of data processed vary according to the purpose pursued, as detailed below.

3.1 Contact form

The following personal data are collected through the contact form:

• identification and contact data (first name, last name, email address, telephone number);
• subject of the request and content of the message, including any further personal data spontaneously provided by the data subject within the body of the message.

The data subject is invited not to include in the message any data falling within the special categories referred to in Article 9 GDPR (for example: data concerning health, racial or ethnic origin, religious or philosophical beliefs) unless strictly necessary for the request.

3.2 Job application form

The following personal data are collected through the job application form:

• identification and contact data (first name, last name, email address, telephone number);
• data contained in the curriculum vitae and any attachments provided by the data subject, including educational background, professional experience, language and IT skills, and professional ambitions;
• any further information that the data subject freely chooses to disclose in the body of the message or in the attached documentation.

The data subject is invited not to include in the curriculum vitae or in the documentation submitted any data falling within the special categories referred to in Article 9 GDPR, unless strictly necessary in relation to the position applied for. In that case, the provision of such data shall constitute an expression of free consent to the processing pursuant to Article 9(2)(a) GDPR.

4. Purposes of the processing and legal basis

The personal data collected through the forms are processed for the purposes and on the basis of the conditions of lawfulness set out below.

The provision of the data marked as mandatory in the forms is necessary in order to respond to the request or to assess the application: failure to provide such data will make it impossible to act upon the data subject's request. The provision of the remaining data is optional.

5. Methods of processing

The processing of personal data is carried out mainly by automated means, in compliance with the principles of lawfulness, fairness, transparency, minimisation and accuracy set out in Article 5 GDPR. Appropriate technical and organisational measures are adopted to ensure a level of security commensurate with the risk, including but not limited to: transmission of data over HTTPS/TLS, access controls to the information system, pseudonymisation where appropriate, periodic backups and incident response procedures.

The data are hosted on infrastructure provided by {{hosting_provider}}, with servers located in the geographical area of {{regione_dati_hosting}}. Transactional email associated with the forms (for example, notification emails to the Controller and to the data subject) is routed through the {{email_provider}} service.

6. Recipients of the data

The personal data may be made accessible, for the purposes set out above, to the following subjects, who act as autonomous controllers or as processors appointed pursuant to Article 28 GDPR:

• internal staff of the Controller duly authorised and instructed in the processing;
• companies belonging to the group to which the Controller belongs, within the limits of the declared purposes;
• providers of IT services, hosting, transactional email, application maintenance and security monitoring ({{elenco_fornitori_en}});
• legal, tax and labour advisors, within the limits strictly functional to the assignment conferred;
• judicial, supervisory and public security Authorities, where required by a legal obligation.

An updated list of processors is available upon request at the contact details indicated in paragraph 1. Personal data will not be disseminated or communicated to subjects other than those identified above.

7. Transfer of data to third countries

Personal data are processed within the European Economic Area. Should it become necessary, on account of the services used by the Controller, to transfer data to third countries outside the European Economic Area, such transfer will only take place in the presence of one of the safeguards provided for in Articles 44 et seq. GDPR, such as an adequacy decision of the European Commission or the adoption of standard contractual clauses approved by the same Commission, supplemented where necessary by additional measures suitable to ensure a level of protection substantially equivalent to that guaranteed within the European Union. A copy of the safeguards adopted is available upon request.

8. Retention period

Personal data are retained for the time strictly necessary to pursue the purposes for which they were collected and, in any case, in compliance with the storage limitation principle laid down in Article 5(1)(e) GDPR. In particular:

• data collected through the contact form are retained for the time necessary to respond to the request and, in any case, for a period not exceeding {{durata_conservazione_contatti}} from the date of receipt of the request, unless a contractual relationship arises from it, in which case the data will be processed and retained in accordance with the specific privacy notice for such relationship;
• data collected through the job application form are retained for the time necessary to assess the application and, in any case, for a period not exceeding {{durata_conservazione_candidature}} from the date of receipt of the application, so as to allow comparison with any future professional positions consistent with the candidate's profile;
• any data processed to comply with legal obligations or for the establishment, exercise or defence of a legal claim before a court are retained for the period provided for by the applicable legislation or by the ordinary limitation period for the relevant rights.

Upon expiry of the retention periods indicated, the data will be irreversibly deleted or anonymised.

9. Rights of the data subject

In relation to the personal data processed, the data subject has the right to:

• obtain confirmation as to whether or not processing is taking place and, if so, to access their personal data and the information indicated in Article 15 GDPR;
• obtain the rectification of inaccurate data or the integration of incomplete data (Article 16 GDPR);
• obtain, where the conditions laid down in Article 17 GDPR are met, the erasure of the personal data (the "right to be forgotten");
• obtain the restriction of processing in the cases provided for in Article 18 GDPR;
• receive in a structured, commonly used and machine-readable format the personal data provided to the Controller and have them transmitted, where technically feasible, to another controller (Article 20 GDPR);
• object at any time to processing based on a legitimate interest of the Controller, unless there are compelling legitimate grounds to proceed with the processing (Article 21 GDPR);
• withdraw any consent given at any time, without affecting the lawfulness of the processing carried out on the basis of consent given prior to the withdrawal (Article 7(3) GDPR).

To exercise the rights listed above, it is sufficient to send a written request to the contact details of the Controller or the DPO indicated in paragraphs 1 and 2, attaching a copy of a valid identity document in order to allow the correct identification of the requesting party. The Controller will respond without undue delay and, in any case, within the deadlines provided for in Article 12 GDPR.

10. Right to lodge a complaint with the Supervisory Authority

A data subject who considers that the processing of their personal data infringes the GDPR has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), based at Piazza Venezia No. 11, 00187 Rome, or to seek a judicial remedy, pursuant to Articles 77 and 79 GDPR. Further information is available on the website www.garanteprivacy.it.

11. Automated decision-making

The Controller does not carry out processing consisting of automated decision-making, including profiling, that produces legal effects concerning the data subject or that similarly significantly affects them within the meaning of Article 22 GDPR.

12. Changes to this notice

The Controller reserves the right to amend this notice at any time, informing users by publishing the new version on the Website. Data subjects are therefore invited to consult this page periodically, referring to the date of the last update indicated at the bottom. In the event of substantial changes affecting the purposes or the methods of processing, the Controller will separately inform the data subject through the most appropriate means.