The Data Controller determines the purposes and means of processing personal data.
2. Types of Data Processed
The Data Controller processes the following categories of personal data:
a) Browsing data
Technical data automatically acquired during navigation, such as:
IP addresses
Domain names of devices used
Browser type and operating system
Access times
Pages visited
Such data are used exclusively for statistical and security purposes.
b) Data voluntarily provided by the user
The voluntary submission of data through:
contact forms
“Work with us” forms
information requests
entails the acquisition of data necessary to respond to the user’s requests (e.g. name, email address, phone number, CV).
c) Recruitment data
In the case of spontaneous applications or applications submitted via dedicated forms, the following data are processed:
personal details
contact information
information contained in the CV
Processing is limited to personnel selection purposes.
d) Data from third-party services
The Website may integrate external services, such as:
Google Maps
Google Places / Google Reviews
These services may involve the collection of data in accordance with the respective privacy policies of the third-party providers.
3. Purposes of Processing and Legal Bases
Personal data are processed for the following purposes:
Purpose
Legal basis
Website navigation and security
Legitimate interest
Responding to contact requests
Performance of pre-contractual measures
Recruitment management
Performance of pre-contractual measures
Service improvement
Legitimate interest
Display of maps and reviews
Legitimate interest
Marketing activities (if any)
Consent
4. Processing Methods
Data processing is carried out using IT and telematic tools, in compliance with the principles of:
lawfulness
fairness
transparency
data minimization
security
Appropriate technical and organizational measures are adopted to ensure data confidentiality and integrity.
5. Data Retention Period
Personal data are retained for the time strictly necessary to achieve the purposes for which they were collected, in particular:
contact data: up to 24 months
recruitment data: up to 24 months
browsing data: according to the retention periods set by technical service providers
aggregated statistical data: in anonymous form
6. Data Recipients
Personal data may be disclosed to:
authorized personnel of the Data Controller
IT and hosting service providers
technical and professional consultants
digital service providers (e.g. Google)
These entities act as Data Processors or independent Data Controllers.
7. Transfer of Data Outside the EU
The use of third-party services (e.g. Google) may involve the transfer of data to countries outside the European Union.
Such transfers are carried out in compliance with Articles 44–49 of the GDPR, through the adoption of appropriate safeguards, such as Standard Contractual Clauses.
8. Data Subject Rights
Users have the right to:
access their personal data
request rectification or erasure
restrict or object to processing
request data portability
withdraw consent (where given)
lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali)
9. How to Exercise Rights
Rights may be exercised at any time by writing to:
