Privacy Policy

This privacy policy is provided, pursuant to Article 13 GDPR 2016/679 - ‘European Data Protection Regulation’, to those who fill in the contact form of this website.

	Type and source of data processed The data (name, surname, contact details, and further data included in the message text) are provided by the data subject by filling in the form on the Controller's website.
	Purpose and legal basis of data processing The processed data are processed to provide feedback to the request sent by the data subject. The legal basis is the performance of a contract, or pre-contractual measures taken at the request of the data subject (Art. 6.1 lit. b GDPR).
	Nature of data provision Although the provision of data is optional, it is indispensable in order to take charge of the request and provide the relevant response.
	Period of data retention The data entered in the form are stored for 45 days.
	Data recipients The data may be processed by employees and collaborators of the Data Controller and may be communicated to the website operator who has been designated as Data Processor. In addition, they may be made available to parties entitled to access them by virtue of legal provisions, regulations, European legislation. Under no circumstances shall they be disseminated or communicated to unspecified subjects, in any possible form, including making them available or simply consulting them. The complete and updated list of data processors is available upon request.
	Transfer of data extra-UE The Data Controller does not transfer personal data to third countries or to international organisations. However, it reserves the right to use cloud services. In this case, the transfer of data will take place exclusively to providers operating in countries deemed adequate under Art. 45 or who have provided the guarantees set out in Art. 46 GDPR. You can obtain more information on the transfer and/or a copy of the guarantees applied by contacting the Data Controller.

This privacy policy is given, pursuant to Art. 13 GDPR 2016/679 - ‘European Data Protection Regulation’, to subscribers of the newsletter ‘News from the Compliance World’.

	Type and source of data processed Personal data (first and last name, e-mail) are provided by the data subject by filling in the form on the Controller's website.
	Purpose and legal basis of data processing The data are processed to manage subscription to the mailing list and send communications of an informative and promotional nature regarding and services provided by the Controller. The legal basis legitimising the processing is the express consent of the data subject by signing the dedicated form (art. 6.1 lit. a GDPR).
	Nature of data provision The provision of data marked with (*) is essential in order to be able to proceed with registration and sending the newsletter to the data subject. Any refusal to provide the data makes it impossible to receive the communications.
	Withdrawal of consent With reference to Article 7 of the GDPR, the data subject may revoke the consent given at any time. Withdrawal of consent, which can be done through the unsubscribe link at the bottom of each message, results in the cessation of sending the newsletter.
	Data retention period The data is stored until the consent is revoked and the newsletter is unsubscribed.
	Data recipients The data acquired may be communicated to: - personnel authorised by the Data Controller (employees and collaborators); - external subjects designated as Data Processors (e.g. manager of the mailing system and newsletter dispatch, information and telecommunication system provider). Lastly, the data may be communicated to the subjects entitled to access them by virtue of legal provisions, regulations, European standards. The complete and updated list of Data Processors is available upon request.
	Transfer of data extra-UE The Data Controller does not transfer personal data to third countries or to international organisations. However, it reserves the right to use cloud services. In this case, the data transfer will take place exclusively to providers operating in countries that are deemed adequate according to Art. 45, that have adhered to the EU-US Privacy Framework or that have provided the guarantees set out in Art. 46 GDPR. You can obtain more information about the transfer and/or a copy of the guarantees applied by contacting the Data Controller.

This privacy policy is provided, pursuant to Articles 13 - 14 of Regulation (EU) 2016/679 on the protection of personal data, to customers who are natural persons and to natural persons working with customers who are legal persons. The management of the pre-contractual and contractual relationship with the legal person customer necessarily involves the processing of personal data of legal representatives, partners, employees, and collaborators. Since it is difficult to communicate this information directly to the persons concerned, it is made available to the customer with a request to notify the persons concerned.

	Type and source of data processed The data may be provided directly by the persons concerned or by other company representatives during the formulation of business proposals and estimates, visits or telephone calls, or other direct contacts. The processed data of customers are: - personal-identification data (name, surname, address, VAT number, registered office); - contact data (telephone number, e-mail); - of payment (IBAN, bank details); - of purchase. The data processed by customer contact persons are: - personal data (name and surname); - contact details (telephone number, e-mail).
	Purpose and legal basis of processing The data are processed for: 1) Carrying out activities connected with and instrumental to the management of the contractual and pre-contractual relationship: processing requests for information on services; preparing offers and estimates; preparing and transmitting documents; exchanging information of various kinds and by various means of communication legal basis: performance of a contract and pre-contractual measures (Art. 6.1 lit. b GDPR). 2) Handling civil, accounting and tax obligations arising from the contractual relationship legal basis: fulfilment of a legal obligation (Art. 6.1 lit. c GDPR). 3) Manage any debt collection activities legal basis: legitimate interest of the Controller (Art. 6.1 lit. f): debt collection 4) Preventing and managing possible litigation in and out of court legal basis: legitimate interest of the Data Controller (Art. 6.1 lit. f GDPR): exercising or defending one's right in and out of court.
	Nature of provision of data The provision of personal data for the above-mentioned purposes is mandatory as it is necessary for the fulfilment of legal and contractual obligations. The provision of personal data of contact persons, while optional, is necessary for the proper and efficient management of the contractual relationship. Therefore, any refusal to provide the data could compromise, in whole or in part, the proper management of the relationship with the Controller.
	Period of data retention The Data Controller stores and processes personal data for the time necessary to fulfil the purposes indicated. In particular, customers’ data are retained until the administrative requirement and the legal requirement of limitations has expired with regard to any litigation; while contact person data are retained until the termination of the contractual relationship.
	Data recipients The data acquired may be communicated to and processed by: - authorised personnel (employees and collaborators); - external parties designated as data processors (professionals or service companies for accounting and tax assistance, suppliers of electronic data processing systems, etc.). Lastly, the data may be communicated to parties authorised to access them by virtue of provisions of law, regulations, European legislation. The complete and updated list of Data Processors is available upon request.
	Transfer of data extra-UE The Data Controller does not transfer personal data to third countries or international organisations. However, it reserves the right to use cloud services. In this case, the transfer of data will take place exclusively to providers operating in countries deemed adequate in accordance with Article 45 or who have provided the guarantees set out in Article 46 GDPR. You can obtain more information on the transfer and/or a copy of the guarantees applied by contacting the Data Controller.

This privacy policy is provided, pursuant to Articles 13 - 14 of Regulation (EU) 2016/679 on the protection of personal data, to suppliers who are natural persons (e.g. sole proprietorships), to those who undertake professional assignments (e.g. consultants), and to natural persons working at suppliers who are legal persons.
The management of the pre-contractual and contractual relationship with the legal person supplier necessarily involves the processing of the personal data of legal representatives, partners, employees, and collaborators. Since it is difficult to send it directly to the persons concerned, the information notice is made available to suppliers with a request to notify the persons concerned.

	Type and source of data The data may be provided directly by the data subjects or by other company representatives during the formulation of business proposals and quotations, visits or telephone calls, or other direct contacts. The data processed by suppliers are: - personal data (first name, surname, address, CF, VAT number, registered office); - contact data (telephone number, e-mail); - billing data (IBAN, bank details). The data processed for contact persons at suppliers are: - personal data (name and surname); - contact details (telephone number, e-mail).
	Purpose and legal basis of processing Supplier data are processed for: 1) Acquire pre-contractual data and information (e.g. evaluation of offers, quotations, preparation of documents, forwarding and exchange of communications relating to the management of the supply relationship, etc.) legal basis: execution of pre-contractual measures (Art. 6.1 lit. b GDPR). 2) Managing the contractual relationship for the purchase of goods or services (e.g. management of payments, financial flows of the Company, organizational management, etc.). legal basis: execution of contractual measures (Art. 6.1 lit. b GDPR). 3) Managing civil, accounting and tax obligations arising from the supply relationship legal basis: fulfilment of a legal obligation (Art. 6.1 lit. c GDPR). 4) Preventing and managing possible litigation in and out of court legal basis: legitimate interest of the Data Controller (Art. 6.1 lit. f GDPR): exercising or defending one's right in and out of court.
	Nature of provision of data The provision of personal data for the above-mentioned purposes is mandatory as it is necessary for the fulfilment of legal and contractual obligations. The provision of personal data of contact persons, while optional, is necessary for the proper and efficient management of the contractual relationship. Therefore, any refusal to provide such data could compromise, in whole or in part, the proper management of the relationship with the Controller.
	Data retention The data controller retains and processes personal data for as long as necessary to fulfil the stated purposes. In particular, suppliers' data are kept until the administrative and legal requirement of limitations has expired with regard to any litigation, while contact person data are kept until the termination of the supply relationship.
	Data recipients The data acquired may be communicated to and processed by: - authorized personnel (employees and collaborators); - external parties designated as Data Processors (professionals or service companies for accounting and tax, corporate, legal assistance; suppliers of electronic data processing systems (e.g. electronic invoicing, supplier registry, etc.). In addition, they may be communicated to: - Banks - Public bodies (e.g. Revenue Agency, etc.). Lastly, they may be communicated to parties authorized to access them by virtue of legal provisions, regulations, European legislation. The complete and updated list of Data Processors is available upon request.
	Transfer of data extra-UE The Data Controller does not transfer personal data to third countries or to international organizations. However, it reserves the right to use cloud services. In this case, the transfer of data will take place exclusively to providers operating in countries deemed appropriate under Art. 45 or who have provided the guarantees set out in Art. 46 GDPR. You can obtain more information on the transfer and/or a copy of the guarantees applied by contacting the Data Controller.

This privacy notice is provided, pursuant to Articles 13 and 14 GDPR 2016/679 - ‘European Data Protection Regulation’, to those who submit their CVs spontaneously or in response to job advertisements.

	Source and type of data processed The personal data processed are acquired, in response to an advertisement or in the case of voluntary self-submission: - Directly from the data subject, through direct mailing or during assessment interviews and pre-employment agreements; - At third parties (e.g. LinkedIn, recruiting companies that the Data Controller may use for the purpose of personnel search and selection, third party recruiters); The data processed are: - personal-identification data (name, surname, date and place of birth, address, gender); - contact data (telephone number, e-mail); - curricular data (CV, educational qualifications, professional training, certificates, specializations, qualifications and certificates); - photos; - any personal data belonging to special categories pursuant to Article 9 GDPR (e.g. belonging to protected categories, etc.).
	Purpose and legal basis of processing The personal data of the data subject are processed for the following purposes: 1) Evaluation of curricula and selection legal basis: execution of pre-contractual measures (art.6.1 lit. b GDPR). 2) Proposing job offers consistent with the professional profile of the data subject in the event of job vacancies other than those for which he/she has applied. legal basis: legitimate interest of the Data Controller (art. 6.1 lit. f GDPR). The processing of any data belonging to special categories ex. art. 9 GDPR is permitted even in the absence of consent, insofar as it is necessary to fulfil obligations relating to labor law, security and social protection (art. 9.2 lit. b GDPR).
	Nature of the provision of data The provision of personal data, while optional, is necessary for the proper and efficient management of the application and selection process. Therefore, any refusal to provide it could compromise, in whole or in part, the evaluation of the application and the proper management of the selection process.
	Data retention The Controller keeps and processes personal data for the time necessary to pursue the above-mentioned purposes. In this particular case, CVs are kept for 24 months if they are deemed to be of interest, otherwise they are immediately deleted. Furthermore, in the event of a positive assessment of the application and subsequent recruitment, the data provided during the selection process may be processed for the entire duration of the employment relationship and retained until administrative prescription.
	Data recipients Personal data are in no case disclosed to unspecified parties. The data acquired may be communicated to: - Authorized personnel (employees and collaborators); - External parties designated as data processors (e.g. employment consultants, recruitment companies, etc.). Lastly, the data may be communicated to parties authorized to access them by virtue of provisions of law, regulations, European legislation. The complete and updated list of Data Processors is available upon request.
	Transfer of data extra-UE IThe Data Controller does not transfer personal data to third countries or to international organizations. However, it reserves the right to use cloud services. In this case, the transfer of data will take place exclusively to providers operating in countries deemed appropriate under Art. 45 or who have provided the guarantees set out in Art. 46 GDPR. You can obtain more information on the transfer and/or a copy of the guarantees applied by contacting the Data Controller.