Privacy notice pursuant to Article 13 of Regulation (EU) 2016/679

As provided by the General Data Protection Regulation (EU) 2016/679 (hereinafter the "Regulation"), this page describes how the personal browsing data of users who consult the following websites and use the following iOS and Android apps are processed:

Osvat S.r.l. – VAT no. 00530250018 (hereinafter, for brevity, "the Company"), as Data Controller of Personal Data (or "the Controller") pursuant to Art. 13 of EU Regulation 679/2016 – General Data Protection Regulation ("Regulation" or "GDPR") and of the Privacy Code as amended by Legislative Decree 101/2018, in compliance with the obligations imposed by the legislator to protect privacy, wishes to inform you in advance about both the use of your Personal Data and your rights, as follows.

1. Identity and contact details of the Data Controller

The Data Controller is Osvat S.r.l., with registered office at via della Masolina no. 22, 10040 Piobesi Torinese (TO) – Italy. The following contact details are provided for data subjects: contact e-mail privacy@osvat.com, telephone: (+39) 011 962 4964.

2. Personal data subject to processing

The Controller may process the following personal data of users:

  • a) browsing data automatically collected by the platform: the IT systems and software procedures used to operate the Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of the Internet communication protocols. This is information that is not collected to be associated with identified data subjects but which, by its very nature, could, through processing and association with data held by third parties, make it possible to identify users. These data are used solely to obtain anonymous statistical information on the use of the site and to check its correct operation and are not, nor will they ever be, used by the Controller for profiling activities;
  • b) user login data, where the e-mail acts as the "user ID" and the password is set by the user;
  • c) identification and contact data for registration in the reserved user area (name, surname, e-mail address, telephone number);
  • d) identification and contact data of the user to request commercial contact (name, surname, e-mail, postal address, landline and mobile telephone number);
  • e) identification and contact data, including the personal data entered in the personal and professional CV of users who wish to submit a spontaneous application.

3. Purposes of processing, legal basis

The Personal Data provided by the Data Subject through the website are collected and processed for the following purposes:

  • a) To verify the correct operation of the site, ensure the security of the pages, optimise the user experience and collect anonymous statistical information on the use and interaction of users with the site; the legal basis is the legitimate interest of the data controller (Article 6(1)(f) GDPR);
  • b) to allow the user to register in the reserved area of the site and access specific content such as, for example, product catalogues: the legal basis is the performance of pre-contractual measures taken at the data subject's request (Article 6(1)(b) GDPR);
  • c) Management of requests via the contact form: the legal basis is the performance of pre-contractual measures taken at the data subject's request (Article 6(1)(b) GDPR);
  • d) Selection and evaluation of candidates submitting spontaneous applications: the legal basis is the legitimate interest of the controller as well as the performance of pre-contractual measures (Article 6(1)(b) and (f) GDPR).

4. Nature of the provision of data

The provision of personal data through our site takes place in different ways, each with specific purposes and legal bases that justify the processing of the data provided by users. The various situations in which personal data may be collected are outlined below, highlighting the mandatory or optional nature of their provision and the consequences of failure to provide them.

a) Operation and Security of the Site

The provision of personal data automatically collected to verify the correct operation of the site, ensure its security, optimise the user experience and collect anonymous statistical information on the use of the site is based on the legitimate interest of the data controller (Article 6(1)(f) GDPR). This collection takes place automatically and its nature is implicit in the use of the Internet communication protocols; therefore, no explicit consent from the user is required.

b) Registration in the Reserved Area

With regard to registration in the reserved area of the site and access to specific content, such as product catalogues, the provision of data is necessary for the performance of pre-contractual measures taken at the data subject's request (Article 6(1)(b) GDPR). Failure to provide such data will make it impossible for the user to register in the reserved area and access the services offered through such registration.

c) Management of Requests via Contact Form

The submission of personal data via the contact form, for the management of users' requests, is based on the performance of pre-contractual measures taken at the data subject's request (Article 6(1)(b) GDPR). The provision of this data is optional but necessary to obtain a response to the requests sent. Without such data, it would not be possible to provide the support or information requested by the user.

d) Spontaneous Applications

For spontaneous applications, the processing of data is based both on the legitimate interest of the data controller and on the performance of pre-contractual measures (Articles 6(1)(b) and (f) GDPR). The provision of data is optional but essential in order to evaluate the data subject's application. Failure to provide the data requested in the CV or application forms will make it impossible to evaluate the data subject for any job opportunities.

In any case, the Controller undertakes to process the personal data provided by users in compliance with the regulations in force regarding the protection of personal data, ensuring maximum confidentiality and security.

5. Recipients of personal data

The personal data collected and processed exclusively for the purposes specified above may be communicated and processed, in compliance with the regulations in force, to:

  • a) Internal Staff such as employees or collaborators of the company that manages the app or the site, who need to access the data to carry out tasks relating to the management, maintenance and support of the application or the site. This includes, for example, IT staff and customer support staff;
  • b) Hosting Service Providers for the application / website;
  • c) External service providers that support the company in various business functions, such as software development, data analysis, marketing, management of communications with customers, legal and accounting services. These providers process the data according to the company's instructions and are bound by confidentiality and data protection agreements;
  • d) Regulatory Authorities and supervisory bodies.

6. Transfer of data to third countries

Should it become necessary, for technical and/or operational reasons, to make use of parties located outside the European Union, we hereby inform you that such parties will be appointed as Data Processors pursuant to and for the purposes of Art. 28 of the Regulation or as Joint Controllers pursuant to Art. 26 of the Regulation, and the transfer of Personal Data to such parties, limited to the performance of specific Processing activities, will be governed in accordance with the provisions of Title V of the Regulation. All necessary precautions will therefore be taken in order to guarantee the fullest protection of the Data Subject's Personal Data, basing such processing on: a) adequacy decisions regarding the recipient third countries expressed by the European Commission; b) adequate safeguards provided by the recipient third party pursuant to Art. 46 of the Regulation; c) the adoption of binding corporate rules. In any case, the Data Subject may request further details from the Data Controller if your data are processed outside the European Union, requesting evidence of the specific safeguards adopted.

7. Processing methods and data retention period

The data collected will be processed using electronic, IT and telematic tools, or by manual processing, with logic strictly related to the purposes for which the Personal Data were collected and, in any case, in such a way as to guarantee the security thereof in all cases.

The retention period of personal data depends on the category of data and the purpose of the processing:

  • a) Browsing Data: Such data are generally retained for a short period, typically no longer than six months, except for any need to investigate computer crimes against the site, which may require retention for a longer period as ordered by the judicial authority;
  • b) User login data: Such data are retained for as long as the account remains active. The user may request the deletion of their account at any time, after which the data will be removed within a reasonable period of 30 days, unless it is necessary to retain them for further periods imposed by legal obligations;
  • c) Identification and contact data for registration in the reserved area and for commercial contact requests: Such data are generally retained for the duration of the relationship with the data subject. The user may request the deletion of their data and account at any time, after which the data will be removed within a reasonable period of 30 days, unless it is necessary to retain them for further periods imposed by legal obligations;
  • d) Data entered in the CV for spontaneous applications: Such data are retained for a period of six months, after which, if no compatible employment opportunities have arisen, the data may be deleted or a renewal of consent for further retention may be requested.

8. Profiling

The controller does not use automated processes for profiling purposes.

9. Cookies and similar technologies

When browsing the site, technical information relating to the hardware and software used by visitors is collected. Such information does not provide personal data of the Data Subject, but only technical/IT data which are used in aggregate and anonymous form for the sole purpose of improving the quality of the service and providing statistics concerning the use of the Site. For more information, please consult the dedicated cookie section.

10. Links to other websites and social media

Our Platform may, from time to time, contain external links to our advertisers and affiliate partners. If the data subject follows a link to any of these websites, they should remember that these websites have their own privacy practices and that we accept no responsibility for such policies. You are requested to consult the privacy notices of said sites before giving consent to the processing of Personal Data.

11. Rights of the data subject regarding data processing

The data subject may exercise the rights provided for by the applicable legislation on the protection of Personal Data, including the right to:

  • a) receive confirmation of the existence of their Personal Data and access its content (right of access);
  • b) update, modify and/or correct their Personal Data (right to rectification);
  • c) request the deletion or restriction of the processing of Data processed in violation of the law, including those whose retention is not necessary in relation to the purposes for which the Data were collected or otherwise processed (right to be forgotten and right to restriction);
  • d) object to processing based on legitimate interest (right to object);
  • e) lodge a complaint with the Supervisory Authority in the event of a violation of the rules on the protection of Personal Data;
  • f) receive a copy in electronic format of the Data concerning them and request that such Data be transmitted to another data controller (right to data portability).

To exercise these rights, you may at any time make a specific request to the Controller by writing an e-mail to privacy@osvat.com. Before responding to the request, we may ask the Data Subject for details to verify their personal identity. The Controller will respond to the request within fifteen (15) days.

12. Changes to the privacy notice

Any changes made to our Privacy notice in the future will be published on this page. Where appropriate, we will inform users or ask them to provide consent. Please consult this page often for any updates or changes to our Privacy notice.

Last updated 10 April 2024