Privacy Policy

Privacy Policy Pursuant to Articles 12 and 13 of the Regulation (Eu) 2016/679 (“Gdpr”) on the Protection of Personal Data of the Website’s Users

Evolution People S.r.l. is committed to the protection and respect of personal data collected in the performance of its business. This document explains the management of the website available at www.evolutionpeople.it (the “Website”) as to the processing of personal data of the users who visit the Website and use its services and functionalities (the “Users”) pursuant to articles 12, 13 and, if necessary, article 14 of GDPR.

This privacy policy does not apply to other websites which may be consulted by the User through links made available on this Website.

1. Data Controller and DPO

The Data Controller is Evolution People S.r.l., Via Mauro Macchi 50, 20124 Milan, phone no. 0287196562, email finance@evolutionpeople.it (the “Controller” or “EP”).

Since the Controller is in Italy, no data representative has been appointed.

The Controller has appointed the lawyer Mr. Antonio Corrado Assenza as data protection officer, who may be contacted at the same address of the Controller or, alternatively, at the email DPO@evolutionpeople.it.

2. Type Of Personal Data Processed

2.2 Browsing data and environmental variables

The IT systems and procedures used by Website automatically collect, during their ordinary use, certain data and personal data of the User, including environmental variables. This category of data includes, by way of example::

• IP addresses of the computers used by Users;
• number of accesses;
• visited web pages;
• date and time of access;
• The URL visited by the User before accessing the Websit;
• Type of browser;
• Operating system used.

Unless otherwise specified herein and in the Cookie Policy (as defined below) regarding automatic navigation data, the mere use of the Website and its sections does not imply the processing of personal data of the User.

The rules, purposes and methods of processing of personal data of Users collected or processed through cookies and other tracking tools – according to the provision set forth by article 10 of Directive 95/46/CE and with the provisions of Directive 2002/58/CE, as revised by Directive 2009/136/CE, with regard to Cookies and article 122 of the Data Protection Code as well as the “Cookie guidelines and other tracking tools” adopted by the Privacy Authority on 10 June 2021– are defined in detail in the cookies policy, available on the Website at the following URL: http://www.evolutionpeople.it/cookies-policy/ (the “Cookies Policy”).

2.3 Data provided voluntarily by the User

Without prejudice to paragraph 2.1 above and to the Cookies Policy, EP only collects and processes the personal data explicitly and voluntarily provided by the User through:

• email or ordinary mail sent to the addresses indicated on the Website;
• emails, including curriculum vitae or other documents, sent to the address: recruiting@evolutionpeople.it;
• the completion of the form published on the web page: [INSERIRE URL] (the “Form”).

Personal data provided by the User in such occasions may involve the acquisition by EP of common personal data of the User, such as e-mail addresses, names, surnames or other personal data voluntarily communicated by the User by submitting his curriculum vitae or request.

In particular, in addition to the e-mail address necessary to reply to the User, any other personal data to which the electronic communication refers will be processed. The data collected in this way will be stored and processed exclusively for the purpose of storing the correspondence and will not be used for other purposes.

The personal data of the User collected through the Form are:

• Name and surname
• E-mail
• Company name
• Telephone number.

Special categories of personal data ex Article 9 of GDPR will not be processed. The User is invited not to enter special category of personal data (for example data concerning their health) in the communications sent to the Controller.

3. Principles Applicable To Processing

EP, in compliance with the provisions set forth by GDPR, constantly strives to ensure that personal data are:

1. processed in a lawful, correct and transparent manner towards the interested party («lawfulness, fairness and transparency»);
2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes («purpose limitation»);
3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed («data minimization»);
4. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay («accuracy»);
5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject («storage limitation»);
6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures. («integrity and confidentiality»).

EP adopts appropriate technical and organizational measures to ensure the protection of personal data from the design stage and to ensure that, by default, only data necessary for each specific purpose are processed.

This privacy policy may be modified, coherently with the evolution of applicable laws and with technical and organizational measures implemented by the Controller over time.

4. Methods of processing

4.1 Types of cookies and tracking tools used

As better described in the Cookies Policy,the Website uses technical, analytic and profiling cookies to ensure the proper functioning and optimization of the Website’s performance, as well as for profiling and marketing purposes.

Cookies are text strings that the websites visited by the User (“publisher” or “first party”) or other websites or web servers (“third parties”) place and store – directly in case of publishers and indirectly in case of third parties – in the terminal of the User.

The main types of cookies used by the Website are:

• technical cookies, namely cookies used for the sole purpose of “carrying out the transmission of a communication over an electronic communications network, or to the extent strictly necessary for the provider of an information society service explicitly requested by the contracting party or user to provide that service” (see Section 122 (1) of the Privacy Code);
• statistical cookies or (“analytics”), namely cookies directly created by the Controller or provided by third parties, including the cookies of Google Analytics (i.e. Google Inc., located at 1600 Amphitheater Parkway, Mountain View, CA 94043, United States) and Hubspot (HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141 USA);
• profiling cookies, for marketing purposes used to monitor Users on websites. The purpose is to publish and display advertising banners relevant and engaging for the User and thus of greater value for publishers and third-party advertisers.

The detailed list of cookies and other tracking tools used by the Website, the type of data processed, and the related characteristics and purposes are detailed in the Cookies Policy.

Since cookies are normal text files, they can be accessed using text processing programs. In any case, each User can independently set his/her browser on his/her device to automatically accept/reject cookies, by visiting the following webpages:

Google Chrome: https://support.google.com/chrome/answer/95647?hl=it 
Mozilla Firefox: https://support.mozilla.org/it/kb/protezione-antitracciamento-avanzata-firefox-desktop
Internet Explorer: https://support.microsoft.com/it-it/windows/eliminare-e-gestire-i-cookie-168dab11-0753-043d-7c16-ede5947fc64d
Safari: https://support.apple.com/it-it/guide/safari/sfri11471/mac

4.2 Methods of processing the data provided voluntarily by the User

The processing of Users’ personal data is carried out both manually and in an automated manner, using both analogue, digital, telematic and electronic tools, according to the purposes indicated in this Policy and in the Cookie Policy and, in any case, in order to ensure security and confidentiality of the data.

5. Purposes and legal basis of processing. Optional nature of consent and consequences of consent refusal

5.1 Purposes and legal basis of processing

As to technical cookies and browsing data, the processing of User’s data is carried out to ensure a correct functioning of the Website. The Website cannot work properly without these cookies. The processing of data collected by technical cookies is based on the legitimate interest of the Controller and does not require the prior collecting of the User’s consent.

As to non-technical cookies, the processing of personal data, including profiling, allows the offering of a personalized browsing experience. In this case, the legal basis is the express consent of the User, to be expressed in compliance with the Cookie Policy. the refusal to grant consent will only prevent the processing of the relevant personal data and will only determine the impossibility for the Controller to provide a personalized service. In this case, the User will be still able to navigate the Website and use the related services.

As to data provided voluntarily by e-mail, the processing of personal data will allow us to respond to Users’ requests. The legal basis of the data processing is the legitimate interest of the Controller in responding to the data subjects and the prior acquisition of the User’s express consent will not be required.

As to the data provided voluntarily through the Form, the processing of personal data will be subject to the prior acceptance of this privacy policy and the granting of consent. The processing of data provided by the User through the Form for marketing and commercial purposes, including the sending of company’s newsletters, is subject to the prior specific consent of the User, which will be collected separately from the acceptance of this privacy policy.

The legitimate interests of the Controller or third parties may constitute a valid legal basis for the processing of personal data, provided that the interests or fundamental rights and freedoms of the data subject do not prevail. In general terms, such a legitimate interest may exist where a relevant and appropriate relationship between the Controller and the data subject is in place, like in the case the data subject is a customer of the Controller.

5.2 Methods for granting consent

The consent to the processing of personal data through non-technical cookies shall be expressed:

• by clicking on a specific thick box inside a banner and in any case in accordance with the Cookie Policy.

The consent to the processing of personal data for marketing and commercial purposes collected through the Form, shall be expressed:

• by clicking on a specific thick box at the bottom of the Form, next to the disclaimer “Subscribe to our newsletter”, which will be separate and distinct from the thick box related to the confirmation and acceptance of this privacy policy.

6. Sources from which personal data originate

Without prejudice to the provisions of the Cookie Policy, EP will process only the data provided by the User in accordance with this privacy policy, collected through the Website, by e-mail or by the filling of the Form.

EP will not process data collected from public sources.

7. Data transferred to third parties

The personal data processed, for the aforementioned purposes, may be communicated by the Controller:

• to those who, within the organization of the Controller, need access to such data due to their role or task. These individuals are persons authorized to process under the direct authority of the Controller pursuant to Article 4 n. 10 of EU Regulation 2016/679 (hereinafter “Appointees”);
• to the subsidiaries or parent companies pursuant to article 2359 of the Italian Civil Code that are authorized to process the data for internal administrative purposes;
• to third parties to whom the Controller may outsource certain activities and who consequently provide the Controller with certain instrumental services, in any case related to the processing operations and purposes described above, such as, for example, administrative services, hosting services of the Website, communications companies that carry out communication activities on behalf of the Controller, companies that offer information society services, service providers of the communication company. These parties shall process personal data on behalf of the Controller and will be authorized as data processors pursuant to Article 28 of the GDPR.

The transfer of personal data to such subjects, in case of entities established in a Extra-EU Country or international organizations, will be performed only if an adequacy decision of the EU Commission exists, which has verified that the other Country, the area or one or more specific sectors within that country or the international organization at stake can guarantee an adequate standard of protection of data subject’s rights. In any case, the Controller – if deemed necessary – reserves the right to enter into specific separate agreements binding these entities to adopt adequate security and organizational measures, aimed at guaranteeing the data subjects’ rights appropriately.

In this respect:

• Google Inc., Google Inc., updated on October 2021, the terms of personal data processing to comply with the new standard contractual clauses concerning the application of the Regulation (EU) 2016/679, approved by the EU Commission (https://cloud.google.com/blog/products/compliance/google-cloud-approach-to-implementing-eu-sccs). The User is invited to read such information;
• Hubspot Inc. updated as of September 2021, the terms of personal data processing to comply with the new standard contractual clauses concerning the application of Regulation (EU) 2016/679, approved by the EU Commission (https://legal.hubspot.com/dpa). The User is invited to read this information.

The data can be transferred to the following Countries: European Union, United States of America. To obtain a copy of such data or the place where they are available, simply send your request to: amministrazione@evolutionpeople.it.

8. Retention period of personal data

Unless otherwise provided in the Cookie Policy, personal data processed and stored for all purposes set out in this privacy policy will be retained for a period which will not exceed 24 months, starting from the date of its collection.

In any case, the Controller reserves the right to request the interested subjects to renew their consent to the processing and/or to verify the consent previously expressed.

9. Rights of the data subject

Pursuant to Article 7 of the Privacy Code and Article 15 and ss. of the GDPR, the Controller informs the User of the existence of the following rights:

• Right of the interested party to access data: the data subject has the right to obtain confirmation from the Controller of whether or not their personal data is being processed at that time and, in that case, to obtain access to their personal data and to specific information, in accordance with Article 15 of the GDPR;
• Right of rectification: the data subject has the right to obtain the correction of inaccurate personal data concerning them from the Controller, without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, and to provide an additional declaration, in compliance with article 16 of the GDPR;
• Right to delete data, including the right to withdraw consent: the data subject has the right to obtain the deletion of personal data concerning them by the Controller, without undue delay, and the Controller is obliged to cancel the data without undue delay; the interested party also has the right to withdraw their consent, if the reasons set out in article 17 of the GDPR apply; in this case, the right of revocation can be exercised at any time without undermining the lawfulness of the treatment based on the consent given prior to the revocation;
• Right to limit processing: the data subject has the right to obtain a limitation of the processing from the Data Controller, when the hypotheses defined by article 18 of the GDPR apply;
• Right to data portability: the data subject has the right to receive, in a format which is structured, in common use and can be read on an automatic device, the personal data concerning him/her that were provided to the Controller, and has the right to transmit this data to another data controller without impediment by the Controller, in the cases and under the conditions specified by article 20 of the GDPR.

10. Exercising the rights

Requests to exercise the rights indicated in this document must be addressed directly to the Controller at the following email address: amministrazione@evolutionpeople.it. Alternatively, you can exercise your rights by sending a communication via registered mail to the following address: Via Mauro Macchi 50, 20124 Milan (Milan).

11. Accessibility of this information

This information is available and accessible at the address www.evolutionpeople.it as well as at the registered office of the Controller.