Privacy notice

ILIOS S.r.l. (hereinafter also “ILIOS” or the “Company”) is the Controller of the Processing and processes the personal data of its web Users (hereinafter, “Data Subjects” or “Data Subjects”) in compliance with their rights, lawfully, transparently and fairly, in accordance with the GDPR, EU Regulation 2016/679 (“GDPR”).

This notice concerns the processing of the personal data of users who:

• browse the ILIOS website;
• interact with the website through social buttons (LinkedIn, X, Instagram, etc.),
• visit or interact with the official ILIOS social pages through their own account.

This notice refers exclusively to processing carried out by ILIOS as an independent Controller. The data are first of all collected by the individual Social Networks, which act as Controllers under their own privacy policies.

When users interact with the ILIOS social pages (comments, messages, likes, statistical insights, etc.), ILIOS receives certain information from the social networks and processes it independently, within the limits of the features made available by the platform.

1. Legal basis (Art. 6 GDPR), purposes and nature of the processing

(why we process your data)

The Data Subject is informed that ILIOS will process their personal data for the following purposes:

1. Interaction with and/or browsing of the website (recording of browsing data and technical logs, to ensure that the Site works properly, network security, debugging and the prevention of malicious activity);
2. Interaction with social networks: when users click on the social buttons on the Site (e.g. LinkedIn), the browser sends data to the selected social network, allowing users to take part in the activities carried out through the page. This includes monitoring interaction with users (comments, messages, reactions) and moderating content, ensuring compliance with the Netiquette and protecting the rights of ILIOS.
   • Legal basis: legitimate interest of the Controller in the proper management and security of its communication channels and in preventing abuse by users through the page (Art. 6(1)(f) GDPR).
   • Nature of the processing: optional. Users may choose not to interact with the social pages and/or not to press the social buttons on the website.
3. Handling of requests sent through the Site or the Social networks.
   • Legal basis: pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR).
   • Nature: necessary in order to handle the request.

   N.B. Where a CV is sent through the dedicated forms, please refer to the Privacy notice for applicants, available in the privacy section of the website.

4. Compliance with legal obligations (administrative, tax or required by Authorities).
   • Legal basis: legal obligation (Art. 6(1)(c) GDPR).
   • Nature: mandatory.

2. Types of data processed

COMMON DATA:

• any type of data you provide through your interactions with the website and our social channels (including public content such as name, profile picture, etc.);
• browsing data (e.g. IP address);
• log files, for users browsing the website;
• contractual (CV) data for applicants;
• data deriving from the statistical insights provided by the social networks (in aggregate form).

3. Retention period and processing methods

The data you provide will be processed for the period necessary to deliver the service requested and in compliance with the retention obligations laid down by law and, in any case, always for the shortest possible time for each purpose, in line with the principle of privacy by default.

Specifically, unless otherwise required by law: 6 months after non-hiring for applicants’ data, 1 month for IP addresses and log files.

For requests you make through the channels provided, for the time needed to answer them and in any case no longer than 24 months.

Your data are processed by electronic means and stored in cloud archives provided by third parties located within the European Union or, in the case of paper documents, kept in dedicated files accessible only to specifically authorised persons.

4. Browsing data

The IT systems and software procedures that run the website acquire certain personal data (IP address, browser type, domain name, date and time of the visit, actions performed, etc.) whose transmission is implicit in the use of Internet communication protocols and which, if combined with other data, could lead to the identification of the person.

These data are used solely to:

• obtain anonymous statistical information on the use of the site;
• check that it works properly;
• debug applications and monitor IT systems in order to detect any misuse and allow post-incident analysis.

These data are deleted immediately after processing and could be used to establish liability in the event of cybercrimes against the site.

5. Communication and disclosure of data

ILIOS undertakes not to transfer the personal data communicated and/or processed to third parties. However, they may be communicated to third parties in order to comply with legal or contractual obligations, to the extent necessary for the Company’s activities, in particular to:

• parties acting as Processors under Art. 28 GDPR (e.g. IT service providers, service providers, legal and tax advisers, etc.);
• parties acting as independent Controllers, including public and supervisory Authorities, where required by law or by sector regulations.

6. Data subject’s rights

The Data Subject has all the rights set out in Articles 15 et seq. of the GDPR. In particular, they have the right to obtain access, rectification, erasure and portability of their data, as well as the right to restrict Processing, the right to withdraw consent (without affecting the lawfulness of Processing carried out before withdrawal), the right to object to Processing and the right to lodge a complaint with a supervisory authority.

These rights may be exercised by the Data Subject by sending a request to the Controller. The request may be sent by registered letter with return receipt to the registered office address given at the end of this notice (writing “Privacy Request” on the envelope), or by email to: info@iliositalia.com

The Controller will reply to the request without undue delay.

Data Controller

The Data Controller is ILIOS srl.
Registered office: Via Monte Napoleone 8, 20121, Milan (MI), Italy
Tel: (+39) 080 893 5086