Privacy Policy – Processing of personal data
PRIVACY POLICY – WEB GENERAL – Information notice pursuant to Art. 13 of Regulation (EU) 2016/679 (“GDPR”)
According to Regulation (EU) 2016/679 (General Data Protection Regulation), we provide you the due information concerning the processing of collected personal data. This notice is not to be considered valid for other websites attainable through links, and the Data Controller shall not be held responsible for third-party web pages.
This notice is provided pursuant to Art. 13 of Regulation (EU) 2016/679 (General Data Protection Regulation) and according to the provisions of Directive 2002/58/EC, as amended by Directive 2009/136/EC on Cookies, as well as according to the Provision of the Data Protection Authority dated 08.05.2014 on cookies.
Personal data we may collect and process
Personal data: any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can directly or indirectly be identified, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more specific factors relating to the physical, physiological, genetic, mental, economic, cultural or social identity (C26, C27, C30 GDPR).
Navigation data
Navigation data include IP addresses, domain name, URI/URL addresses, time and method of the request, response status code from the server and some information regarding the user agent (OS version, resolution, device type).
Voluntarily provided data
The optional, explicit and voluntary transmission of messages to contact addresses or forms entails the subsequent acquisition of the sender’s address. The latter, along with any other personal information provided, will be necessary for us to reply.
Social media
For more information regarding the processing of personal data carried out by any Social Media platforms deployed on this website, please refer to their respective privacy policies. The Data Controller processes the personal data through the pages of the dedicated Social Media platforms to manage interactions with users (comments, public posts, etc.) and in compliance with current legislation.
Specific privacy statements may be furnished with regards to specific processing or services offered by the website.
Cookies
More information is available in the specific cookies statement; please refer to the dedicated link in the website footer.
Data Controller
Pursuant to Art. 4 and 24 of Regulation (EU) 2016/679, the Data Controller is PILOT ITALIA SPA, with registered office in via Lanzi, 42 – 20872 Cornate d’Adda (MB), Italy, represented by the legal representative pro tempore.
Purposes and lawfulness of processing
| Purpose of processing | Legal basis | Data retention | Data conferral |
|---|---|---|---|
| A) Website browsing Activities strictly related to site operations and to platform browsing service provision. The data required to avail yourself of this website will be processed as well in order to: – gather statistical information (most viewed pages, number of visitors, timeline visits, geographical source of visits); – monitor the status of services. | Legitimate interest | Data subject rights Art. 6 (1) (f) and recital 47 GDPR: processing is necessary for pursuing the legitimate interest of the Data Controller or third parties. | Single browsing session and up to 7 days thereafter (except for any requests by the Judicial Authority for crime prevention needs). | Necessary in order to guarantee website navigation. |
| B) Contact or information request By means of phone calls, contact forms, Whatsapp or similar tools. | Legitimate interest | Data subject rights Art. 6 (1) (f) and recital 47 GDPR: processing is necessary for pursuing the legitimate interest of the Data Controller or third parties. | 1 year. | Necessary for the legitimate interest of the Data Controller, with due regard to the user’s rights and fundamental freedoms. |
| C) Staff recruiting Research and selection of personnel for the purpose of establishing an employment relationship, also for any positions different from those for which the data subject is a candidate; storage of personal data also for future selections; managing applications in response to job vacancies posted on our website; interviews and any video-interviews (data processing including image / audio). | Contract Art. 6 (1) (b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. | Up to 24 months. | Necessary. The provision of personal data is mandatory where so required; in case of lack of provision, the Data Controller will not be able to consider your candidacy. |
| D) Management of data subjects’ requests Pursuant to Art. 15 and following of the GDPR (data subject rights). | Legal obligation Art. 6 (1) (c) GDPR: processing is necessary for compliance with a legal obligation the Controller is subject to. | 5 years after its closure, except in case of disputes. | Necessary. The provision of personal data is mandatory in order to execute legal obligations. |
| E) Website analytics By means of cookies and similar technologies. | Cookies other than technical ones (or similar) require the user’s consent in order to be deployed (Art. 6 (1) (a) GDPR). Where required, consent will be requested by means of our cookie policy and its banner. | More information available in the cookie policy. | More information available in the cookie policy. |
| F) Direct marketing For the sending of advertising material or direct sales, or for conducting market research, commercial and promotional communication, newsletters, via automated means (email, SMS). The Data Controller, in order to compare and potentially improve the results of automated communications, uses systems with reports. Through these reports, the Data Controller can, for example, track the number of readers, of openings, unique “clickers” and “clicks”; the devices and operating systems used to view the communication; detailed activity of individual users; details of sent, delivered, undelivered and forwarded emails. All this data is used to compare and, if necessary, improve the results of the communications. | Consent Art. 6 (1) (a) and recitals 42 and 43 GDPR: processing is based on the consent to the processing of personal data. | Until withdrawal of consent (or opt-out). | Voluntary: the provision of data is optional. Failure to provide the necessary data will result in the inability to receive direct marketing communications. |
| G) Non-automated profiling Personal data will be entered into company databases/CRMs/platforms in order to conduct analyses, evaluations, and to categorize data subjects into homogeneous groups based on specific business activity characteristics, for better service management and the sending of targeted promotional communications. | Consent Art. 6 (1) (a) and recitals 42 and 43 GDPR: processing is based on the consent to the processing of personal data. | Until withdrawal of consent and for a maximum of 12 months. | Voluntary: the provision of data is optional. Failure to provide the necessary data will result in the inability to perform analyses and send targeted communications. |
Recipients or categories of recipients of personal data
Personal data provided by you may be communicated to recipients who will act as Processors (Art. 28 of Regulation (EU) 2016/679) and/or persons acting under the authority of the Controller and the Processor (Art. 29 of Regulation (EU) 2016/679) for the purposes indicated above.
Precisely, your data may be disclosed to recipients being part of the following categories:
- Subjects providing services for the management of the information system used by PILOT ITALIA SPA and telecommunication networks;
- Studies or companies in the context of assistance and consultancy relationships;
- Subjects providing services related to the management of the above-mentioned purposes;
- Head-hunters agencies;
- Commercial partners, upon consent;
- For direct marketing purposes and upon prior consent, to subjects for the management of direct marketing activities;
- Competent authorities for compliance with legal obligations and/or provisions of public bodies, upon request.
You can request a complete list of processors and recipients by writing to: privacy@pilotitalia.com.
Data transfer to a third country and/or to international organisations
Personal data provided will not be transferred to a third country outside the EEA. Moreover, all data will be hosted and retained in Italy; all third parties to whom data may be disclosed have their registered office in Italy.
Automated-mean processings
Personal data will be manually and electronically processed, as well as by automated-mean activity. It is specified that fully automated decision-making processes are not carried out.
With reference to the profiling activity carried out with prior and express consent, it will be carried out through the intervention of operators who will elaborate the profile of the data subject and analyse his/her habits and consumption choices, in order to improve the commercial offer and the Data Controller’s services (non-automated profiling).
Data subject’s rights
You may freely exercise your rights at any time under Regulation (EU) 2016/679 – GDPR (Sections 15, 16, 17, 18, 19, 20, 21) by contacting the Data Controller – PILOT ITALIA SPA, in person of its legal representative, sending an email to privacy@pilotitalia.com.
You have the right, at any time, to obtain confirmation from the Data Controller as to whether or not personal data concerning you are being processed, request their rectification or erasure, to object to personal data processing (also to profiling), without prejudice to the lawfulness of processing, and to obtain the restriction of processing.
Without prejudice to any other administrative or judicial remedy, in case you consider your data processing in contrast with Regulation (EU) 2016/679, pursuant to Art. 15 (f) of Regulation (EU) 2016/679, you have the right to lodge a complaint with a supervisory authority (www.garanteprivacy.it) and, pursuant to Art. 6 (1) (a) and Art. 9 (2) (a), you have the right to revoke your expressed consent at any time.
Exercising your right to data portability, the Data Controller may provide your personal data in a structured, commonly-used and machine-readable format, subject to the provisions set forth in paragraphs 3 and 4 of Art. 20 of Regulation (EU) 2016/679.
Informative amendments
The Data Controller retains the right to modify, update, add or remove some parts of this information notice at any time.
Date of review: April 27th 2026
PILOT ITALIA SPA