Privacy Policy and Cookies

This privacy policy and cookies is provided to users/visitors who interact with the official website of Exprivia Group, accessible by electronic means from the address https://www.exprivia.it which corresponds to the home page of the site, pursuant to:

• Article 13 of EU Regulation 2016/679;
• of the Italian Privacy Authority’s Provision No. 229 of May 8, 2014 (Identification of simplified procedures for information and acquisition of consent for the use of cookies);
• of Italian Privacy Authority Provision No. 231 of June 10, 2021 (Guidelines cookies and other tracking tools), which supplements Provision No. 229 of 2014 and provides important clarifications in order to facilitate data controllers in the correct application of the current regulatory framework;
• of the Art. 29 Working Party’s Recommendation No. 2/2001 on minimum requirements for online data collection in the EU;
• of Directive 2009/136/EC, amending Directive 2002/58/EC (so-called e-Privacy Directive), concerning the processing of personal data and the protection of privacy in the electronic communications sector;
• Of WP 29 Guidelines of April 10, 2019, ratified by the European Data Protection Board and superseded by Guidelines 05/2020 on consent under Regulation 2016/679 adopted on May 4, 2020

This policy describes how to manage only the official Exprivia Group website, but not other external websites that may be consulted by the user through links present on the Exprivia Group website. Additional information may be provided within specific sections.

The processing of personal data collected in certain formats of some sections of the website (examples include the “Newsletter”, Contact us, Whistleblowing and Employment Applications sections) are governed through specific disclosures, available in the relevant sections of the website.

Access to the Site does not require the user/visitor to provide any personal information.

1) TYPE OF DATA PROCESSED AND PURPOSE OF PROCESSING

1.1) Purpose of processing

The processing of personal data of users/visitors is aimed, exclusively, at enabling users to navigate within the Website. II personal data of users may, also, be used for the fulfillment of legal obligations. In some sections of the Website, where information services organized by the Data Controller are offered, additional personal data and preferences may be collected, which may be processed only after collecting the visitor’s express consent.

1.2) Data provided voluntarily by the user

The voluntary and explicit sending of electronic mail to the addresses indicated in the different access channels of this site entails the subsequent acquisition of the sender’s/user’s data, necessary to respond to the instances produced, as well as any other personal data entered by the same.

Personal data provided by users will be disclosed to third parties only if the disclosure is necessary to fulfill the users’ requests. Data collected will not be kept for a period of time longer than necessary to fulfill the purpose for which it was acquired. These retention periods generally apply to all personal data that have been collected to respond to the requests produced.

1.3) Navigation data

The “software” platform responsible for the operation of this website acquires, in the course of their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

This is information that is not collected in order to be associated with identified data subjects, but which by its very nature could, through processing and association with data held by third parties carried out only at the explicit request of the Judicial Authority, allow users to be identified.

This category of data includes the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) notation addresses of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and computer environment. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning.

1.4) Cookie Policy

Cookies are small text files that sites visited by users send to their terminals, where information is stored that is then transmitted back to the same sites on subsequent visits. The terminals referred to are, for example, a computer, tablet, smartphone, or any other device capable of storing information. The information encoded in cookies can include personal data, such as an IP address, user name, unique identifier, or email address, but can also contain non-personal data, such as language settings or information about the type of device a person is using to browse the website.

In addition to the above information, a cookie typically contains the name of the Internet domain (the IP address of the site) from which the cookie originated, the “lifetime” of the cookie (i.e., an indication of when the cookie expires), and a numeric code, usually a single randomly generated number.

This site does not make use of passive tracking tools such as fingerprinting but makes exclusive use of active identifiers such as cookies.

1.4.1) Technical cookies used by this site and their purpose

This site uses technical cookies, which are automatically installed following access to the site, for the proper functioning of the website.

This type of cookies includes navigation or session cookies aimed solely at enabling the transmission of communication over an electronic communications network or to the extent strictly necessary for the provider of an information society service explicitly requested by the contractor or user to provide such service or, functionality cookies, which allow the user to navigate according to a set of selected criteria that, among other things, do not contain personal data (e.g., language, choices on certain types of cookies inherent in the type of non-technical device) in order to improve the service rendered to the user.

Technical cookies used by this site expire at the same time as the browser is closed unless those containing the user’s choice on non-technical cookie consents which have a 6-month expiration.

At any time, the user will still have the option of accepting or not accepting the use of cookies by changing their browser settings. Should the user use different computers in different locations, he/she will have to make sure that each individual browser is set correctly. The user can easily delete any cookies installed in the cookie folder by following the procedures provided by the browser used.

1.4.2) Advertising or profiling cookies.

Some sections of the website use third-party platforms that display content for which to offer certain types of advertising, including those related to information services offered through the website, as well as some advertising based on users’ interests. Specifically, said sections use cookies and tracking technologies provided by HubSpot, a marketing automation and CRM platform used for purposes of data collection, analysis of user behavior, and sending personalized communications. HubSpot’s cookies allow it to track user interactions with the website (e.g., filling out forms, downloading content, viewing specific pages) and to improve the quality and relevance of messages sent.

Information collected by HubSpot may include IP address, approximate geographic location, device type, and browsing behavior within the site. The data is processed by the Owner in accordance with the principle of minimization and is not shared with third parties for purposes other than those stated.

Authorized third parties may also set cookies when you interact with Exprivia’s services. Third parties include search engines, social media, and companies that provide advertising services. These third parties use cookies in the delivery of advertising content, including advertising defined by your interests, to assess the effectiveness of their ads, and to provide services on Exprivia’s behalf.

Personalized ads, sometimes known as interest-based ads, are part of the Exprivia Group website user experience. We show personalized ads to help you find and discover features, products, and services that might interest you. You may also see these ads on other Services and on third-party sites. The cookies used in this category are used for the purpose of selecting personalized ads, measuring the effectiveness of displayed ads, detecting and preventing fraud and reputational damage to brands and vendors who advertise with Exprivia, and developing, troubleshooting, and improving our advertising services.

You can request deletion of your personal information from our advertising systems at any time. If you do not request deletion, we will retain your personal information for as long as necessary to pursue the advertising purposes described in this Policy, such as selecting personalized ads or detecting fraudulent activity.

Unless manually deleted, advertising cookies remain in your browser for up to 13 months from when you provided us with consent to use these cookies.

We use personal information about your interactions with the Information Services available on Exprivia’s website to personalize ads. We create groups of visitors, based on interests identified from their browsing.

We may also use cookies and similar identifiers, such as IP address, to select personalized ads and understand which ads are clicked on or displayed. For example, we may use IP address to limit the number of times the same ad is shown to you.

The Exprivia website uses third-party advertising and profiling cookies for which your explicit and specific consent is required.

By default, all advertising and profiling cookies are disabled. The user can at any time consent to their use or disable them using the “Cookie Settings” link located at the footer of each web page. In case the visitor has logged in to the website for the first time or the website does not find the technical cookie inherent in the choices made about cookies, the website will present a banner with a short information and give the possibility to accept all of them, deny all of them or customize them individually.

1.4.3) Third Party and Social Plug-in Cookies.

Exprivia Group website pages may contain plug-ins, such as those from Social Networks. If you access one of our web pages that has such a plug-in, your Internet browser connects directly to the social and the plug-in is displayed on your screen through your browser connection.

Exprivia uses the AddToAny Plug-in to enable the user to share informational content posted on the website in a variety of Social platforms. For more information about the AddToAny Plug-in please refer to the following link AddToAny Privacy Policy. Prior to the use of such Plug-ins the interested party is encouraged to consult the privacy policy of the social networks themselves, on their official pages. In some cases the Plug-ins may make use of third-party cookies.

The Exprivia website makes use of third-party cookies from YouTube in order to show Exprivia Group videos posted in Exprivia Channel. Please refer to the following YouTube Privacy Policy link for more information.

In addition, Exprivia’s website uses analytical cookies. Google Analytics cookies capture information about how the visitor uses the website. The data collected include the number of visitors, the source from which they came, and the pages they visited. Exprivia acquires them in aggregate and anonymous form for the sole purpose of analyzing the sections of the site of greatest interest and improving its offerings through the site. For more information please refer to the following link http://tools.google.com/dlpage/gaoptout.

By default, all third-party and social plug-in cookies are disabled. The user can at any time consent to their use or disable them using the “Cookie Settings” link located at the footer of each web page. In case the visitor has logged in to the website for the first time or the website does not find the technical cookie inherent in the choices made about cookies, the website will present a banner with a brief information and give the possibility to accept them all, deny them all or customize them individually. In some cases, disabling them may not allow you to use certain features.

We also inform you, that by not accepting marketing cookies you will not be able to view the thematic videos also published on the YouTube channels of the Group companies and processed by them (e.g. podcasts). For this reason, on each web page where such videos are present should you attempt to access them, without having previously enabled marketing cookies, a notice will appear explaining the reason for the video’s inaccessibility and reminding you of the possibility to change your choices regarding marketing cookies. To that end, to facilitate your browsing you will also find a link to the “Setting About Cookies” web page that allows you to enable such cookies. This enablement may also be temporary since, immediately after viewing the video of your interest, and in any case at any time, you will be able to disable marketing cookies again.

1.4.4) Resubmission of the consent request banner.

The reiteration of the request for consent in the presence of a previous failure to provide it is an illegitimate activity that, therefore, Exprivia will not carry out.

The consent acquisition banner may be resubmitted to you in the following cases:

• Where at least six months have elapsed since the previous submission of the banner;
• In cases where the conditions of processing have changed significantly and, therefore, the banner also fulfills the information function in regard to the changes that have occurred (e.g., in the case of changing third-party cookies);
• When Exprivia cannot have knowledge of the fact that a cookie has already been previously stored on the device to be transmitted in a subsequent visit of the same user, to the site that generated it (e.g., hypothesis in which the user chooses to delete the cookies legitimately installed in his device without the holder being able to keep track of the will to maintain the default settings and, therefore, to continue browsing without being tracked).

1.4.5) How to control cookie settings.

You can also remove existing cookies and block the installation of new cookies through your browser settings.

Users/visitors can decide from time to time whether or not to accept cookies by configuring their browser to generate a warning each time a cookie is saved. Most popular browsers provide the ability to block only third-party cookies, accepting only the site’s own cookies. Refer to the informational websites of the browser you are using.

1.4.6) LINKS TO OTHER SITES

Browsing Exprivia Group’s website provides access through links to other websites operated by third parties. These sites may collect personal information about the data subject. Exprivia does not control the sites that are operated by such parties and cannot be held responsible for their conduct.

Requirements to protect the privacy and security of personal data processed on sites linked to or from the Exprivia Group site are not covered by this privacy policy. Exprivia, therefore, is not responsible for the privacy conduct of these sites.

2) MODE OF DATA PROCESSING AND STORAGE

Personal data are processed by automated means (e.g., using electronic procedures and media) and/or manually (e.g., on paper) for the time strictly necessary to achieve the purposes for which they are collected and, in any case, in accordance with the relevant regulations. Specific security measures are observed to prevent data loss, illicit or incorrect use and unauthorized access.

No automated decision making will be applied to the data collected.

After this period, the data will be deleted or transformed into anonymous form, unless their further storage is necessary to fulfill legal obligations or to comply with orders issued by Public Authorities.

3) OPTIONAL NATURE OF PROVIDING DATA

The provision of personal data by the interested party, for the purposes described in the previous paragraph (1.2), is to be considered optional. Failure to provide them may result in the inability to navigate in certain sections of the site or to follow up on any requests submitted.

4) OWNER, DATA PROTECTION OFFICER (DPO) AND APPOINTEES

The Data Controllers of personal data, relating to identified or identifiable persons who have consulted this site are the Companies belonging to the Exprivia Group:

• Exprivia S.p.A. with registered office in via A. Olivetti, 11- Molfetta (BA);
• Exprivia Projects Srl with registered office in Viale del Tintoretto 432 – Rome.

Data Controllers have appointed a Data Protection Officer or Data Protection Officer in accordance with Articles 37 ff. of EU Regulation 2016/679 who can be contacted:

• for Exprivia SpA at the following e mail address: dpo_expriviaspa@exprivia.com
• for Exprivia Projects Srl at the following e mail address: dpo_expriviaprojects@exprivia.com.

Treatments related to the web services of this site are handled exclusively by technical personnel, appointed/authorized and instructed to the proper processing of personal data that, in no case, will be subject to dissemination.

5) COMMUNICATION AND/OR DISSEMINATION OF DATA

Except as stated in Section 1.2, the personal data provided by you will not be disclosed to third parties or disseminated and will not be transferred to third countries (outside the EU) without the explicit consent, if any, provided by the data subject.

6) DATA RECIPIENTS

For the pursuit of the purposes described, or in the event that this is indispensable or required by provisions of the law or by authorities with the power to impose it, the Controllers reserve the right to communicate the data to recipients belonging to the following categories:

• the Data Protection Officer, to follow up on privacy claims of data subjects and for any further eventualities that fall within his or her duties as outlined in Article 39 of the EU Regulation 2016/679;
• Control Authorities and, in general, subjects, public or private, with functions of public relevance (e.g.: Prefecture Police Headquarters, Judicial Authority, in any case only to the extent that the prerequisites established by the applicable regulations are met);
• other parent, subsidiary or associated companies, pursuant to Article 2359 of the Civil Code;
• professional firms or companies as part of service and consulting relationships;
• Individuals who carry out control, audit and certification duties of the activities put in place by the Holders;
• Owner’s suppliers, formally appointed as data controllers.

7) RIGHTS OF INTERESTED PARTIES

“Data subjects,” i.e., natural persons to whom the data refer, have the right, at any time, to access the information concerning them and to request that it be updated, rectified and supplemented, as well as erased, transformed into anonymous form or blocked, limited in its processing, and portability of the data, as well as to object in any case in whole or in part to its processing, for legitimate reasons, in accordance with Articles 15 to 22 of EU Regulation 2016/679.

Moreover, data subjects, if the processing of their data is based on consent, may revoke it at any time. Revocation of consent does not invalidate previous processing. Please note that the data subject may always object to processing for promotional purposes.

Processing of personal data carried out for cybersecurity purposes or for defensive needs are among the processing for the legitimate interest of the Data Controller, in which case the data subject may object only for reasons related to his or her particular situation, which the Data Controller will evaluate without prejudice to the execution of defensive purposes.

For any information regarding the processing of data, as well as for exercising their rights under Articles 15-22 of EU Regulation 2016/679, users can send an email to the DPO addresses above.

In addition, data subjects have the right to appeal to the Garante per la protezione dei dati personali, based in Rome at Piazza Venezia, 11, or another authority to lodge a complaint about the processing of their personal data under Article 77 if they believe there has been a violation of their personal data v. www.garanteprivacy.it.

8) CHANGES TO THE PRIVACY POLICY

This Privacy Policy may be subject to change over time – also related to the possible entry into force of new sector regulations, the updating or provision of new services or to intervening technological innovations – so we invite the user/visitor to periodically consult this page.