1. Data Controller
The Data Controller is Colibryx S.r.l., with registered office at Via Riccardo Felici 11, 37135 Verona (VR), Italy, VAT No. 04901390239, REA VR 459634.
For any communication regarding the processing of personal data, you may contact the Data Controller at the email address: [email protected].
2. Types of data collected
a) Browsing data
The computer systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This includes information such as: IP address, browser type, operating system, domain name, website addresses from which access or exit was made, information about pages visited, access time, time spent on each page, internal path analysis, and other parameters related to the user's operating system and computing environment.
b) Data voluntarily provided by the user
The optional, explicit, and voluntary submission of data through the contact, application, or consultation request forms on the website entails the subsequent acquisition of the data entered by the user, including: name, surname, email address, phone number, company name, message, and, where applicable, curriculum vitae.
c) Cookies and tracking technologies
The website uses technical, analytics, and marketing cookies. For detailed information about the cookies used, please refer to the Cookie Policy.
3. Purposes and legal basis of processing
Personal data is processed for the following purposes:
- Service provision and request management (Art. 6(1)(b) GDPR): to respond to requests submitted through contact forms, manage applications, and provide the requested consulting service.
- Compliance with legal obligations (Art. 6(1)(c) GDPR): to fulfill obligations established by law, regulations, or EU legislation.
- Statistical analysis (Art. 6(1)(a) GDPR — consent): with the user's consent, analysis of website usage through Google Analytics 4 and Microsoft Clarity to improve service quality and browsing experience.
- Marketing and remarketing (Art. 6(1)(a) GDPR — consent): with the user's consent, use of Meta Pixel to measure advertising campaign effectiveness and deliver personalized content.
- Security and fraud prevention (Art. 6(1)(f) GDPR — legitimate interest): use of Google reCAPTCHA to protect website forms from automated abuse.
4. Data recipients
Personal data may be disclosed to the following categories of recipients, acting as data processors or sub-processors:
- Cloudflare, Inc. — Hosting and CDN (Content Delivery Network)
- Twilio Inc. (SendGrid) — Transactional email delivery
- Google LLC — Google Analytics 4, Google reCAPTCHA
- Microsoft Corporation — Microsoft Clarity
- Meta Platforms, Inc. — Meta Pixel
- Mapbox, Inc. — Interactive maps service
Data will not be disclosed to unspecified subjects nor transferred to third parties for their own purposes.
5. Transfer of data to third countries
Some of the above providers are based in the United States of America or in other countries outside the European Economic Area. Data transfers comply with Chapter V of the GDPR and are based on:
- EU-US Data Privacy Framework for providers certified under the European Commission's adequacy decision;
- Standard Contractual Clauses (SCC) adopted by the European Commission under Art. 46(2)(c) GDPR, where the Data Privacy Framework is not applicable.
6. Data retention period
- Contact and consultation form data: retained for a maximum of 24 months from collection, unless otherwise required by legal or contractual obligations.
- Application data: retained for a maximum of 24 months from receipt, for potential future employment opportunities.
- Browsing data and analytics cookies: retained according to the timeframes specified in the Cookie Policy.
- Data for tax and accounting obligations: retained for 10 years pursuant to Art. 2220 of the Italian Civil Code.
7. Data subject rights
Under Articles 15-22 of the GDPR, the user has the right to:
- Access (Art. 15): obtain confirmation of the existence of processing and access their personal data.
- Rectification (Art. 16): obtain correction of inaccurate data or completion of incomplete data.
- Erasure (Art. 17): obtain the erasure of their data, in cases provided for by law.
- Restriction (Art. 18): obtain restriction of processing, in cases provided for by law.
- Portability (Art. 20): receive data in a structured, commonly used, and machine-readable format.
- Objection (Art. 21): object to data processing at any time, on grounds relating to their particular situation.
- Withdrawal of consent (Art. 7): withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
8. How to exercise your rights
The user may exercise their rights by sending a written request to the email address [email protected], or by registered mail to the registered office: Via Riccardo Felici 11, 37135 Verona (VR), Italy.
The Data Controller will respond within 30 days of receiving the request, extendable by a further 60 days in cases of particular complexity, informing the data subject of the extension and the reasons for the delay.
9. Right to lodge a complaint
Any user who believes that the processing of their personal data is in violation of the GDPR has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it), pursuant to Art. 77 of the GDPR.
10. Changes to this privacy notice
The Data Controller reserves the right to modify this privacy notice at any time. Any changes will be published on this page with an indication of the last update date. Users are encouraged to periodically consult this page to review the most recent version.