Privacy policy.
Information on the processing of personal data under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)
This is a translation of the Italian privacy policy, published for convenience: in case of discrepancy the Italian version prevails.
This notice describes how Ardeevo S.r.l. processes the personal data:
- of users who visit and use the website ardeevo.eu (Sections 1–9);
- of people who apply for an employment or collaboration position at Ardeevo, through any channel (Section 10 — Applicants).
This notice does not cover the processing of the data of employees, collaborators, clients and business partners within their respective relationships, for which Ardeevo provides a specific notice.
1. Data controller
Ardeevo S.r.l., Viale della Grande Muraglia n. 498, 00144 Rome, Italy (the “Controller” or the “Company”).
Email for any request concerning personal data: privacy@ardeevo.eu
The Controller may rely on suppliers that process personal data on its behalf, appointed as processors under Art. 28 GDPR and bound to adopt appropriate technical and organisational measures.
2. Data collected through the site
- a) Identification data: first and last name.
- b) Contact data: email address, telephone number, postal address, country, job title, company and other professional contact information.
- c) Technical data: IP address, cookies (as described in the Cookie Policy), access data (date, time, duration), browser type and version and plug-ins, operating system and device type, time zone setting, device location, traffic data and pages visited.
- d) Contact form and survey data: the information the user provides through the site’s forms (e.g. “Contact”, “Send us a message”, “Stay in touch”) or by taking part in a survey, including the content of the communication. Fields marked as mandatory are needed to answer the request.
- e) Marketing communications data: information on how the user interacts with emails, messages and other marketing communications, and on newsletter subscription.
- f) Social media data: profile data and other information the user has made public or shared with us through social media.
Data relating to applications, even when sent through the site’s form, are processed under Section 10.
We may also collect some of the data listed above when the user gives us a business card, meets us at a conference or an event, or is a client or a prospective client.
3. Purposes, legal basis and retention (site users)
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
1) Answer requests and provide the information requested through the site | Identification, contact, form and survey data | Performance of pre-contractual measures or of a contract at the data subject’s request (Art. 6(1)(b)); consent for surveys (Art. 6(1)(a)) | 2 years from the last contact |
2) Direct marketing by email, messaging, telephone, social media (events, newsletter) | Identification, contact and marketing communications data, social media data where applicable | Consent, where required by law (Art. 6(1)(a)); legitimate interest in promoting its services, where consent is not required (Art. 6(1)(f)) | Until consent is withdrawn or the user unsubscribes |
3) Information on the Company’s services | Identification, contact and marketing communications data, social media data where applicable | As purpose 2 | Until consent is withdrawn or the user unsubscribes |
4) Identify the companies (legal entities) that have interacted with the site through the IP address | Technical data | Legitimate interest in administering the site and providing relevant information (Art. 6(1)(f)) | IP address: 14 days; cookies: see Cookie Policy |
5) Improve content, site and resources based on user preferences | Technical data | Legitimate interest (Art. 6(1)(f)) | IP address: 14 days; cookies: see Cookie Policy |
6) Enable the use of the site’s interactive features (e.g. requests for a demonstration of the services) | Technical, identification and contact data | Performance of pre-contractual measures at the data subject’s request (Art. 6(1)(b)) | 2 years from the last contact; technical data as above |
7) Develop and improve the site and systems | Technical data | Legitimate interest (Art. 6(1)(f)) | IP address: 14 days; cookies: see Cookie Policy |
4. How the data are collected
- a) Direct interactions: when the user fills in forms or contacts us by post, telephone, email or otherwise, for example to request services, create an account, subscribe to services or newsletters, request material, take part in a survey or an event, give feedback or ask to be contacted.
- b) Automated technologies: technical data collected while browsing the site.
- c) Third parties or publicly accessible sources: information the user has made public on social media and websites, or listed in public professional directories.
5. Marketing communications
Individuals. The user can subscribe to marketing communications by ticking the relevant box in the data collection form. Where the law does not require consent, we may send communications on the basis of our legitimate interest in promoting our services.
Businesses. Within existing or potential business relationships, we process the contact data of representatives of clients and other companies for “business to business” communications about services we believe are of interest to them, on the basis of our legitimate interest. To this end we may obtain contact data from public sources, including public professional profiles on social media, to make a first contact with the relevant representative.
Unsubscribing. The user can stop receiving marketing communications at any time through the “unsubscribe” link in each communication or by writing to the address given in Section 1.
6. Use of artificial intelligence on the site
The site and its applications may use artificial intelligence systems, for example to suggest and display alternative search results. The user’s personal data are not used in solely automated decision-making, including profiling, that produces legal effects or similarly significantly affects the user (Art. 22 GDPR). In all cases decisions remain with people.
For the use of artificial intelligence in recruitment, see Section 10.6.
7. Recipients of the data (site users)
The data may be disclosed:
- a) to suppliers appointed as processors, who carry out administrative and operational activities on our behalf, with access only to the data they need: IT, facilities management, administrative and accounting service providers.
- b) to the following providers of services for the site and marketing:
- Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA — support for marketing activities;
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — monitoring and optimisation of the site, marketing, additional features and embedded content (e.g. maps, videos);
- LinkedIn Ireland Unlimited Company, Ireland — additional features and support for marketing activities;
- Cal.com, Inc., USA — booking of demos through the booking page linked from the site;
- Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland — analysis and optimisation of the site through Microsoft Clarity.
- c) to public, judicial or supervisory authorities, when disclosure is required by a legal obligation or necessary to establish, exercise or defend a right.
8. Place of processing and data transfers
The data are processed primarily within the European Economic Area, including on servers of suppliers appointed as processors.
Where data are transferred outside the European Economic Area, the transfer takes place on the basis of an adequacy decision of the European Commission (Art. 45 GDPR) or of appropriate safeguards, such as the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR). Only in the absence of these conditions may the transfer take place in the cases provided for by Art. 49 GDPR, including the explicit consent of the data subject. For information on transfers, write to the address given in Section 1.
9. Data security
The Controller adopts operating procedures and appropriate technical and organisational security measures to prevent unauthorised access, alteration, deletion or transmission of personal data (Art. 32 GDPR).
10. Applicants
This section applies to anyone who applies for an employment or collaboration position at Ardeevo, whether in response to a job posting or on their own initiative, and supplements the previous sections.
10.1 Application channels
We receive applications:
- by email at job@ardeevo.eu;
- through the application form on the site;
- through LinkedIn.
For applications sent through LinkedIn, LinkedIn processes the data as an independent controller under its own privacy notice; Ardeevo processes the data it receives under this section.
If we contact you after finding your professional profile on LinkedIn or on other publicly accessible sources, we give you this notice at the first contact and tell you the source of the data (Art. 14 GDPR).
10.2 Data processed
- Identification and contact data: first name, last name, email, telephone, place of residence.
- CV data: degrees, qualifications and certifications, professional experience, language and technical skills, and any other information you choose to include.
- Data generated during the selection: interview notes, results of the tests assessing technical and soft skills, assessments by the recruiters and the founding team, correspondence with you.
- Data on the conditions offered: salary range and contractual conditions communicated during the selection.
We do not ask about your current or past pay. We do not carry out enquiries, not even through third parties, into your political, religious or trade union opinions, or into facts that are not relevant to assessing your professional aptitude (Art. 8 Law 300/1970; Art. 10 Legislative Decree 276/2003).
10.3 Special categories of data
Please do not include in your CV data that are not needed for the assessment, such as photographs, or data on health, racial or ethnic origin, religious beliefs or political opinions.
If you voluntarily tell us that you belong to a protected category (Law 68/1999), we process this information only to comply with employment law obligations (Art. 9(2)(b) GDPR). Any other special categories of data in your CV that are not needed for the selection are not used.
10.4 Purposes, legal basis and retention
| Purpose | Legal basis | Retention |
|---|---|---|
a) Assess your application for the position you applied for, or for a compatible position if the application is unsolicited, and manage the selection process (CV review, interviews, tests, communications) | Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR). For unsolicited CVs consent is not required (Art. 111-bis Legislative Decree 196/2003) | 1 year from the end of the selection process. If you are hired, the data become part of your personnel file and are processed under the notice for employees |
b) Keep your application for future selections | Consent (Art. 6(1)(a) GDPR), optional and revocable at any time | 1 year from when consent is given, unless withdrawn earlier |
c) Comply with legal obligations, including those on the mandatory employment of protected categories | Legal obligation (Art. 6(1)(c) GDPR); Art. 9(2)(b) GDPR for protected categories | For the period required by the applicable law |
d) Establish, exercise or defend a right in court | Legitimate interest of the Controller (Art. 6(1)(f) GDPR) | For the duration of any litigation and until the time limits for appeal expire |
When these periods end, the data are deleted or anonymised.
10.5 Whether providing the data is mandatory
Providing the data needed for the assessment (identification, contact and CV data) is optional, but without them we cannot consider your application.
Consent to keeping your application for future selections is optional: if you do not give it, your application is still assessed for the position you applied for.
10.6 Use of artificial intelligence in recruitment
To support the review of applications we use artificial intelligence tools provided by Google Ireland Limited, which help us analyse CVs against the requirements of the position.
The artificial intelligence tools support the recruiters but do not decide: every decision on your application, including rejection, is taken by a person, who reviews your CV.
We do not take decisions based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR).
You can at any time ask for information on the use of the tool in assessing your application, express your point of view and ask for a review by a person, by writing to the address given in Section 1.
10.7 Who can access your data
Application data are accessible only to the people involved in the selection: the hiring manager and the members of the founding team.
They may also be processed, solely for the purposes of this section, by:
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as provider of the email and storage services and of the artificial intelligence tool described in Section 10.6, appointed as processor (Art. 28 GDPR). For transfers of data outside the European Economic Area, the safeguards described in Section 8 apply;
- the labour consultant, for the formalities connected with any hiring;
- public authorities, when required by law.
Application data are not used for marketing purposes and are not disclosed to the marketing or site analytics providers listed in Section 7.
For transfers outside the European Economic Area, Section 8 applies.
11. Rights of the data subject
Under Articles 15–22 GDPR you have the right to:
- access your data and receive a copy;
- rectify inaccurate or incomplete data;
- obtain the erasure of the data, in the cases provided for by law;
- obtain the restriction of processing;
- receive the data you have provided to us in a structured, machine-readable format and transmit them to another controller (portability), in the cases provided for by law;
- object to processing based on legitimate interest, on grounds relating to your particular situation, and at any time to processing for direct marketing purposes;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- not be subject to decisions based solely on automated processing, under Art. 22 GDPR.
To exercise your rights, write to the address given in Section 1.
You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it (opens in a new tab)), or with the supervisory authority of the Member State where you live or work or where the alleged infringement took place (Art. 77 GDPR).
12. Changes to this notice
This notice may be updated. We will publish substantial changes on this site and, where necessary, communicate them through other channels.