Privacy Notice pursuant to Art. 13 of Regulation (EU) 2016/679 – Website Users
By means of this document (the “Privacy Notice”) the Data Controller, as identified below, wishes to inform you of the purposes and means of the processing of the personal data of users who visit and interact with the website https://gksdholding.com (the “Website”), as well as of the rights granted to you by Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”). This Privacy Notice relates exclusively to the Website and not to any other websites, pages or online services that may be reached through links. The rules on cookies and tracking tools are set out in detail in the relevant Cookie Policy, to which reference is made.
Data Controller
GKSD S.R.L. (Tax Code and VAT No. 11451170960), with registered office at Via Senato 12, 20121 Milan (MI), Italy, e-mail: info@gksdholding.com (hereinafter the “Data Controller”).
Types of personal data processed
The processing activities carried out through the Website may concern the following personal data:
Browsing data: browsing data collected automatically (e.g. IP address, browser and device type, operating system, pages visited, date and time of access, referring URL);
Data provided through the “Contacts” form: first name, surname, e-mail address, telephone number and content of the message;
Data provided through the “Work With Us” section: identification and contact data, data relating to education and professional experience and any further information voluntarily included by the candidate in the curriculum vitae;
Data for the newsletter (where activated): e-mail address and any data provided upon subscription;
Data collected through cookies: data collected through cookies and tracking tools, as described in the Cookie Policy.
Data subjects are invited not to include in their curriculum vitae or in their communications any special categories of personal data (Art. 9 GDPR, e.g. health data) or personal data relating to criminal convictions and offences (Art. 10 GDPR) that are not necessary for the purposes indicated.
Categories of data subjects
The processing activities carried out concern the following categories of data subjects: users and visitors of the Website; persons submitting requests through the “Contacts” form; candidates submitting their application through the “Work With Us” section.
Purposes, Legal Basis and Retention Periods
Purpose | Legal Basis | Retention Period |
A) Browsing and use of the Website To enable browsing and the provision of the content and services of the Website, as well as to ensure the security of the network and of the services and the correct technical functioning of the pages. | Ordinary personal data Legitimate interest of the Controller in providing and keeping the Website secure and efficient, pursuant to Art. 6(1)(f) GDPR. For technical cookies only, the processing is necessary for the functioning of the Website. | The provision of browsing data is inherent in the use of Internet communication protocols. Browsing data are retained for the time strictly necessary and, as a rule, for a maximum of [•] days, save where it is necessary to investigate criminal offences at the request of the Judicial Authority. |
B) Responding to requests submitted through the “Contacts” form To receive, handle and respond to requests for information and communications submitted by completing the relevant contact form (first name, surname, e-mail address, telephone number, message). | Ordinary personal data Steps taken at the request of the data subject prior to entering into a contract and/or response to the request received, pursuant to Art. 6(1)(b) GDPR; where the request is not of a pre-contractual nature, the legitimate interest of the Controller in following up on requests, pursuant to Art. 6(1)(f) GDPR. | The provision of data is optional but necessary in order to respond to the request; failing that, it will not be possible to handle it. For the time necessary to handle the request and, in the absence of a subsequent relationship, for a maximum of 24 months from the last relevant contact. |
C) Management of job applications (“Work With Us” section) To receive and assess the applications and curricula vitae submitted through the relevant section, for personnel search and selection purposes. | Ordinary personal data Steps taken at the request of the data subject prior to entering into a contract, pursuant to Art. 6(1)(b) GDPR. Any special categories of personal data (Art. 9) or data relating to criminal convictions and offences (Art. 10) contained in the CV are processed only where strictly relevant and, where necessary, on the basis of the data subject’s consent (Art. 9(2)(a)). | The provision of data is optional but necessary for the assessment of the application; failing that, it will not be possible to take it into consideration. For the time necessary for the assessment and, in any event, for a maximum of 12 months from receipt, unless separate and specific consent is given to retention for future recruitment purposes. |
D) Cookies and statistical and marketing tracking tools Installation of cookies and other tracking tools for statistical/analytics and marketing purposes, belonging to the Controller (first party) or to third parties, for the purposes described in the Cookie Policy. | Ordinary personal data Consent of the data subject, pursuant to Art. 6(1)(a) GDPR, given through the banner and the cookie preference centre. Consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out before the withdrawal. | The provision of data is optional; in the absence of consent, only the necessary technical cookies will be used. In accordance with the retention periods indicated in the Cookie Policy. Consent is generally stored for 6 months, after which the request is presented again. |
E) Newsletter and promotional communications Where the user subscribes accordingly, periodic sending by e-mail of newsletters, updates on the Controller’s activities, invitations to events and communications of a promotional nature. | Ordinary personal data Consent of the data subject, pursuant to Art. 6(1)(a) GDPR, which may be withdrawn at any time, including through the unsubscribe link included in each communication, without affecting the lawfulness of the processing carried out before the withdrawal. | The provision of data is optional; failure to provide it merely means that the communications cannot be received. The data are processed until consent is withdrawn or the user unsubscribes, with periodic verification that the interest persists. |
F) Compliance with legal obligations and defence of the Controller’s rights To comply with obligations laid down by law, by regulations and by EU legislation, as well as to establish, exercise or defend a right of the Controller in or out of court. | Ordinary personal data Compliance with a legal obligation pursuant to Art. 6(1)(c) GDPR; for the defence of a right, the legitimate interest of the Controller pursuant to Art. 6(1)(f) GDPR. | Where the data are already lawfully processed, no further action by the data subject is required. For the period required by the relevant legal obligations and, in the event of litigation, until expiry of the time limits for bringing appeals. |
G) Handling of requests to exercise the rights under Articles 15-22 of Regulation (EU) 2016/679 Handling of, and response to, requests submitted by data subjects to exercise their rights. | Ordinary personal data Compliance with a legal obligation pursuant to Art. 6(1)(c) GDPR. | The provision of data is optional; failing that, it will not be possible to handle the requests submitted pursuant to Articles 15-22 GDPR. The data are retained for a maximum period of five years from the handling of the request. |
Means of Processing
The data are processed mainly by electronic and automated means, using logics strictly related to the purposes indicated and by adopting technical and organisational security measures appropriate to protect the confidentiality, integrity and availability of the data. No automated decision-making is carried out which produces legal effects concerning the data subject or similarly significantly affects him or her.
Transfers of data outside the EU
As a general rule, personal data are processed within the European Economic Area (EEA). However, the use of certain third-party cookies and tools (e.g. providers of statistical and marketing services) may involve the transfer of data to third countries. In such cases, the transfer takes place solely on the basis of an adequacy decision of the European Commission or of appropriate safeguards pursuant to Art. 44 et seq. GDPR (e.g. standard contractual clauses). Further details are set out in the Cookie Policy.
Recipients of the personal data
Personal data may be processed by the Controller’s personnel duly appointed pursuant to Art. 29 GDPR as persons authorised to process personal data.
Personal data may also be shared with service providers closely connected with and instrumental to the activities of the Website and of the Controller — such as, by way of example, the hosting provider, IT maintenance and support service providers and providers of cookie, analytics and marketing services — which typically act as processors pursuant to Art. 28 GDPR or, in certain cases, as independent controllers or joint controllers. The data may also be disclosed to persons, bodies or authorities to whom disclosure is mandatory under provisions of law or orders of the competent authorities. A complete list may be obtained by contacting the Controller at the addresses indicated above.
Rights of the data subject - complaint to the supervisory authority
In relation to the processing described in this Privacy Notice, as a data subject you may, under the conditions laid down by the GDPR, exercise the rights set out in Articles 15 to 22 GDPR and, in particular, the following rights:
right of access – Article 15 GDPR: the right to obtain confirmation as to whether or not personal data concerning you are being processed and, where that is the case, to obtain access to your personal data;
right to rectification – Article 16 GDPR: the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or to have incomplete personal data completed;
right to erasure (‘right to be forgotten’) – Article 17 GDPR: the right to obtain, without undue delay, the erasure of personal data concerning you. The right to erasure does not apply to the extent that the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims;
right to restriction of processing – Article 18 GDPR: the right to obtain restriction of processing in the cases provided for by that provision, including where the data subject contests the accuracy of the personal data or objects to the processing;
right to data portability – Article 20 GDPR: the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning you which you have provided to the Controller, and to transmit those data to another controller without hindrance, where the processing is based on consent or on a contract and is carried out by automated means;
right to object – Article 21 GDPR: the right to object, at any time, to the processing of personal data concerning you which is based on legitimate interests, unless the Controller demonstrates compelling legitimate grounds for continuing the processing;
right not to be subject to automated individual decision-making – Article 22 GDPR: the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, within the limits provided for by that provision;
right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): http://www.garanteprivacy.it;
withdraw consent given, at any time and as easily as it was given, without affecting the lawfulness of processing based on consent before its withdrawal.
The above rights may be exercised vis-à-vis the Controller by contacting the details indicated above. The exercise of your rights as a data subject is free of charge pursuant to Article 12 GDPR. However, where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the Controller may charge a reasonable fee or refuse to act on the request. The Controller may request the provision of additional information necessary to confirm the identity of the data subject.
How consent is given
For the purposes based on consent (statistical and marketing cookies and, where activated, the newsletter), consent is collected directly online through the banner and the cookie preference centre and through the relevant checkboxes included in the forms on the Website. Consent is optional, specific to each purpose and freely revocable at any time, without prejudice to the lawfulness of the processing carried out before the withdrawal.
Updates to this Privacy Notice
This Privacy Notice applies to the Website from the date of its publication. The entry into force of new sector legislation, as well as the ongoing review and updating of the terms of use of the Website, may make it necessary to revise this document. Data subjects are therefore invited to consult this page periodically.