Privacy policy

1. Data controller

The controller of the data collected through the Site is inCloud s.r.l., Via Unità d'Italia 135, 41058 Vignola (MO), Italy. For any matter concerning personal data you may write to [email protected] or, via certified email, to [email protected]. Data Protection Officer (DPO): Melis Salvatorangelo, [email protected].

• Controller's contact details
• inCloud S.r.l.
• Via Unità d'Italia 135, 41058 Vignola (MO), Italia
• C.F. / P.IVA 04209270364
• [email protected]
• PEC: [email protected]

2. Data processed and purposes

The Site is the company's corporate website: it presents the company, its services and its open positions. It requires no registration, creates no accounts and processes only the data listed below.

• Contact form
  Name, email address and message are mandatory; the phone number is optional. They are used solely to reply to the request received. The data is not stored in any database of the Site: it is sent by email to the company's mailboxes and remains in the controller's mail. A confirmation copy is sent to the address given by whoever filled in the form.
• Applications for open positions
  In the "Work with us" section, the application form collects first name, last name, email address, motivation, the declaration of residence in the area indicated by the job posting and the curriculum vitae attached as a PDF or Word file; the phone number is optional. This data and the CV are used solely for recruitment purposes. As with the contact form, nothing is stored in any database of the Site: the application is sent, with the CV attached, to the company's mailbox, which sends a confirmation to the applicant.
• Technical and preference cookies
  The Site uses a session cookie required for it to work and a cookie that records the preferences expressed about cookies (privacy_consent, 365 days). Neither is used to profile users or to follow them across other websites. The chosen language is not stored in a cookie: it is part of the page address.
• Browsing data
  The servers log accesses to the Site with IP address, date and time, requested page and browser type, as happens with any web service. This serves to ensure the operation and security of the Site and is not used to identify users.

The Site uses no statistics or analytics tools, contains no advertising tracking pixels, does not profile visitors and applies no automated decision-making concerning them.

3. Legal bases

The processing of the data from the contact form and the application form is based on the performance of pre-contractual measures requested by the data subject (Art. 6.1.b GDPR). Technical cookies, server logs and the protection of forms against automated submissions are based on the controller's legitimate interest in the operation and security of the Site (Art. 6.1.f). For tools requiring the data subject's consent (Art. 6.1.a), the Site provides the preferences panel described at the bottom of this page: consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. Retention

Messages received through the contact form are kept for as long as needed to handle the request and any relationship arising from it, and in any case for no longer than 24 months from the last contact, unless other legal obligations apply. Applications and CVs received are kept for as long as needed for the selection process and, in any case, for no longer than 24 months from receipt, unless the applicant requests earlier deletion. Server logs are kept for a limited period for security purposes. Cookies last as indicated in point 2 and can be deleted at any time from the browser settings.

5. Recipients and third-party services

The data is processed by the controller's authorised personnel and is not disclosed to third parties for marketing purposes. The following providers are involved in the operation of the Site and may become aware of the IP address of those browsing it.

• Hosting provider and email service
  The Site is hosted on servers managed by a technical provider and the messages sent from the forms travel through the controller's email service. Both process data on behalf of the controller as processors pursuant to Art. 28 GDPR.
• jsDelivr
  Content delivery network from which the Site loads the Bootstrap graphic library, its icons and the technology icons shown on the home page. It receives the visitor's IP address. Typefaces, by contrast, are hosted on the Site itself and involve no requests to third parties.
• Google reCAPTCHA
  The contact form and the application form are protected by Google's reCAPTCHA service, which distinguishes people from automated submissions by analysing the interaction with the page and may set its own technical cookies. The script is loaded together with the page containing the form. Google's privacy policy and terms of service apply.
• Google Maps
  The map of the office is embedded in the contact section of the home page and is provided by Google. It is loaded when the page opens: from that moment Google receives the visitor's IP address and may set its own tracking tools. Those who prefer to avoid this can block third-party content in their browser settings.
• WhatsApp
  The Site shows a link to start a WhatsApp conversation with the controller. The link loads no content into the page: only those who choose to use it come into contact with the WhatsApp (Meta) systems, under that service's own privacy policy.

The providers listed above may also process data outside the European Union, on the basis of the safeguards laid down in Chapter V of the GDPR. Their respective privacy policies are available on their websites.

6. Security

The Site is reachable over an encrypted connection (HTTPS/TLS). The forms are protected against automated submission and the application form only accepts attachments in PDF or Word format up to 8 MB. Access to the controller's mailboxes and systems is restricted to authorised personnel.

7. Data subject rights

Data subjects may exercise at any time the rights of access, rectification, erasure, restriction, objection and portability set out in Articles 15-22 GDPR, by writing to [email protected]. They may also withdraw at any time the consent given, without affecting the lawfulness of processing carried out before withdrawal, and lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

8. inCloud products and services

This policy covers the corporate website only. The products built by inCloud s.r.l. — including RESTinCloud, PECinCloud, ITinCloud, EDILinCloud and Necrologi.news — are separate services, reachable at their own addresses and covered by their own privacy policies. For the data that client companies process through those platforms, the controller is the client company that signed the contract, while inCloud s.r.l. acts as processor pursuant to Art. 28 GDPR: those who use those applications should address their own company to exercise their rights, and inCloud s.r.l. assists the company as processor.

9. Changes

This policy may be updated. The version in force is always available at this address, with the date of the last update shown at the top of the document.