PRIVACY NOTICE

 

This Privacy notice (the “Policy”) describes how EVCO S.p.A. (the “Data Controller”) collects and processes the personal data of users (the “User/s”) who access and browse the website www.evco.it, in accordance with Regulation (EU) 2016/679 (“GDPR”) and the applicable national legislation on the protection of personal data. This Policy is provided pursuant to Article 13 of the GDPR.

This Policy applies exclusively to the processing of personal data carried out via this corporate website and does not cover processing related to software, applications or other services that may be provided by the Data Controller, for which specific privacy policies are provided.

Through the website, Users may, for example:

  • browse the published content;
  • request commercial or technical information;
  • submit unsolicited applications or apply for vacant positions;
  • subscribe to the newsletter;
  • use any additional services that may be made available by the Data Controller.

For each of these activities, this Policy sets out the categories of personal data processed, the purposes and legal bases for processing (Article 6 of the GDPR), any conditions for the processing of special categories of personal data (Article 9 of the GDPR), retention periods, the recipients of the data, and the rights granted to data subjects under Articles 15–22 of the GDPR.

Where the processing of personal data is based on the data subject’s consent pursuant to Article 6(1)(a) of the GDPR, consent will be sought in accordance with the conditions set out in Article 7 of the GDPR and may be withdrawn at any time as easily as it was given, without affecting the lawfulness of the processing carried out prior to the withdrawal.

Users are asked to provide only personal data relating to themselves or data relating to third parties which they are authorised to disclose to the Data Controller, assuming responsibility for the lawfulness of such disclosure.

This Policy applies exclusively to this website and not to third-party websites that may be accessed via hyperlinks, the processing of personal data on which is governed by their respective privacy notices.

The Data Controller reserves the right to update this Policy at any time, including as a result of regulatory changes, technological developments or changes in the methods of processing personal data. Users are therefore advised to consult it periodically.

If a User is under the age required by applicable legislation to give independent consent to information society services, such consent must be given or authorised by the person exercising parental responsibility, in accordance with Article 8 of the GDPR and applicable national legislation.

1. DATA CONTROLLER

The Data Controller is EVCO S.p.A. with its registered office at Via Feltre 81, 32036 Sedico (BL) ITALIA and email address info@evco.it .

2. DATA PROCESSOR

Pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR), EVCO S.p.A., with registered office at Via Feltre, 81, 32036 Sedico (BL), Italy, acts as the Data Processor in relation to activities involving the technical management and maintenance of the website.

3. COOKIE POLICY

Cookies are small text strings that the websites visited by the User send to the browser of the device used for browsing, where they are stored to be subsequently retransmitted to the same websites during the same visit or on subsequent visits. Whilst browsing, the User may also receive cookies on their device from different websites or web servers (so-called third-party cookies), which may contain elements present on the website being visited.

Cookies may be used for various purposes, including enabling the website to function correctly, ensuring secure browsing, storing the User’s preferences and collecting statistical information on website usage.

Depending on their purpose, cookies are categorised as follows:

  • technical cookies;
  • analytical cookies, whether first-party or third-party;
  • profiling cookies, whether first-party or third-party.

For its website, the Data Controller uses technical cookies that are strictly necessary for the website to function properly. These cookies are essential to ensure browsing, security and the proper provision of the services offered by the website and are used, for example, to manage browsing sessions, portal security and functions strictly related to the website’s operation.

Technical cookies are used exclusively to ensure navigation, the use of the website and the services requested by the User. They are not used for any other purposes and, as they are necessary for the website to function, they do not require the User’s prior consent. Without these cookies, certain features of the website may not be available, or their use may be more complicated or less secure.

The Data Controller also uses first-party analytical cookies to collect aggregated statistical information regarding the use of the website, with a view to improving its performance and the services offered. These cookies are used without the User’s prior consent only where they are configured in accordance with the requirements set out in the applicable legislation and the guidelines of the Data Protection Authority.

The website also uses third-party analytics cookies via Google Analytics 4, a service provided by Google LLC, in order to collect statistical information regarding the use of the website and to enable the Data Controller to analyse its performance and improve the content and services offered. These cookies will be installed only with the User’s prior consent, unless they are configured in such a way as to comply with the requirements of applicable legislation and the guidelines of the Data Protection Authority regarding exemption from the obligation to obtain consent.

The data collected via cookies may be processed directly by the Data Controller or by service providers specifically appointed as Data Processors pursuant to Article 28 of GDPR, or by third parties acting as independent Data Controllers, as set out in their respective privacy notices.

The website does not use profiling cookies.

4. GOOGLE SEARCH CONSOLE SERVICE

The Data Controller uses Google Search Console, a service provided by Google LLC, to monitor the website’s visibility in Google Search results, check the indexing status of pages, analyse the website’s organic performance and identify any technical issues.

The service does not involve the installation of cookies or other tracking tools on the devices of Users browsing the website. The information made available through the service is derived from Google Search systems and is processed by Google in accordance with its own privacy policy. Google Search Console does not, as far as the Data Controller is concerned, involve any direct collection or profiling of website Users, but solely allows for the consultation of statistical and technical data made available by Google.

For further information on how Google processes data, please refer to Google’s Privacy Policy.

5. TYPES OF DATA PROCESSED

Browsing data

The IT systems and software procedures used to operate the website www.evco.it acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow Users to be identified.
This category of data includes the IP addresses or domain names of the computers used by Users connecting to the website, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the User’s operating system and IT environment.

This data is processed solely to ensure the website functions correctly, to guarantee its security, to prevent unlawful use and, where necessary, to establish liability in the event of cybercrimes. Any statistical analysis carried out on browsing data is conducted exclusively in aggregated form.

Statistical analyses relating to the use of the website carried out using analytical cookies are, however, governed by the ‘Cookie Policy’ section of this Privacy Notice.

The legal basis for the processing is the Data Controller’s legitimate interest, pursuant to Article 6(1)(f) of the GDPR, consisting in ensuring the security and proper functioning of the website and the protection of its rights.

Data for requests for commercial or technical information

This refers to personal data provided by the User on an optional and voluntary basis via the ‘Contacts > Request for information’ section.

This data is processed exclusively to manage and respond to requests for commercial and/or technical information, to provide the requested assistance and to contact the User again if necessary to process the request.

The legal basis is the implementation of pre-contractual measures (Article 6(1)(b)). Where the enquiry does not relate to the establishment of a contractual or pre-contractual relationship, processing is carried out on the basis of the Data Controller’s legitimate interest in responding to enquiries received (Article 6(1)(f)).

Data for submitting job applications

This refers to the personal data provided by the User, on an optional and voluntary basis, via the ‘Work with us > Apply’ section, including the data contained in the CV, the cover letter and any additional attached documents.

This data is processed exclusively to manage the application, assess the User’s professional profile for the purposes of selecting candidates, contact the User as part of the selection process, and carry out all activities connected with and necessary for the recruitment process. The provision of data is optional; however, failure to provide it may prevent the application from being assessed.

The legal basis for the processing is the implementation of pre-contractual measures taken at the data subject’s request, in accordance with Article 6(1)(b) of the GDPR. Should the application contain special categories of personal data within the meaning of Article 9 of the GDPR, such data will be processed exclusively within the limits permitted by current legislation on labour law and social security, on the basis of the conditions of lawfulness set out in Article 9(2)(b) of the GDPR and the applicable national provisions.

Data for newsletter subscription requests

This refers to the personal data provided by the User, on an optional and voluntary basis, via the ‘Subscribe to our newsletter’ section.

This data is processed solely to manage subscription to the newsletter service and to send the User periodic communications containing information, updates, news, initiatives, events, products and services provided by the Data Controller, as well as any promotional and marketing communications, within the limits of the consent given.

The legal basis for the processing is the data subject’s consent, pursuant to Article 6(1)(a) of the GDPR. The User may withdraw their consent at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal, by using the dedicated unsubscribe link included in every newsletter or by contacting the Data Controller.

6. PLACE, METHOD AND DURATION OF DATA PROCESSING

Browsing data

The data is processed by the Data Controller as well as on the IT infrastructure of hosting service providers and any Data Processors appointed in accordance with Article 28 of the GDPR. Processing is carried out using IT and telecommunications tools, with appropriate technical and organisational measures in place to ensure data security and to prevent loss, unlawful or unauthorised use, unauthorised access, disclosure or alteration. Browsing data is retained for the time strictly necessary to fulfil the purposes for which it is collected. Log files are retained for a maximum period of six months, unless further retention is necessary to investigate unlawful acts, protect the Data Controller’s rights or comply with legal obligations.

Data processed in connection with requests for commercial or technical information

Personal data provided by the User is processed by the Data Controller, using both IT tools and, where necessary, paper-based methods, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, integrity and confidentiality as set out in GDPR. The Data Controller implements appropriate technical and organisational measures to ensure the security of personal data and to prevent its loss, unauthorised access, unlawful or improper use, disclosure and unauthorised alteration.

The data is retained for the time necessary to manage and respond to the User’s request and, in any event, for a period not exceeding one year from the date of collection, unless:

  • a contractual or pre-contractual relationship is established which justifies a different retention period;
  • the User provides new consent for further specific purposes;
  • retention is necessary to comply with legal obligations or for the establishment, exercise or defence of a legal claim in court.

Once the retention period indicated above has elapsed, personal data will be erased or made anonymous, except where their further retention is required by applicable legislation or justified by a different legal basis pursuant to Article 6 of the GDPR.

Data processed for the submission of applications

The personal data provided by the User when submitting their application is processed by the Data Controller using IT systems and, where necessary, on paper, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, integrity and confidentiality as set out in GDPR. The Data Controller implements appropriate technical and organisational measures to ensure the security of personal data and to prevent its loss, unauthorised access, unlawful or improper use, disclosure and unauthorised alteration.

The data is retained for the time necessary to carry out the selection and assessment of the application and, in any event, for a period not exceeding one year from receipt of the application, unless the data subject gives new consent to the retention of the data for future employment opportunities, or unless the retention is necessary to comply with legal obligations or for the establishment, exercise or defence of a legal claim.

Once the retention period indicated above has elapsed, personal data will be erased or made anonymous, except where their further retention is required by applicable legislation or justified on a different legal basis pursuant to Article 6 of the GDPR.

Data processed for newsletter subscription

The personal data provided by the User to subscribe to the newsletter is processed by the Data Controller via newsletter management platforms used by the Data Controller to send email communications, which may be provided by third parties appointed as Data Processors pursuant to Article 28 of the GDPR.

The processing is carried out using IT tools, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, integrity and confidentiality. The Data Controller implements appropriate technical and organisational measures to ensure the security of personal data and to prevent its loss, unauthorised access, unlawful or improper use, disclosure and unauthorised alteration.

Personal data is retained until the User withdraws their consent or unsubscribes from the newsletter service. The User may, at any time, exercise their right to withdraw consent and stop receiving marketing communications by using the dedicated unsubscribe link included in each email received or by contacting the Data Controller.

7. PURPOSES AND LEGAL BASES FOR PROCESSING

Personal data provided by the User via the website www.evco.it is processed exclusively for the purposes set out in this Policy and in accordance with the principles of lawfulness, fairness, transparency, data minimisation, integrity and confidentiality as laid down in GDPR. The provision of personal data is, unless otherwise specified, optional. However, failure to provide data marked as necessary may prevent the Data Controller from responding to the User’s requests or from providing the requested services.

An exception is made for browsing data, the provision of which is implicit in the use of Internet communication protocols and necessary to enable browsing and the proper functioning of the website. It is technically impossible to withhold such data whilst using the website.

The legal bases for the processing carried out via the website are as follows:

  • the performance of pre-contractual measures or a contract (Article 6(1)(b) of the GDPR, for the management of requests for commercial or technical information, job applications and any other request made by the User that requires a response from the Data Controller;
  • consent of the data subject (Article 6(1)(a) of the GDPR), for subscription to the newsletter and for any further processing for which the law requires prior consent;
  • the Data Controller’s legitimate interests (Article 6(1)(f) of the GDPR), to ensure the security of the website, the technical management of the platform, the prevention of misuse or unlawful activities, and to respond to requests that do not fall within the scope of a contractual or pre-contractual relationship.

Where processing is based on consent, this will be obtained by ticking the relevant box (check-box) on the data collection form or through the additional methods provided on the website. Consent will be requested in a manner that is freely given, specific, informed and unambiguous, and may be withdrawn at any time as easily as it was given, without affecting the lawfulness of the processing carried out prior to withdrawal.

For processing carried out using cookies, please refer to the provisions in the ‘Cookie Policy’ section of this Notice, which describes the categories of cookies used, their purposes and, where necessary, the methods for obtaining consent.

For the sake of completeness, please note that the Data Controller does not carry out processing by means of automated decision-making, including profiling that produces legal effects or similarly significantly affects the User within the meaning of Article 22 of the GDPR.

8. POSSIBLE RECIPIENTS AND TRANSFER OF DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS

Personal data may be disclosed to third parties who process data on behalf of the Data Controller as Data Processors pursuant to Article 28 of the GDPR, or to parties acting as independent Data Controllers, within the limits of the purposes described in this Policy and in compliance with applicable legislation.

Generally speaking, the processing of personal data takes place within the European Economic Area (EEA). However, should it become necessary, for reasons related to the provision of services or the use of external suppliers, to transfer personal data to third countries or international organisations, such transfer will take place in accordance with Articles 44 et seq. of the GDPR. Where applicable, the transfer will be carried out on the basis of an adequacy decision adopted by the European Commission, including that relating to the EU-US Data Privacy Framework for participating organisations, or through the adoption of other appropriate safeguards provided for by current legislation, such as the Standard Contractual Clauses (SCCs) adopted by the European Commission.

9. RIGHTS OF DATA SUBJECTS

Data subjects whose personal data are processed by the Data Controller may, in the cases provided for by GDPR, exercise the rights recognised by Articles 15 et seq. of the GDPR, including:

  • Article 7 – the right to withdraw consent, where processing is based on consent;
  • Article 15 – the right of access to personal data;
  • Article 16 – the right to rectification of inaccurate or incomplete data;
  • Article 17 – the right to erasure of data (‘right to be forgotten’), in the cases provided for by the legislation;
  • Article 18 – the right to restrict processing;
  • Article 20 – the right to data portability, where applicable;
  • Article 21 – right to object to the processing of personal data, in the cases provided for by the GDPR.
  • Art. 22 – the right not to be subject to a decision based solely on automated processing, including profiling.

To exercise their rights, data subjects may contact the Data Controller:

EVCO S.p.A.
Via Feltre 81, 32036 Sedico (BL), Italy
Email: info@evco.it

Pursuant to Article 77 of the GDPR, if the data subject considers that the processing of their personal data infringes applicable legislation, they also have the right to lodge a complaint with the Data Protection Authority, without prejudice to any other administrative or judicial remedies provided for by law.

10. SECURITY OF THE DATA PROVIDED

Il sito www.evco.it tratta i dati degli Utenti in maniera lecita, corretta e trasparente e il Titolare, in conformità al Regolamento Europeo 2016/679 ed in particolare agli articoli 24 e 25, ha adottato misure tecniche ed organizzative adeguate e proporzionali designed to prevent the loss of personal data, unauthorised access, unlawful or incorrect processing, and unauthorised disclosure. The security measures adopted also apply to persons authorised to process data and to data processors acting on behalf of the Data Controller, within the limits of their respective responsibilities and the instructions provided in accordance with Articles 28 and 29 of the GDPR.

11. LINKS TO SOCIAL MEDIA

The website www.evco.it contains hyperlinks to the official pages of EVCO S.p.A. on the main social media platforms, in order to enable Users to access the relevant information and institutional channels more easily.

The links on the website do not constitute plugins, widgets or integrated tracking tools and therefore do not involve the installation of cookies or the transmission of personal data to social media platforms before the User accesses the relevant platforms.

By clicking on the links on the website, the User is redirected to external platforms managed independently by their respective providers, which operate in accordance with their own terms of use and privacy policies. Following access to these platforms, any processing of personal data carried out by the social media operators will be governed by their respective privacy policies, to which reference should be made. EVCO S.p.A. is not responsible for the processing of personal data carried out independently by the social media operators following the User’s redirection.

EVCO S.p.A.’s official social media pages are available at the following addresses:

LinkedIn
Privacy policy: https://it.linkedin.com/legal/privacy-policy
Cookie policy: https://it.linkedin.com/legal/cookie-policy
YouTube
Privacy policy: https://www.youtube.com/intl/ALL_it/howyoutubeworks/user-settings/privacy
Facebook
Privacy policy: https://www.facebook.com/policy.php
Cookie Policy: https://www.facebook.com/policies/cookies

Any personal data provided voluntarily by Users via EVCO S.p.A.’s official social media pages (for example, through comments, messages or interactions with published content) may be processed by EVCO S.p.A. solely for the purpose of managing such interactions and responding to enquiries received, in accordance with the principles set out in the GDPR. Such data will be retained for as long as necessary to fulfil the purposes for which it was collected, subject to any further retention obligations laid down by applicable legislation.

12. AMENDMENTS TO THIS DOCUMENT AND UPDATES
This Privacy Notice is published at https://www.evco.it/it/content/2-privacy; it constitutes the privacy notice for the website www.evco.it and may be subject to updates or amendments over time, including as a result of regulatory, organisational or technical changes.

Users are invited to consult this Policy periodically to check for any updates.

Should the changes made be significant in relation to the methods of processing personal data or likely to have a significant impact on the rights and freedoms of data subjects, the Data Controller will provide appropriate notification via the channels deemed most appropriate.

This Privacy Notice is current as of 6 August 2026.