Privacy Policy

This notice is provided by Finlogic SpA pursuant to Art. 13 of Regulation (EU) 2016/679 (“GDPR”) to inform users of the website www.finlogicgroup.com (the “ Site ”) about how it processes personal data collected during navigation and use of the services available through the site.

• Data Controller

Finlogic Spa, VAT number 02379641208, with registered office in Bollate (Milan), 20021, at via Galileo Ferraris, n.125, (the “ Owner ”).

• Categories of personal data processed

Identification and contact information : first name, last name, company email address; telephone number (if provided); company title (if provided); city and province of residence (for applications).

Data contained in requests sent by the user by filling out the contact form for quote and assistance requests or any requests sent by email

Curriculum Vitae and attachments (if the user contacts us through the "work with us" section): identification and contact data in addition to any additional personal and professional information present in the curriculum vitae and any information provided spontaneously by the candidate when filling out the relevant contact form or by email.

Browsing data : information collected automatically during navigation on the site, the processing of which is implicit in the use of Internet communication protocols (for example, IP addresses or domain names of the devices used to connect to the site, the date and time of the request, information relating to the browser used and other technical data necessary for the operation of the site and its security.)

Data collected through cookies and other tracking tools : please refer to the cookie policy.

Purpose of processing, legal basis, and duration of processing.

The Data Controller processes the data for the following purposes and legal bases:

Management of requests for information, assistance, quotes, and other communications sent via the website , including those sent via the messaging service available on the website . Legal basis: implementation of pre-contractual measures taken at the request of the data subject or performance of the contract, where applicable: To record a User request (e.g., request for assistance or quote) and manage data processing. Duration of Processing : The Data will be processed for the time necessary to manage the request and, subsequently, for up to 24 months from the last contact, except for further retention necessary to protect the Data Controller's rights due to legal obligations.

Sending commercial and promotional communications relating to the Data Controller's products, services, events, and initiatives. Legal basis : consent of the data subject (Article 6, paragraph 1, letter a) of the GDPR). Processing period : up to 24 months from the data subject's last interaction with communications sent by the Data Controller. Or, if earlier, until revoked.

Management of personnel selection procedures: evaluation of applications and performance of activities related to the recruiting process. Legal basis: implementation of pre-contractual measures taken at the data subject's request (Article 6, paragraph 1, letter b) of the GDPR). Data subjects are advised not to include special categories of personal data in their CVs, except where strictly necessary and in compliance with applicable law. Duration of Processing: The Data will be processed for 6 (six) months following collection.

Ensure the proper functioning of the website, the security of IT systems and networks, and prevent and combat unauthorized access, abusive use, and other illegal activities. Legal basis: (legitimate interest of the Data Controller in ensuring the security of its systems and services) (Art. 6, par. 1, letter f) GDPR). Duration of Processing: For the time strictly necessary to achieve the aforementioned purposes and, generally, for a period not exceeding 6 months, unless further retention is necessary to investigate security incidents, protect the Data Controller's rights, or fulfill legal obligations.

• To whom we disclose Personal Data

To achieve the purposes indicated in this policy, personal data may be disclosed, to the extent strictly necessary, to the following categories of recipients:

The Data Controller's personnel specifically authorized to process personal data in order to carry out their duties;

Companies belonging to the Finlogic Group, if disclosure is necessary to manage the data subject's requests, to provide the requested products or services, or to perform commercial, technical, production, administrative, or logistical activities related to the Group's activities. These companies will process personal data as independent data controllers or, where applicable, as data processors.

Service providers acting on behalf of the Data Controller as external data processors, such as, for example, hosting and cloud service providers, website maintenance and management providers, IT services, electronic communication and user request management platforms, technical assistance, professional consultancy, and other services strictly functional to the pursuit of the purposes described in this policy.

Third-party service providers and platforms , if the user interacts with the buttons or links on the site that redirect to the Data Controller's official social media profiles (such as LinkedIn, Facebook, Instagram, and YouTube) or to other services provided by third parties. Any processing of personal data by these third parties is governed by their respective privacy policies.

• Transfer of personal data to third countries.

Personal data is processed and stored mainly within the European Economic Area.

If, for reasons related to the use of services, applications, or platforms provided by third parties, it becomes necessary to transfer personal data to countries outside the European Economic Area, the Data Controller undertakes to ensure that such transfer occurs in compliance with applicable data protection legislation and through the adoption of the guarantees provided therein.

In particular, where applicable, the transfer will take place on the basis of an adequacy decision adopted by the European Commission or through the adoption of the Standard Contractual Clauses (SCC) or other suitable instruments provided for by current legislation, including, for suppliers established in the United States who have adhered to them, certification pursuant to the EU-US Data Privacy Framework.

• Links to Group sites

The Site may contain links to websites managed by other Group companies or to platforms dedicated to providing specific services. Access to these sites is at the user's own initiative. The processing of personal data through these sites is governed by their respective privacy policies, which we encourage you to consult before using their services.

• Personal Data Security 

The Data Controller adopts appropriate security measures to minimize the risks of destruction, loss, even accidental, of Personal Data, as well as unauthorized access. 

• User rights

The user has the right to exercise the rights recognized by applicable law, and in particular:

• right of access, obtaining confirmation as to whether or not personal data concerning him or her are being processed and receiving the relevant information, including the purposes of the processing, the categories of data processed, the recipients to whom the data have been or will be disclosed and the envisaged retention period or the criteria used to determine it;
• right to rectification, obtaining the correction of inaccurate data and the integration of incomplete data;
• right to erasure of personal data, in the cases provided for by applicable legislation (so-called “right to be forgotten”);
• right to restriction of processing, in the cases provided for by applicable legislation;
• right to data portability, where the conditions are met;
• right to object to the processing of personal data, in the cases provided for by applicable legislation;
• right to withdraw any consent given at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal;
• The right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), as well as to take legal action before the competent judicial authorities, if you believe that the processing of your personal data violates applicable law.

• Provision of personal data

Providing data marked as mandatory in the forms on the site is necessary to allow the Data Controller to process the interested party's request. Failure to provide such data may make it impossible to process the request or provide the requested service.

Providing data for marketing purposes is optional. Failure to provide consent or its subsequent revocation will in no way affect your ability to use the website or take advantage of the requested services.

• Exercise of User Rights

To exercise the above rights or request further information regarding the processing of personal data, the interested party may contact the Data Controller at the contact details indicated in this policy, or by certified email at privacy@pec.finlogic.it

The Data Controller will respond to the request without undue delay and, in any case, within one month of receiving it. This deadline may be extended where necessary, taking into account the complexity and number of requests. In this case, the Data Controller will inform the data subject of the extension and the reasons therefor within one month of receiving the request.

In any case, the interested party retains the right to lodge a complaint with the Italian Data Protection Authority or to take legal action before the competent judicial authorities if he or she believes that the processing of his or her personal data is in violation of applicable law.

• Information Updates

This information, updated as of September 24, 2026, may be modified or updated, including as a result of changes in applicable legislation, the evolution of the services offered by the Data Controller, or the methods of processing personal data.

The updated version of the privacy policy will be published in this section of the website and will become effective from the date of its publication. Therefore, we encourage you to periodically check this page for any updates.

For further information on personal data protection and to learn about the rights granted to data subjects under current legislation, please consult the official website of the Italian Data Protection Authority.