Art. 1 – Data Controller

The Data Controller is Gardafrutta S.r.l., with registered office at via Orzinuovi 82, (25125) Brescia (IT), contactable at the email address: privacy@gardafrutta.it.

Art. 2 – Types of Data Collected and Purposes

• Browsing data and system logs (Aruba Hosting): IP addresses, URI/URL of requested resources, time, request method to the server, and operating system parameters, collected automatically to enable service delivery, security, and prevention of fraud/cyber attacks.

• Contact requests (Website form): First name, last name, email address, and message content provided voluntarily by the user to receive information.

• Applications and Curriculum Vitae (“Work with us” section): Personal data, contact details, educational background, professional experience, and any additional information contained in the CV submitted for profile evaluation for personnel selection purposes.

• Newsletter (Brevo / Sendinblue SAS): Email address for periodic delivery of informational and promotional communications.

• Statistics and tracking (Google Analytics): Data on user interaction with pages, used for aggregate analysis aimed at website optimization.

• Embedded multimedia content (YouTube videos): Technical and profiling cookies from third parties set to enable video playback directly on pages.

Art. 3 – Legal Bases for Processing

• Performance of pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR and Art. 111-bis D.Lgs. 196/2003):

  • Management and response to requests submitted via contact form.

  • Receipt, examination, and evaluation of Curriculum Vitae submitted spontaneously or in response to open positions.

• Explicit consent of the data subject (Art. 6.1.a GDPR):

  • Subscription to the newsletter service via Brevo.

  • Installation of non-anonymized analytical cookies (Google Analytics) and third-party cookies (YouTube).

• Legitimate interest of the Controller (Art. 6.1.f GDPR): For technical management, maintenance of the Aruba hosting infrastructure, and IT security.

Art. 4 – Hosting, Service Providers, and Data Transfer

Personal data are processed using IT and telecommunications tools by entities formally designated as Data Processors pursuant to Art. 28 GDPR:

• Hosting Provider (Aruba S.p.A.): The shared server infrastructure on which the website resides is managed by Aruba S.p.A. (headquartered in Italy). The data centers are located within the European Economic Area (EEA), in full compliance with European data security standards.

• Newsletter Platform (Brevo / Sendinblue SAS): Mailing list management service with servers located in the European Union.

• Google Analytics and YouTube (Google Ireland Ltd.): Services provided by Google. For any data transfers to servers located in the USA, compliance is ensured by Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework.

Curriculum Vitae received will be processed exclusively by authorized internal personnel responsible for selection activities.

Art. 5 – Data Retention Period

• Curriculum Vitae and applications: Retained for a maximum period of 12 months from receipt, after which they will be deleted unless an employment relationship is established or renewed interest from the parties exists.

• Server logs (Aruba): Retained for a period not exceeding 12 months for diagnostic and security purposes, except where required by law.

• Messages from contact form: Retained for the time strictly necessary to fulfill the request (maximum 12 months).

• Newsletter data: Retained until consent is withdrawn (unsubscription via the dedicated link included in each communication).

• Cookies and aggregated data: Governed by the specific policy (maximum 14 months for Google Analytics).

Art. 6 – Rights of the Data Subject

Pursuant to Arts. 15-22 of EU Regulation 2016/679, the user may exercise the following rights at any time:

• Obtain confirmation of the existence of data concerning them and request access to it.

• Request rectification, updating, or deletion (right to erasure).

• Request restriction of processing or object to it for legitimate reasons.

• Request data portability in a structured, machine-readable format.

• Withdraw previously given consent without prejudice to the lawfulness of processing carried out prior to withdrawal.

• Lodge a complaint with the national supervisory authority (Italian Data Protection Authority – www.garanteprivacy.it).

To exercise these rights, simply send a written request to the Controller’s email address.