Privacy Policy
Last updated: October 12, 2026 (version 2.1)
This is a translation provided for convenience; the Italian version prevails.
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679.
1. Data controller and Data Protection Officer
The data controller is CoreXServices S.r.l., with registered office at Via Marco Aurelio 42, 20127 Milano (MI), Italy. Phone: +39 02 82397715; certified email (PEC): corexservices.srl@legalmail.it; dedicated email: privacy@corexservices.it.
The Data Protection Officer (DPO) is Mario Mureddu, who can be contacted at dpo@mariomureddu.com. Data subjects may contact the controller or the DPO for information about the processing and to exercise their rights under the GDPR.
2. Scope
This notice describes the processing of personal data carried out through the website www.corexservices.it in connection with browsing, contact and quote requests, job applications and newsletter sign-up. It does not cover third-party websites that may be reached through external links.
3. Categories of personal data processed
3.1 Browsing data
The IT systems used to run the website may collect IP addresses, device and browser information, the date and time of requests, the resources accessed, response codes and other technical parameters needed for communication over the Internet. This data is processed to make the website work, protect its security and detect anomalies.
3.2 Contact and quote requests
The dedicated forms may collect first name, last name, company, email address, phone number (where requested) and the content of the message. This information is used to reply to requests and to prepare any offers.
3.3 Job applications and recruitment
The application form may collect name, email address, phone number, the position of interest, a message and, optionally, a curriculum vitae (PDF, DOC or DOCX). This data is used to receive and assess applications, check professional requirements, arrange interviews and carry out the activities related to the possible establishment of an employment or collaboration relationship.
Candidates are asked to provide only information relevant to the professional assessment and to avoid including special categories of data, unless strictly necessary.
Any special categories of data are processed only where an applicable condition of Article 9(2) GDPR applies, in particular point (b) in the cases provided for by employment law. Irrelevant data is handled in a limited way, including for the purpose of its removal, in line with the principles of data minimisation and storage limitation.
3.4 Newsletter
The newsletter is sent to users who sign up voluntarily. The email address is processed, together with the information needed to document consent, manage the subscription and allow it to be withdrawn.
3.5 Cookies and similar tools
The website uses strictly necessary technical tools and, only with consent, Google Analytics 4, Hotjar, Google Ads and Meta Pixel for statistical purposes, interaction analysis and advertising campaign measurement. For details, please see the Cookie Policy.
4. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Technical operation of the website and IT security | Art. 6(1)(f) – legitimate interest in operation and security. |
| Replying to general contact and information requests | Art. 6(1)(f) – legitimate interest in handling unsolicited requests; (b) where applicable. |
| Preparing quotes and pre-contractual activities | Art. 6(1)(b) – pre-contractual measures at the data subject’s request; (f) in cases not falling under (b). |
| Searching, selecting and recruiting staff; reviewing CVs, interviews and handling irrelevant data | Art. 6(1)(b) – pre-contractual measures; (c) – legal obligations where applicable; (f) – legitimate interest for relevant ancillary operations, within the applicable limits. |
| Newsletter and promotional communications on sign-up | Art. 6(1)(a) – consent. |
| Statistical analysis subject to consent; advertising and remarketing | Art. 6(1)(a) – consent. |
| Regulatory obligations | Art. 6(1)(c) – legal obligation. |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) – legitimate interest, within the applicable limits. |
For any special categories of data relevant to recruitment, one of the conditions of Article 9(2) GDPR is also required. Receiving and assessing unsolicited CVs does not require consent in the cases provided for by Article 111-bis of Legislative Decree 196/2003.
5. Whether providing data is mandatory
Technical data is provided as part of browsing. In the forms, providing the data marked as mandatory is necessary to handle the request; failing to provide it may prevent the form from being sent or answered. Data marked as optional may be left out. Newsletter sign-up and consent to non-essential tracking tools are optional.
6. Processing methods and security
Data is processed using IT and electronic tools by authorised staff and by suppliers involved in providing the services. Technical and organisational measures are in place to protect communications, control access, secure the forms and handle attachments.
7. Recipients and services used
| Service / supplier | Stated function |
|---|---|
| Netlify Inc. | Website hosting and server functions for the forms. |
| Sanity.io | Editorial content management. |
| Resend | Forwarding form data by email. |
| Ydea S.r.l. | CRM for contact and quote requests. |
| Google Analytics 4; Hotjar | Analysis of visits and interactions, subject to consent. |
| Google Ads; Meta Pixel | Campaign measurement and marketing, subject to consent. |
| OpenStreetMap / map services | Displaying the map of our offices. |
Contact and quote requests are forwarded to the company mailbox and recorded in Ydea. Applications and CVs are forwarded to the company mailbox. Newsletter subscribers' addresses are used to manage subscriptions and mailings.
The website does not store form data in a permanent database of its own; temporary technical processing by the infrastructure and forwarding services remains possible. Suppliers are vetted and, where necessary, appointed as processors under Article 28 GDPR according to their actual roles.
In particular, Netlify provides hosting and the server functions for the forms; Sanity is used for editorial content management; Resend for forwarding forms by email; Ydea for recording and managing sales requests. Google Analytics 4 collects statistical information about visits, Hotjar makes it possible to analyse interactions with the pages, while Google Ads and Meta Pixel support campaign and conversion measurement. These statistical and advertising tools are subject to consent. OpenStreetMap and map services are used to display our offices. Tracking technologies and the related user choices are described in the Cookie Policy.
8. Transfers to third countries
The use of international suppliers may involve processing or transfers outside the European Economic Area. Any transfers take place in compliance with Articles 44 et seq. GDPR, on the basis of an applicable adequacy decision or the other safeguards provided for by the Regulation, including, where necessary, standard contractual clauses.
9. Retention periods
| Data categories | Retention criterion |
|---|---|
| Technical data and logs | Normally 30 days; longer retention only where needed for the documented handling of incidents and the protection of systems. |
| Contact and quote requests | 24 months from the last contact for requests and negotiations that are not concluded; for contractual relationships and documentation subject to legal obligations, up to 10 years or for the other applicable period. |
| Job applications | 12 months from receipt of the application, unless an employment relationship is established or specific legal obligations or the protection of rights require otherwise. |
| Newsletter | Until consent is withdrawn or, in the absence of significant documented interactions, for 24 months from the last interaction. Evidence of consent and withdrawal is kept for up to 5 years after the subscription ends, to protect legal rights. |
| Cookie preferences | 6 months, unless the user makes a new choice. |
| Statistical and advertising data | For the period needed for statistical and advertising purposes, according to the settings of the services used and in line with the user’s preferences. Withdrawing consent stops any further processing based on that consent, without affecting data lawfully retained for other reasons. |
At the end of the applicable periods, data is deleted or anonymised, unless further retention is required to comply with legal obligations or to establish, exercise or defend legal claims.
10. Cookies and tracking tools
Only the strictly necessary technical tools may operate without consent, while Google Analytics 4 and Hotjar, as well as Google Ads and Meta Pixel, are activated only after consent for the relevant category. The banner lets you accept, reject or customise your preferences; closing it without making a choice does not activate non-essential trackers. Preferences can be changed through the "Cookie preferences" link on the website. The related preference cookie is set to last six months.
The categories of tools used, the services involved, their purposes and how to give and withdraw consent are described in the Cookie Policy.
11. Data subjects’ rights
In the cases provided for by the GDPR, data subjects may obtain confirmation as to whether their data is being processed and access it (Art. 15), ask for it to be rectified if inaccurate or completed if incomplete (Art. 16), request its erasure where applicable (Art. 17) and the restriction of processing (Art. 18). They may receive the data they have provided in a structured, machine-readable format and, where applicable, ask for it to be transmitted to another controller (portability, Art. 20). They may also object, on grounds relating to their particular situation, to processing based on legitimate interest (Art. 21); for direct marketing, objection may be exercised at any time without giving reasons. Consent given for the newsletter and for optional tracking may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal. Requests can be sent to privacy@corexservices.it or to the Data Protection Officer, Mario Mureddu, at dpo@mariomureddu.com. The controller normally replies within one month of receipt, which may be extended in the cases provided for by Article 12 GDPR, informing the data subject. Exercising these rights is normally free of charge, except as provided for by the Regulation.
Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) and to apply to the competent judicial authority.
12. Automated decision-making
The website does not use the data collected to make decisions based solely on automated processing that produce legal or similarly significant effects on the data subject within the meaning of Article 22 GDPR.
13. Updates
This notice may be updated following regulatory, organisational or technological changes. The updated version will be made available on the company website.
Last revised: October 12, 2026