Data controller
The data controller is IN SY TO srl, with registered office at Via Benedetto Croce, 34, 00142 – Rome, Italy. For personal-data protection requests, contact info@insyto.it.
Data we collect and how
The website does not require user registration. Data are provided directly by the data subject through website forms and stored in the application database.
- “Send a message” form: name, email address, optional telephone number, subject, message content, selected language and technical request identifier.
- “Work with us” form: name, email address, telephone number, position of interest, experience, optional message and a CV attachment in PDF, DOC or DOCX format.
- Anti-abuse measures: to enforce hourly submission limits, the system retains a pseudonymous identifier derived from the IP address through a cryptographic function; the application does not store the plain IP address in that archive.
Purposes and legal bases
Message data are processed to reply to requests and manage professional or pre-contractual communications. Application data are processed to assess the profile and manage a potential selection process. Legal bases are performance of pre-contractual measures requested by the data subject and, where necessary, the controller’s legitimate interest in service security, continuity and abuse prevention. Form data are not used for marketing, profiling or automated decision-making.
Recipients and email notifications
Data are accessible to authorised IN SY TO srl personnel handling messages and applications. Aruba infrastructure is used to host the application and database; Resend is used for email notifications when configured. Notifications contain the form data needed to handle the request; the CV remains in the private restricted archive and is not attached to the notification.
Suppliers operate under their respective contractual terms and, where they process data on behalf of the controller, under applicable instructions and agreements. If a supplier entails a transfer outside the European Economic Area, the controller will apply the safeguards required by applicable law.
Retention and security
Messages, applications and CVs are kept in the restricted archive for the time needed to handle the request or selection and are subject to periodic review. The controller provides for a retention period of no more than 12 months from receipt, unless further retention is required by law, for the protection of rights or because a professional relationship is established.
Access to applications, messages and CVs is limited to authorised administrators. CVs are saved outside the public website directory and are available only through the authenticated administration area.
Cookies
As of the update date of this page, public website pages do not use profiling cookies or third-party analytics tools. The administration area uses a technical session cookie required for authentication; it is not available to public pages. Any non-technical tools will be enabled only after this notice and the required measures have been updated.
Your rights
Where applicable under Articles 15–22 GDPR, you may request access, rectification, erasure, restriction, objection and portability, and withdraw any consent without affecting the lawfulness of prior processing. You may also lodge a complaint with the Italian Data Protection Authority. To exercise your rights, contact info@insyto.it.