Information on the processing of personal data pursuant to Articles 12 and 13 of Regulation (EU) 2016/679
This privacy policy describes how Innovaway S.p.A. processes the personal data of users who consult the website and use the features made available through it, such as contact forms, submitting information requests, and sending job applications.
This notice applies exclusively to processing carried out through the website. Additional notices may be provided for any processing carried out through other channels or for specific services.
1. Data Controller
The Data Controller is Innovaway S.p.A., with registered office in Via G. Porzio n. 4, Centro Direzionale Isola G1, 80143 Naples, Italy.
For any matter relating to the processing of personal data and to exercise your rights, you can contact the Controller at [email protected] or [email protected].
2. Data Protection Officer
The Data Protection Officer (DPO) is Attorney Alessandro Bonavita.
The DPO can be contacted at [email protected].
3. Categories of Data Processed
The following categories of personal data may be processed through the website:
a) Technical and navigation data: such as IP address, technical identifiers, information about the browser and device used, date and time of access, pages visited, and data related to connection security;
b) Identification and contact data provided voluntarily by the user: such as first name, last name, company, email address, phone number, and any other information entered in the contact form or request sent;
c) Data contained in job applications and CVs: such as personal details, contact details, educational background, professional experience, skills, and any additional information the candidate chooses to communicate;
d) Data relating to user preferences regarding cookies and tracking tools;
e) Any data contained in user communications: limited strictly to what is necessary to manage the request.
Users are requested not to transmit special categories of data under Article 9 of the GDPR through the website forms, unless strictly necessary and within the scope of a specific procedure for which a dedicated privacy policy has been provided. If such data is sent spontaneously, Innovaway will process it only within the limits permitted by applicable law and, where not necessary, may proceed to delete it.
4. Purposes, Legal Bases, and Retention Periods
Site Navigation and Security
I dati tecnici e di navigazione sono trattati per garantire il corretto funzionamento del sito, verificare la sicurezza delle infrastrutture, prevenire abusi, accessi non autorizzati, attacchi informatici e attività potenzialmente illecite, nonché per accertare o difendere un diritto in sede giudiziaria.
The legal basis is the Controller's legitimate interest in the security and continuity of the website, pursuant to Article 6(1)(f) GDPR. Data is retained for the period strictly necessary for security purposes and, as a rule, for no longer than 7 days, unless longer retention is justified by investigation, prevention, or defense requirements, legal obligations, or security incident management needs.
Management of contact requests and information requests
Data provided through the contact form or via the email addresses indicated on the site are processed to respond to the request, provide the requested information, manage any pre-contractual activities, and maintain documentation of the communication that has taken place.
The legal basis is the performance of pre-contractual measures taken at the request of the data subject, or the Controller's legitimate interest in managing communications and protecting its rights. Data is retained for the time necessary to handle the request and, subsequently, for a maximum period of 12 months, unless longer retention is necessary to comply with legal obligations, execute a contract, establish or defend a legal claim, or manage further relations with the data subject.
Providing the data marked as required in the form is essential to process the request. Failure to provide it may prevent Innovaway from responding.
Management of job applications
Data transmitted as part of a job application are processed to evaluate the candidate's professional profile, manage the recruitment procedure, organize interviews, and contact the candidate regarding the position applied for. The legal basis is the adoption of pre-contractual measures at the request of the data subject and, where applicable, compliance with legal obligations under employment and recruitment law.
Data is retained for the time necessary to manage the specific selection procedure and, as a rule, for a maximum period of 12 months from the conclusion of the procedure, unless legal obligations or requirements to protect rights dictate a longer retention period.
Any retention of the application for future professional opportunities, if not compatible with the original specific procedure, must be communicated in advance to the data subject and, where necessary, based on separate consent. Application data is not used for marketing or profiling purposes unless such purposes are subject to a specific privacy notice and a distinct legal basis. Providing the data necessary to evaluate the application is optional, but failure to provide it may prevent participation in the selection process.
Legal compliance and protection of rights
Data may be processed to comply with obligations laid down by laws, regulations, or European Union legislation, as well as to establish, exercise, or defend a right of the Data Controller, whether in court or in out-of-court proceedings.
The legal basis is compliance with a legal obligation, pursuant to Article 6(1)(c) GDPR, or the Controller's legitimate interest in protecting its rights, pursuant to Article 6(1)(f) GDPR. Data is retained for the period required by law or, in the absence thereof, for the time necessary to protect the right and conclude the relevant proceedings.
Commercial communications and marketing
The sending of commercial communications, newsletters, or promotional material via email or other electronic tools takes place only when a suitable legal basis exists and, in the cases provided for by applicable law, subject to the specific consent of the data subject. Consent for marketing, when required, is optional and may be revoked at any time, without affecting the lawfulness of processing based on consent before its revocation. Revocation can be carried out using the link provided in the communications or by writing to [email protected] or [email protected].
Data used for marketing purposes is retained until consent is revoked and, in any case, subject to periodic reviews of its currency and necessity.
5. Processing methods
Processing is carried out using electronic tools and, where necessary, paper-based means, in accordance with the principles of lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, integrity, and confidentiality.
Innovaway implements technical and organizational measures appropriate to the risk, including measures to prevent the loss, destruction, alteration, unauthorized disclosure of, or access to personal data.
Data is not subject to indiscriminate dissemination. No decisions are made based solely on automated processing, including profiling, that produce legal effects concerning the data subject or similarly significantly affect them, unless explicitly communicated and one of the conditions provided for by the GDPR applies.
6. Data recipients
Data may be communicated, within the limits of the respective purposes, to:
1) persons authorized to process data under the direct authority of the Controller;
2) IT, hosting, cloud, maintenance, cybersecurity, and website management service providers;
3) service providers necessary to manage incoming requests and applications;
4) consultants and professionals, to the extent necessary to perform their assignment;
5) companies within the Innovaway group, when communication is necessary to manage the request, the application, or the relationship with the data subject;
6) public authorities, entities, and bodies authorized to receive the data by law or by an authority order;
7) other recipients indicated, where necessary, in the specific privacy notice linked to the service used.
Entities processing data on behalf of Innovaway are designated as data processors pursuant to Article 28 of the GDPR, where the relevant conditions apply. The updated list of data processors may be requested from the Data Controller by writing to [email protected] or [email protected].
7. Transfers to third countries
Some vendors used for the website or related services may process personal data outside the European Economic Area, including the United States of America or other third countries.
Where the recipient does not fall within the scope of an adequacy decision, the transfer is carried out on the basis of appropriate safeguards pursuant to Article 46 of the GDPR, including, where applicable, the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures in light of the risks involved in the transfer.
Transfers to group companies established in third countries, including Innovaway Albania Sh.p.k., must be carried out only after verifying the recipient's privacy role, the purposes of the transfer, the categories of data involved, and the applicable transfer mechanism. Information regarding the safeguards adopted and the means to obtain a copy of them can be requested from the Data Controller at [email protected].
The presence of a US provider or a provider with international operations does not, in itself, imply that all data is transferred to the United States or to other third countries. Actual transfers depend on the technical configuration of the service and must be verified and kept up to date by the Data Controller.
8. Cookies and other tracking tools
The website may use cookies and similar tools.
Technical or strictly necessary cookies
Technical cookies are used to enable navigation, provide services requested by the user, manage security, and remember preferences necessary for the operation of the website.
Consent is not required for such tools when they are strictly necessary for the transmission of a communication or to provide the requested service.
Analytics, functional, profiling, and third-party cookies
Any analytics cookies that are not strictly necessary, non-essential functional cookies, profiling cookies, and tools enabling third parties to collect information on user behavior are activated only after obtaining valid consent, where required by applicable law.
Consent is collected through a banner that allows users to accept, reject, or customize their preferences. Rejecting consent must be as simple as accepting it. Users can modify or withdraw their preferences at any time via the link or control provided on the website.
Social plugins, embedded videos, analytics tools, and other third-party services must be configured in such a way that they do not transmit personal data prior to user interaction or obtaining consent, unless the relevant processing is strictly necessary and otherwise permitted under applicable law. The cookie policy must specify, for each cookie or tool, at least the name, provider, purpose, duration, type, any access by third parties, and any transfer to third countries. This list must be updated based on the cookies and scripts actually present on the website.
9. Rights of the data subject
The data subject may exercise, in the cases provided for by the GDPR, the following rights:
to obtain confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data and to the information set out in Article 15 of the GDPR;
to obtain the rectification of inaccurate data and the completion of incomplete data;
to obtain the erasure of data, where the grounds set out in Article 17 of the GDPR apply;
to obtain the restriction of processing in the cases provided for by Article 18 of the GDPR;
- to receive the personal data in a structured, commonly used, and machine-readable format and to transmit those data to another controller, where the conditions set out in Article 20 of the GDPR apply;
- to object to processing based on legitimate interest and, at any time, to processing carried out for direct marketing purposes;
- to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing based on consent before its withdrawal;
- not to be subject to a decision based solely on automated processing, in the cases and under the conditions provided for by Article 22 of the GDPR;
- to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), as the competent supervisory authority.
Requests may be sent to [email protected]. As a general rule, the Data Controller will respond within one month of receipt of the request, subject to an extension in the cases provided for by Article 12 of the GDPR.
10. Minors
The website is intended for a general audience and does not, as described herein, offer services directly targeted at minors. Innovaway does not knowingly intend to collect personal data from minors through the website's functionalities. Should a parent, legal guardian, or other authorized party believe that a minor's data has been collected in a manner non-compliant with applicable law, they may contact the Data Controller at [email protected] so that the situation can be verified and appropriate measures taken.
11. Links to third-party websites
The website may contain links to third-party websites, platforms, or services. Innovaway is not responsible for data processing carried out by such third parties. Before providing personal data or using external services, users are encouraged to consult the relevant privacy and cookie policies.
12. Updates to the Privacy Policy
Innovaway may update this privacy policy to adapt it to regulatory, organizational, technical changes, or changes in the services used. The updated version is published on this page, indicating the date of the latest update.
Rev.03 del 14/09/2026
