GDPR · PERSONAL DATA

Privacy policy

This Policy explains how EFESTO S.r.l. (“EFESTO”, “we” or “our”) processes personal data relating to people who visit www.efesto.eu, request a project contact or submit a career application. It is intended to provide information under Articles 13 and, where applicable, 14 of Regulation (EU) 2016/679 (“GDPR”).

Effective date: 3 August 2023Last updated: 13 August 2026

DATA CONTROLLER

EFESTO S.R.L.

Controller: EFESTO S.r.l.
Registered office: Via Enrico Fermi 19, 25030 Roccafranca (BS), Italy
Tax ID / VAT number: 02978020968
Share capital: €30,000
Privacy contact: info@efesto.eu

Scope and sources of data

This Policy applies to personal data processed through the Website and to information that a User chooses to send to EFESTO in connection with the Website. Most information is obtained directly from the User. Technical browsing data is generated automatically by the User’s device, browser and the Website’s hosting and security infrastructure.

If EFESTO receives personal data from a customer, supplier, recruiter or other third party, it will provide the information required by Article 14 GDPR when applicable, unless a lawful exemption applies.

Categories of personal data

Contact and business information: name, company, role, business email, telephone number, country and preferred contact method.
Project information: reason for contact, message, timing and any NDA or other document voluntarily sent to EFESTO.
Career information: name, contact details, preferred location, professional area, curriculum vitae, cover letter, portfolio or LinkedIn link and information relevant to assessing an application.
Browsing and security data: IP address, request date and time, requested resource, response status, browser and device information, referral data and technical logs necessary for delivery and security.
Preference data: cookie-consent choices and the local state used to avoid repeatedly displaying notices or prompts.

Purposes and legal bases

Purpose	Data	Legal basis
Provide, secure and maintain the Website	Browsing, device and security logs	Legitimate interests in service availability and security (Art. 6(1)(f) GDPR) and, where applicable, legal obligations (Art. 6(1)(c))
Respond to enquiries and assess projects, RFQs or production transfers	Contact, company, project message and NDA	Pre-contractual measures requested by the data subject (Art. 6(1)(b)) and legitimate interests in managing B2B relationships (Art. 6(1)(f))
Assess spontaneous applications and recruitment	Contact and professional application data	Pre-contractual measures (Art. 6(1)(b)) and obligations/rights in employment law where applicable (Art. 6(1)(c) and Art. 9(2)(b))
Comply with legal duties and defend rights	Relevant records and correspondence	Legal obligation (Art. 6(1)(c)) and establishment, exercise or defence of legal claims (Art. 6(1)(f); Art. 9(2)(f) where applicable)
Use optional experience or measurement technologies	Online identifiers and usage data	Consent (Art. 6(1)(a)); no optional analytics or marketing service is currently active

Website forms and email delivery

The current project-contact and career forms prepare an email locally on the User’s device. Data and attachments are not uploaded to or stored in an EFESTO Website database. EFESTO receives and processes them only when the User sends the prepared email through their chosen email service.

Email transmission also involves the User’s email provider and EFESTO’s email service provider, each acting under its own role and applicable terms. Users should not include unnecessary special-category data in an enquiry, CV or attachment.

Recipients and processors

Personal data may be accessed, within the limits of their duties and need to know, by authorised EFESTO personnel and by providers supporting hosting, cybersecurity, maintenance, email, document management, professional advice and recruitment. Such providers act as independent controllers or processors under Article 28 GDPR, as appropriate.

Public authorities, regulators, courts or law-enforcement bodies where disclosure is legally required.
Professional advisers, insurers or counterparties where necessary to protect rights or manage a transaction.
Other recipients only with a valid legal basis or the User’s prior consent.

International transfers

Some technology providers may process data outside the European Economic Area. Where this occurs, EFESTO will rely on an adequacy decision, the European Commission’s Standard Contractual Clauses or another safeguard permitted by Chapter V GDPR, together with supplementary measures where required. Information on the applicable safeguard may be requested from EFESTO.

Retention

Processing	Retention criterion
Browsing and security logs	For the period necessary to operate, secure and troubleshoot the Website, according to the documented schedules of EFESTO and its infrastructure providers, unless longer retention is required for an incident or by law
Project and commercial enquiries	For the time needed to respond and manage pre-contractual discussions; if a relationship follows, for the applicable contractual and statutory retention periods
Career applications	For the recruitment process and potential compatible openings, normally no longer than 24 months, unless a different period is required by law or agreed with the applicant
Cookie-consent choices	Up to 6 months, unless the User changes the choice earlier or a material change requires renewed information and consent
Legal claims and compliance records	For the limitation period or the longer period required by a competent authority or applicable law

Security

EFESTO applies technical and organisational measures proportionate to the risks, including access controls, minimisation, confidentiality obligations, provider governance and appropriate security safeguards. No transmission or storage system is absolutely secure; Users should therefore avoid sending information that is unnecessary for the requested purpose.

Cookies and similar technologies

The Website uses technical storage necessary for delivery, security and recording privacy choices. Optional technologies require prior consent and remain disabled by default. At present no optional analytics or marketing service is active. Details and the control panel are available in the Cookie Policy, and choices can be reopened at any time from the footer.

Whether providing data is mandatory

Browsing data required for network communication and security is processed automatically. Providing data in a contact or career request is voluntary, but fields marked as required are necessary for EFESTO to identify and respond to the request. Failure to provide them may prevent EFESTO from following up.

Data-subject rights

Subject to the conditions in the GDPR, Users may request access, rectification, erasure, restriction, data portability, or object to processing based on legitimate interests. Where processing is based on consent, consent may be withdrawn at any time without affecting earlier lawful processing.

Requests may be sent to info@efesto.eu. EFESTO may ask for information reasonably necessary to verify identity.
Users may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or another competent supervisory authority in the EU/EEA.

Automated decisions and profiling

EFESTO does not use Website data to make decisions based solely on automated processing that produce legal or similarly significant effects. The Website currently performs no marketing profiling.

Third-party links and minors

The Website may link to third-party websites governed by their own privacy notices. EFESTO is not responsible for their processing activities. The Website is intended for professional and business audiences and is not directed to children.

Changes and contact

EFESTO may update this Policy when processing activities, providers or law changes. Material changes will be highlighted where appropriate, and the updated date will appear on this page. Questions and privacy requests may be sent to info@efesto.eu or to the registered office.