This page describes the processing of personal data of the data subjects that interact with TECNOFIRMA SPA. This information is provided – including in pursuance of article 13 of Italian Legislative Decree No. 196/03 (Code on the Protection of Personal Data) – to users using the electronically-based services accessible from the homepage of TECNOFIRMA SPA’s official website at The information provided applies exclusively to TECNOFIRMA SPA’s website and does not apply to any other websites accessed by the user, including through a link.

Data Controller

The data controller is TECNOFIRMA SPA, a company with operating offices at Viale Elvezia 35, 20900 MONZA, Italy.

Place Where the Data are Processed

Data processing activities take place only at TECNOFIRMA’s offices at the above address and are conducted exclusively by qualified personnel that has been entrusted with the task of processing said data or by persons that have been specifically instructed to carry out maintenance operations. Personal data supplied by users making specific requests are used solely for the purpose of providing the services required and are disclosed to third parties only as necessary for the above purpose.

Types of Data Processed and Purposes of the Processing

Personal data are processed for purposes that are instrumental to the performance of our activities or the activities of our subsidiary and/or associated companies, including in particular: provision of web-based services; provision of products and services; commercial information; marketing activities regarding Tecnofirma products; customer information activities; creation of customer/user professional profiles; scientific research; statistical research; market research. In addition, personal data may be processed to ensure full compliance with present and future legal requirements (money laundering, tax, accounting, requests by law enforcement authorities, defence in court, etc.).

A) Navigation data
During their normal activity, the IT systems and software procedures employed for the operation of this website acquire personal data that are transmitted automatically through Internet communications protocols. This information is not collected for the purpose of associating it with identified data subjects; however, because of its nature, it could be processed further and matched with data held by third parties to identify users. This data category includes the IP addresses and domain names of the computers used to connect to this website, the method used for submitting a request to the server and other parameters relating to the user’s operating system and IT environment. These data are used exclusively to obtain anonymous statistical information on the use of the website and make sure it is functioning properly and are not stored for any purposes other than statistical. The data might also be used for the purpose of determining liability in case of cybercrimes against the website.

Tecnofirma uses exclusively technical cookies and third-party cookies (Google analytics). For further information, please refer to the privacy policies of the respective data controllers.

B) Data provided by users voluntarily. By sending e-mail messages to the addresses listed on this website, on a voluntary, personal-choice basis, senders automatically authorise the subsequent acquisition of their email addresses - which is necessary for the purpose of responding to their requests - as well as of any additional personal data included in their e-mail messages.

C) Data for subscription to internal information services (newsletters and technical bulletins) which, unless otherwise requested, will be activated for customers and prospects, subject to article 130 of Italian Legislative Decree No. 196/03.

Voluntary Nature of Data Provision

Except as indicated with regard to navigation data, users are free to decide whether to provide the personal data requested in the request forms. Failure to provide said data, however, could make it impossible to satisfy the associated requests.

Methods of Processing

The processing of personal data takes place through automated means strictly for no longer than required in order to achieve the purposes for which they have been collected. Personal data may also be processed with traditional means (telephone, fax, text messages) and revocation of consent for any of the above means automatically implies revocation of consent for all means.

Specific security measures are observed to prevent the data from being lost, used unlawfully or inappropriately or accessed without authorisation.

Rights of the Data Subjects

Data subjects shall have the right at any time to obtain confirmation as to whether or not data relating to him/her exist, to be informed of their contents and source, to verify the accuracy of the data and to request their supplementation, updating or rectification, as per article 7 of Italian Legislative Decree No. 196/03. In accordance with the same article, data subjects shall also have the right to request the erasure, transformation in anonymous form and blocking of any data processed in breach of the applicable law, as well as to object, for legitimate reasons, to their processing. All requests are to be submitted to TECNOFIRMA SPA.


All data provided in the CVs sent to TECNOFIRMA SPA, whether spontaneously or in response to a specific ad, are processed exclusively for purposes related to the recruitment of personnel for the group’s companies. The information received may be kept by TECNOFIRMA SPA for future recruitment purposes for a maximum of 4 years from the date of receipt. All CVs that TECNOFIRMA SPA does not expect to use in future recruitment activities will be destroyed immediately. All CVs containing personal data that are classed as “sensitive (that is data revealing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of political parties, trade unions, associations or organisations of a religious, philosophical, political or trade-union nature, as well as personal data concerning health and sex life) which do contain an express authorisation to the processing of personal data in accordance with article 23 of Italian Legislative Decree No. 196/2003 will be destroyed immediately. Consent must be expressed using the following or similar phrasing: "In accordance with article 23 of Italian Legislative Decree No. 196/03, I hereby authorise TECNOFIRMA SPA and its group companies to process the sensitive data provided by me exclusively for personnel recruitment purposes, in accordance with their privacy policy".


Data processors: Privacy Office - TECNOFIRMA SPA - Vle Elvezia 35, 20900 MONZA (MB), Italy.


Articles 7, 8, 9 and 10 of Italian Legislative Decree No. 196/03
Article 7 (Right to access personal data and other rights)

  1. The data subject shall have the right to obtain confirmation as to whether or not personal data relating to him/her exist, even if they have not been recorded yet, and to obtain communication of said data in an intelligible form.
  2. The data subject shall have a right to obtain information on:
    a) the source of the personal data;
    b) the purposes and methods of processing;
    c) the logic involved in any electronic processing;
    d) the identification details of the data controller, the data processors and the representative designated under article 5, paragraph 2;
    e) the subjects or categories of subjects to whom the data may be disclosed or who may access the data in their capacity as designated country representative, data processors or persons authorised to process the data.
  3. The data subject shall have a right to obtain:
    a) the updating, rectification or, should it be in his/her interest, supplementation of the data;
    b) the erasure, transformation in anonymous form or blocking of data which do not comply with the provisions of the applicable law, including any data that no longer need to be stored in relation to the purposes for which they were originally collected or processed;
    c) certification that notification has been given to any and all third parties to whom the data have been disclosed of any and all operations carried out in compliance with items a) and b) above, including with regard to their content, unless this proves impossible or involves a manifestly disproportioned effort in relation to the right protected.
  4. The data subject shall have a right to object, in whole or in part:
    a) on legitimate grounds, to the processing of personal data relating to him/her, even when they are relevant to the purposes for which they were originally collected;
    b) to the processing of personal data relating to him/her for purposes of direct marketing, direct selling, market research or advertising.

Article 8 (Exercise of Rights)

  1. The rights under article 7 may be exercised by simple request to the data controller or the data processor, including through a person authorised to process the data. A suitable response shall be provided without delay.
  2. The rights under article 7 may not be exercised by submitting a request to the data controller or the data processor or by lodging a recourse under article 145, if the personal data are processed:
    a) under the provisions of Italian Decree Law No. 143 of 3 May 1991, as amended and converted into Italian Law No. 197 of 5 July 1991, as amended, on money laundering regulations;
    b) under the provisions of Italian Decree Law No. 419 of 31 December 1991, as amended and converted into Italian Law No. 172 of 18 February 1992, as amended, on the support to be provided to the victims of extortion;
    c) by a parliamentary committee of inquiry set up under article 82 of the Italian Constitution;
    d) by a public body, other than a profit-driven public body, under a specific provision of law, for purposes relating exclusively to monetary and currency policies, the system of payments, the supervision of financial intermediaries and credit and financial markets and the safeguarding of their stability;
    e) pursuant to article 24, paragraph 1, item f), exclusively for the period during which said exercise may cause actual and real prejudice to defensive investigations or the exercise of a legal claim;
    f) by providers of publicly-accessible electronic communications services in relation to incoming telephone calls, except where this may cause actual and real prejudice to defensive investigations under Italian Law No. 397 of 7 December 2000;
    g) for justice-related reasons, by judicial authorities of all types and tiers, as well as by the Superior Council of Magistracy or other self-regulatory bodies or the Ministry of Justice;
    h) pursuant to article 53, without prejudice to the provisions of Italian Law No. 121 of 1 April 1981.
  3. The Privacy Commissioner, including upon request by the data subject, in the cases under paragraph 2, items a), b), d), e) and f), may intervene in the manner described under article 157, 158 and 159 and, in the cases under items c), g) and h) of the same paragraph, may intervene in the manner described under article 160.
  4. When it regards data of a non-objective nature, the exercise of the rights under article 7 may be permitted where it does not concern the rectification or supplementation of personal evaluation data, in connection with judgments, opinions and other types of personal assessments, or the specification of conducts to be undertaken or decisions to be made by the data controller.

Article 9 (Exercise Procedure)

  1. The request to the data controller or data processor may be made by registered mail, fax or e-mail. The Privacy Commissioner may indicate other suitable systems using new technological solutions. When it regards the rights under article 7, paragraph 1 and 2, the request may be made verbally, in which case it shall be briefly recorded in writing by a person authorised to process the data or by the data processor.
  2. When exercising the rights under article 7, the data subject may grant written power of attorney or proxy to specific natural persons, bodies, associations or organisations. The data subject may enlist the assistance of a person of his/her choice.
  3. The rights under article 7, where referring to personal data concerning a deceased person, may be exercised by any party who has a direct interest or acts to protect the data subject, or for family-related reasons that deserve to be protected.
  4. The identity of the data subject is checked using appropriate information, including by means of available records and documents or by exhibiting or attaching copy of suitable ID. A person acting on behalf of a data subject is required to exhibit or attach copy of the power of attorney or proxy statement signed by the data subject in the presence of a person authorised to process the data or signed by the data subject and submitted together with a copy of the data subject’s ID, which does not need to be authenticated. If the data subject is a legal person, a body or an association, the request is made by the person that is legally authorised to do so in accordance with the respective articles of association or regulations.
  5. The request under article 7, paragraph 1 and 2, may be worded freely, without constraints, and may be renewed after a minimum interval of ninety days, except in the presence of justified reasons.

Article 10 (Response to the Data Subject)

  1. In order to ensure the effective exercise of the rights under article 7, the data controller shall be required to implement suitable measures aiming to:
    a) facilitate access by the data subject to his/her personal data, including by means of dedicated software applications designed to allow accurate retrieval of data relating to specifically identified or identifiable data subjects;
    b) simplify the request procedure and reduce response times, including in customer relations offices or services.
  2. The data shall be retrieved by the data processor or by persons authorised to process the data and may be communicated to the requesting party verbally or otherwise shown on electronic means, providing that the data are easily intelligible in consideration of the nature and amount of the information. If requested, the data shall be transposed on paper or IT media or transmitted electronically.
  3. Except where the request refers to a specific type of processing or specific personal data or category of data, the response provided to the data subject shall include all personal data relating to him/her, however processed by the data controller. If the request is made to a healthcare professional or healthcare provider, article 84, paragraph 1, shall apply.
  4. Should the retrieval of the data prove particularly difficult, the response to the data subject’s request may take place through the exhibition or delivery of copy of records or documents containing the personal data requested.
  5. The right to obtain communication of the data in an intelligible form shall not apply to personal data relating to third parties, except where separation of the processed data or the elimination of certain items from the latter would make the personal data relating to the data subject incomprehensible.
  6. Communication of the data in an intelligible form also includes the use of legible handwriting. Where codes or abbreviations are communicated, the parameters for the understanding of their meanings are also provided, including through persons authorised to process the data.
  7. Where, following a request made under article 7, paragraphs 1 and 2, items a), b) and c), no data appear to exist relating to the data subject, a contribution towards costs may be requested from the data subject, which may not exceed the costs actually incurred for the search conducted.
  8. In any case, the contribution referred to under paragraph 7 may not exceed the amount established by the Privacy Commissioner in a general provision and may consist in a fixed fee where the personal data are processed electronically and the response is provided orally. In the same provision, the Privacy Commissioner may establish that a contribution be requested when the personal data are stored on a special medium the reproduction of which is specifically requested, or when a significant effort is required by one or more data controllers due to the complexity or extent of the requests and the existence of data concerning the data subject is confirmed.
  9. Contributions under paragraphs 7 and 8 may be paid by bank or postal order, or by credit or debit card, where possible upon receipt of the related response and in any case no later than fifteen days after said response.
Siga-nos no: