Privacy Policy

Frigel Firenze S.p.A., with registered offices at Via Pisana 316, 50018 Scandicci (FI), Italy (hereinafter "Frigel" or "Data Controller"), is committed to protecting the online privacy of users of its website (the "Website"). This document describes how personal information is collected, used and protected in accordance with Regulation (EU) 2016/679 ("GDPR"). In accordance with the Regulation, processing operations carried out by Frigel are based on the principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimisation, accuracy, integrity and confidentiality.

1. Data Controller
The data controller for processing operations carried out through the Website is Frigel Firenze S.p.A., as defined above. For any information regarding the processing of personal data by Frigel, including requesting the list of data processors, you may contact the Controller by writing to: [email protected].

2. Personal Data processed
As you navigate the Website, please note that Frigel will process Personal Data which may consist of an identifier such as a name, an identification number, an online identifier or one or more characteristic elements of your identity suitable to make the data subject identified or identifiable (hereinafter "Personal Data"). The Personal Data processed through the Website are as follows:

• 2.a Browsing data
  The computer systems and software procedures used to operate the Website acquire, during their normal operation, certain Personal Data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of computers used by users connecting to the Website, URI (Uniform Resource Identifier) addresses of requested resources, time of request, method used to submit the request to the server, size of file obtained in response, numeric code indicating the status of the server response (successful, error, etc.) and other parameters relating to the user's operating system and IT environment. These data are used solely to obtain anonymous statistical information on the use of the Website and to check its correct functioning.
• 2.b Special categories of Personal Data
  When using the "Work with Us" section of the Website, you may submit Personal Data falling under the special categories of Personal Data referred to in Article 9 of the Regulation, namely data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. Frigel requests that you do not submit such data unless strictly necessary.
• 2.c Data provided voluntarily by the data subject
  The Website offers users the opportunity to voluntarily provide personal information, for example by filling out contact forms for information or support requests, submitting job applications via CV in the "Work with Us" section, and subscribing to the corporate newsletter service. If you enter or otherwise process Personal Data of third parties when using the Website, you act as an independent data controller, assuming all statutory obligations and responsibilities.
• 2.d Cookies
  Cookies are small text files sent and stored on your computer or mobile device by websites you visit, which are then retransmitted to the same sites upon your next visit. The Website uses technical cookies necessary for proper operation, functional cookies to facilitate navigation, and third-party analytical/statistical cookies (including Google Analytics cookies for aggregate traffic analysis and ActiveCampaign tracking cookies/scripts to measure interactions and conversions from emails and the Website). For full details and preference management, please refer to the comprehensive Cookie Policy accessible from the Website footer.

3. Purpose of the processing
Frigel intends to use your Personal Data, collected through the Website, for the following purposes:

• a. To provide Services you request (e.g., responding to assistance or information requests, registration for training courses) and allow Website navigation;
• b. To analyse CVs and contact candidates who submitted applications via the "Work with Us" section;
• c. For compliance with statutory, accounting and tax obligations;
• d. Sending commercial, promotional communications and newsletters regarding Frigel products, solutions and services via email and email marketing automation (e.g. ActiveCampaign);
• e. Statistical analysis of Website performance and email campaigns (e.g. tracking email opens and clicks via pixels/web beacons) to measure communication effectiveness and optimize content.

4. Legal bases and mandatory or discretionary nature of the processing
The legal bases for processing Personal Data for the above purposes are:

• For Section 3(a) (service provision): Art. 6(1)(b) GDPR (contract performance or pre-contractual measures). Providing data is optional but necessary to deliver services.
• For Section 3(b) (CV evaluation): Art. 6(1)(b) GDPR, as processing is necessary for taking steps at the data subject's request prior to entering into a contract (pursuant to Art. 111-bis of the Italian Privacy Code). Providing data is optional, but failure to do so prevents application assessment.
• For Section 3(c) (legal compliance): Art. 6(1)(c) GDPR (compliance with a legal obligation).
• For Section 3(d) (marketing & newsletter): specific, free, informed consent under Art. 6(1)(a) GDPR, expressed via dedicated registration checkboxes.
• For Section 3(e) (statistical analytics & tracking): specific consent under Art. 6(1)(a) GDPR, collected and managed separately via the Website cookie banner.
  Consent-based processing (3.d and 3.e) is entirely optional and may be withdrawn at any time (e.g. via ""unsubscribe"" links in emails or cookie settings) without affecting pre-withdrawal lawfulness.

5. Recipients of Personal Data
Your Personal Data may be shared, for the purposes listed in Section 3 of this Privacy Policy, with:

• Entities acting as Data Processors pursuant to Art. 28 GDPR, such as business consultants, hosting providers, technical web maintenance providers, third-party email and marketing automation providers (e.g. ActiveCampaign, LLC) and web analytics providers (e.g. Google Ireland Limited / Google LLC), formally designated as Data Processors;
• Public entities, bodies or authorities to whom your Personal Data must be disclosed pursuant to applicable laws or binding orders;
• Persons authorised by Frigel to process Personal Data necessary to perform activities strictly related to the provision of Services, bound by confidentiality obligations.

6. Product security and vulnerability reporting
This section applies to personal data processed when you report a suspected vulnerability or other product security issue to Frigel by email at [email protected], and during subsequent investigation, remediation and follow-up. For this processing, the data controller is Frigel Firenze S.p.A., with registered offices at Via Pisana 316, Scandicci (FI), Italy.

• 6.1 Personal data and purposes
  Frigel may process your email address and the name, contact details and affiliation you choose to provide, the contents of your report and attachments, subsequent correspondence, and technical information associated with the report that may constitute personal data, such as IP addresses, device identifiers and log entries. These data are processed to receive and assess reports, investigate and address security issues, communicate with reporters where possible, coordinate remediation and disclosure, and fulfil applicable legal reporting and cooperation obligations. Personal data collected through this channel will not be used for marketing. Please include only information reasonably necessary to explain and investigate the issue. Where possible, redact unrelated personal data from screenshots, logs and other evidence, and avoid including passwords, access credentials or sensitive personal information. 
• 6.2 Legal bases and optional information
  Processing necessary to receive, investigate and manage reports is based on Article 6(1)(f) GDPR: Frigel’s legitimate interest in protecting the security of its products and services and helping prevent harm to customers, users and other affected persons. Where processing is necessary to comply with an applicable legal obligation, including reporting or cooperation obligations under Regulation (EU) 2024/2847 (Cyber Resilience Act), the legal basis is Article 6(1)(c) GDPR. Providing your name, affiliation and other contact details is optional. When you report by email, your email address and message information will be visible to Frigel; you may use an email address that does not identify you. Without contact means, Frigel may be unable to request clarification or provide individual updates, which may limit its ability to investigate the report.
• 6.3 Access and recipients
  Personal data may be accessed by authorised personnel and service providers supporting the reporting channel, security investigation, remediation or legal compliance, subject to confidentiality obligations. Where necessary, relevant information may also be shared with suppliers of affected components, other remediation parties, competent CSIRTs, ENISA and competent authorities. Sharing is limited to necessary information. Technical data will be shared without identifying the reporter wherever practicable; reporter contact details will not routinely be disclosed to component suppliers. Transfers outside the EEA are subject to Section 7 safeguards.
• 6.4 Retention
  Personal data will be retained for the time necessary to assess, investigate and resolve the report and complete any related follow-up. Any further retention will be limited to what is necessary to fulfil applicable legal obligations, preserve evidence of issue handling, or establish, exercise or defend legal claims. Retention periods are assessed based on complexity, remediation status and statutory requirements. Technical records of vulnerabilities do not require keeping reporter identities for the same duration. Data will be deleted or anonymised when no longer necessary.
• 6.5 Your rights
  You may exercise rights described in the "Data subjects' rights" section using provided contact details. In particular, you may object to legitimate interest processing based on your particular situation. You have the right to lodge a complaint with supervisory authorities. For the processing described here, this section takes precedence over any conflicting general wording in this Privacy Policy.

7. Transfers of Personal Data
Some of your Personal Data are shared with Recipients who may be located outside the European Economic Area (EEA). Frigel ensures that the processing of your Personal Data by these Recipients complies with Regulation (EU) 2016/679. Specifically, for newsletter distribution (ActiveCampaign, LLC) and web analytics services (Google LLC), Personal Data may be transferred to the United States. Such transfers take place in full compliance with Chapter V of the GDPR, based on European Commission adequacy decisions (EU-U.S. Data Privacy Framework - DPF) and/or Standard Contractual Clauses (SCCs) approved by the European Commission. Further information is available by writing to: [email protected].

8. Retention of Personal Data
Personal Data processed for service provision (Section 3.a) will be retained for the period strictly necessary to fulfill such purposes and for the subsequent statutory limitation period (ordinarily 10 years).
CV data (Section 3.b) will be retained for a maximum of 12 months from receipt to evaluate profiles for current or future positions, unless earlier erasure is requested by the candidate, after which they will be deleted.
Personal Data processed for compliance with legal obligations (Section 3.c) will be kept for the duration required by applicable statutory laws.
Personal Data processed for marketing, newsletter and statistical analysis (Sections 3.d and 3.e) will be retained until consent is withdrawn (exercisable at any time via "Unsubscribe" links or specific cookie revocation) or up to 24 months from the last contact/interaction.
For further information on retention periods and criteria, please contact: [email protected].

9. Data subjects' rights
Under Articles 15 et seq. of Regulation (EU) 2016/679, you have the right to request from Frigel at any time access to your Personal Data, rectification or erasure, as well as to object to processing. You also have the right to request restriction of processing pursuant to Article 18, and to data portability in a structured, commonly used and machine-readable format pursuant to Article 20. Requests must be addressed in writing to: [email protected]. You always have the right to lodge a complaint with the competent supervisory authority (in Italy, Garante per la Protezione dei Dati Personali) pursuant to Article 77 of the GDPR.

10. Amendments
This Privacy Policy entered into force on 29/04/2019 and was updated on 05/10/2026. Frigel reserves the right to amend or update its content in whole or in part, including due to changes in applicable legislation. Frigel will notify you of such amendments as soon as introduced, which will become binding upon publication on the Website.

update: 07/10/2026