Privacy Policy

Art. 13 EU Regulation 679/16

Zapi s.p.a. , as Data Controller, pursuant to Article 13 of EU Regulation 679/2016 ("General Data Protection Regulation", hereinafter "GDPR"), hereby informs Users of the methods for processing personal data in relation to navigation on the website www. zapispa.com (hereinafter "the Site").

This Policy, which applies only to the Site and not to other websites that may be consulted by the User through links, is subject to change, in accordance with changes in legislation and/or new purposes that may be pursued through the Site. Please check the "Last Updated" section at the bottom of this page to find out when the Policy was last updated. Any changes to this Policy will be effective immediately upon posting on the Site.

1. Data controller
1.1 The data controller is ZAPI s.p.a. , in the person of its legal representative pro tempore, VAT no. 01143740288, with registered office in Via Terza Strada no. 12 - ZI, 35026 Conselve (PD) Tel. +39 049 9597700 e-mail info@zapispa.com - PEC zapi@pec.it (hereinafter also referred to as "ZAPI" or the "Data Controller").

2. Data subject to processing
2.1 The data to be processed are as follows:

• browsing data: in the course of normal operation, the computer systems responsible for the operation of the Site acquire certain personal data, which are then implicitly transmitted during the use of Internet communication protocols. This information is not collected in order to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, make it possible to identify Users. This category of data includes the IP addresses or domain names of the computers used by Users who connect to the Site, the URI (Uniform Resource Identifier) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the User's operating system and computer environment.
• Cookies: while browsing the Site, various types of cookies may be used, in accordance with the applicable provisions. In this regard, please read the extended cookie policy, which can be viewed via the following link: Cookie Policy;
• Contact section: name, e-mail address, telephone number, company provided by the User through the contact form for requesting information from ZAPI as well as any personal data contained in the request;
• Work with us section: name, telephone number, e-mail address, country, personal data contained in the message, further personal data contained in the CV. The Data Controller may also process any special data within the meaning of Art. 9 GDPR contained in CVs (e.g. data disclosing health status such as belonging to protected categories, racial or ethnic origin of the candidate) only if it is necessary to assess the candidature as part of the personnel selection process. Interested parties are requested to include in the CV only the data necessary to assess their professional profile and not to indicate any particular data pursuant to Art. 9 GDPR, unless strictly necessary. In the event that the CV contains data that are irrelevant to the purpose pursued, ZAPI will refrain from using such information.

Please note that the optional, explicit and voluntary sending of e-mail messages to the addresses indicated on this Site entails the subsequent acquisition of the sender's address, which is necessary in order to reply to requests, as well as any other personal data included in such requests.

3. Purpose and legal basis of processing
3.1 The Data Controller shall carry out processing for the following purposes, distinguished by categories of personal data:

1. a) browsing data: to allow the User to navigate on the Site and to obtain anonymous statistical information on the use of the Site in order to check its correct functioning and to determine which data/content are more or less useful/interesting to Users and thus be able to improve the effectiveness of the material available on the Site. The legal basis for the processing is the legitimate interest of the Data Controller (Art. 6(1)(f) GDPR);
2. b) personal data provided through the contact form and through the voluntary sending of e-mails: responding to requests for information sent by the User. The legal basis for the processing is the fulfilment of pre-contractual measures taken at the request of the Data Subject (Art. 6(1)(b) GDPR);
3. c) personal data provided through the Work with us section: to evaluate the application as part of the personnel selection process by ZAPI. The legal basis for the processing is the execution of pre-contractual measures taken at the request of the Data Subject pursuant to Article 6(1)(b) GDPR and, for any special data contained in the CV, the fulfilment of obligations and the exercise of specific rights of the data controller or the data subject in the field of employment law pursuant to Article 9(2)(b) GDPR.
4. d) fulfilling legal obligations incumbent on the Controller and complying with orders from Authorities. The legal basis for the processing is the fulfilment of legal obligations to which the Controller is subject (Art. 6(1)(c) GDPR).

4. Methods of processing
4.1 Data will be:

• collected electronically;
• protected against the risks of destruction, modification, deletion and unauthorised access by means of appropriate physical, logical and organisational security measures;
• further processed, also in paper form, to the extent and within the time strictly necessary to fulfil the above-mentioned purposes.

4.2 The data may be processed, for the purposes set out in point 3, by persons working within the internal organisational structure of the Data Controller, specifically authorised and instructed on the basis of their respective duties, as well as by external parties necessary for the operation of the Site and the provision of the services requested, appointed as data processors pursuant to Article 28 GDPR.

4.3 There are no automated profiling processes.

5. Recipients of the data
5.1 The data acquired through the Website may be communicated to collaborators and employees of ZAPI, specifically authorised to process the data, and to suppliers of services offered through the Website or connected to its operation, or in any case necessary for the provision of the services requested by the User, in their capacity as data processors pursuant to art. 28 GDPR, as well as to the parent company or group companies.

5.2 The data acquired through the Site may be communicated to third parties if necessary for the provision of the requested service, or in the event of an obligation imposed by law or regulation, or of an order from the Judicial or Public Security Authorities. No personal data will be disclosed.

5.3 Personal data may be transferred to third countries outside the EU in the presence of adequacy decisions pursuant to Article 45 GDPR or adequate safeguards pursuant to Articles 46-47 GDPR. Data will not be transferred to international organisations.

6. Period of data retention
6.1 The Data Controller shall store the data for the period indicated below:

• personal data provided by the User through the contact form and through the voluntary sending of e-mails: this data will be kept for the period of 24 months, unless a contractual relationship is established with Zapi. In that case the data will be retained for the time periods stipulated in the customer and supplier privacy notices;
• personal data sent through the Careers section: they will be kept for a maximum period of 12 months after receipt of CVs.

This is subject to further retention periods related to the protection of Zapi's rights.

7. Compulsory and optional nature of personal data communication
7.1 Browsing data: the communication of browsing data is obligatory and indispensable for the Controller to enable the User to use the Site.

7.2 Contact form: The provision of the data requested in the contact form is mandatory, where marked as such (*). Failure to provide the data indicated as mandatory will result in the impossibility of providing the requested information.

7.3 Work with us section: without prejudice to the candidate's free will to submit their CV, failure to provide the data indicated as mandatory (*) will result in the impossibility of sending their application.

8. Rights of the Data Subject pursuant to Articles 15 - 21 GDPR
8.1 Pursuant to Articles 15-21 GDPR, Data Subjects have the right to:

• obtain confirmation as to whether or not data relating to them is being processed, and if so, obtain access to their data and to the information referred to in Article 15 GDPR (right of access);
• obtain rectification of inaccurate personal data without undue delay or supplementation of incomplete personal data (right of rectification - Art. 16 GDPR);
• obtain the deletion of data without undue delay (right to deletion - Art. 17 GDPR);
• obtain limitation of processing (right of limitation - Art. 18 GDPR);
• object to the processing at any time on grounds relating to their particular situation (right to object - Art. 21 GDPR);
• file a complaint with the Data Protection Authority pursuant to Article 77 GDPR.

8.2 Rights may be exercised by sending a request to the data controller to the following contacts, to speed up evading your request use this appropriate form:

• ZAPI s.p.a. - Via Terza Strada, 12 - 35026 Conselve (PD)
• gdprprivacy@zapi.it - PEC zapi@pec.it