Personal data privacy notice
Website and contact enquiries — Article 13 of Regulation (EU) 2016/679
Version dated 11 November 2026
1. Controller and contact details
The controller is iHires, tax code and VAT number 03036200362, fully identified in the website's Registered office section. Its office is at Via Jacopo da Porto Sud 283, 41126 Modena (MO), Italy.
For questions or to exercise your rights, email problema@ihires.it or write to the registered office. You can do so without completing the website form.
2. Data processed
The form collects your full name, email, topic and enquiry text. Company is optional. The enquiry language and acknowledgement of this notice are also recorded. Attachments are not requested.
Operation and security may involve IP addresses, timestamps, requested URLs, request outcomes, technical browser information, session identifiers and anti-spam indicators. The application counter uses an HMAC-pseudonymised IP address; this is not anonymous data.
Provide only relevant information. Do not include passwords, credentials, health data, identity documents or other special-category or criminal-offence data in the message. The form is not intended to collect such data.
3. Purposes and lawful bases
Acknowledging this notice is not consent to marketing. The form does not subscribe you to newsletters, and its data is not used for marketing, profiling or training AI models. Any future use for a different purpose requires appropriate information and a suitable lawful basis.
| Purpose | Lawful basis |
|---|---|
| Responding to an individual's request for a quotation or services and handling related pre-contractual contacts. | Article 6(1)(b) GDPR: steps requested by the individual before entering a contract. |
| Handling general enquiries and professional contacts from business contacts. | Article 6(1)(f): legitimate interests in responding to communications and maintaining relevant professional relationships. |
| Operating the website, preventing spam and abuse, protecting systems and communications, identifying and managing incidents. | Article 6(1)(f): legitimate interests in secure, continuous and reliable services, balanced against users' rights. |
| Complying with applicable legal obligations and binding requests from authorities. | Article 6(1)(c), within the scope of the applicable obligation. |
| Establishing, exercising or defending a legal claim. | Article 6(1)(f), to the extent strictly necessary for that claim. |
4. Providing your data
Providing data is voluntary. Fields marked with an asterisk are necessary to handle the enquiry through the form; you cannot submit it without them. Omitting a company name does not prevent submission. Direct contact details remain available.
5. Processing, recipients and providers
Authorised personnel process data electronically according to their responsibilities. Hosting, maintenance, security and email providers may process it as processors under Article 28 GDPR where they act on the controller's behalf, together with authorised sub-processors.
The form is designed to deliver enquiries to business email through Microsoft 365 and Microsoft Graph under the service's applicable contract and data protection terms. The message goes to the configured business mailbox and the visitor's email is set as Reply-To. Messages are not stored in a website database; they may remain in relevant mailboxes, security systems and backups.
Data is not publicly disclosed. It may be shared with professional advisers or authorities where necessary for the stated purposes. An updated processor list and further provider details are available from the controller.
6. Transfers outside the European Economic Area
Cloud services, sub-processors or support may involve processing outside the EEA. Before enabling the services, the controller checks locations, recipients and contractual terms.
Any transfer must meet Chapter V GDPR requirements, for example an applicable adequacy decision or standard contractual clauses and supplementary measures where needed. Coverage by an adequacy framework must be checked for the particular recipient and processing. It is not assumed that all data stays in the EU. You may request further information and a copy of relevant safeguards using the controller's contact details.
7. Retention
These retention rules apply to operation of the website services. For an incident or dispute, only necessary data is kept for a justified and documented period.
| Data | Period or criterion |
|---|---|
| Enquiries that do not lead to a contract. | 12 months after the enquiry is closed, unless documented legal-claim needs justify otherwise. |
| Data forming part of a contractual relationship. | For the relationship and then under the legal duties and applicable limitation periods for the relevant records; a ten-year period is not applied indiscriminately to every message. |
| Routine website access and security logs. | An ordinary period of no more than 30 days; longer retention only for documented incidents, disputes or legal duties. |
| Technical cookie and form token. | Cookie for the browser session; CSRF token valid for 30 minutes. Server-side sessions follow the server's configured technical deletion process. |
| Pseudonymised anti-spam counters. | One-hour rate-limit window. Expired records are automatically removed on the next request to the home page or contact endpoint. Without traffic they may remain until the next relevant request. |
| Any backups. | Until the relevant service's defined rotation cycle expires, with restricted access and no routine reuse of deleted data. |
8. Cookies, logos and external links
The website has no analytics, advertising, tracking pixels or remote fonts. When the form is active, it uses the technical __Host-ihires cookie, with Secure, HttpOnly and SameSite=Strict attributes, to protect the session and anti-forgery token. Technical cookies do not require prior consent; information about their use is still required.
In the PHP version, logos are retrieved and cached by the server and served from the website's own domain: visitors' browsers do not need to contact logo providers to display them. Clicking a technology opens the producer's website, subject to its own privacy notice. Form fields and added visitor identifiers are not included in those links.
HTML preview copies load public image links and may cause browsers to communicate with the relevant image hosts. These are demonstration copies, not the PHP configuration described for the published site. Adding non-technical tools requires a new assessment and, where necessary, consent before activation.
9. Security, incidents and NIS2
The design includes HTTPS, server-side application credentials, permissions scoped to the sender mailbox, input validation, CSRF protection, anti-spam limits and separation of public and private files. Operations must complete these measures with access management, updates, supplier checks, backups and risk-proportionate incident procedures.
Personal data breaches are assessed under Articles 33 and 34 GDPR for any required notifications or communications. Risk-management and incident-notification duties under Italian Legislative Decree 138/2024 implementing NIS2 apply only where the company or service actually falls within scope. This notice does not claim that iHires is registered as a NIS entity and does not replace the scope assessment, organisational measures or legally required notifications.
10. Your rights
Where and to the extent provided by GDPR, you may request access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Portability applies to automated processing based on contract or consent where legally applicable.
Send requests to problema@ihires.it. The controller normally responds within one month, with a reasoned extension where legally allowed, and may request only the information needed to verify identity. You may complain to the Italian data protection authority at www.garanteprivacy.it or seek a judicial remedy. Exercising rights does not require purchasing a service.
11. Automated decisions and updates
Enquiries are not subject to solely automated decisions with legal or similarly significant effects. Automated form checks validate submissions and limit abuse.
The notice is updated when services or processing materially change. The date above identifies the version. If a DPO is designated, their contact details must also be published.