Notice provided pursuant to Art. 13 of Regulation (EU) 2016/679 (“GDPR”), Art. 13 of Italian Legislative Decree 196/2003 (“Privacy Code”), and the Guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority (Garante) on 10 June 2021, No. 231 (in force since 10 January 2022)

Last updated: 29 July 2026

Introduction

For ELFO S.r.l. con socio unico (“ELFO”, “the Company”), personal data is a valuable asset to be protected. Transparency towards data subjects is a primary objective: this notice describes how personal data is processed for visitors of the website elfo.net (“Site”), in compliance with Regulation (EU) 2016/679, Legislative Decree 196/2003, and the Garante’s cookie guidelines of 10 June 2021.

Data Controller and Contacts

Data subjects may contact the DPO to exercise the rights set out in Arts. 15-21 GDPR (access, rectification, erasure, restriction, portability, objection) and to withdraw a previously given consent. In the absence of a response, the data subject may lodge a complaint with the Garante for the protection of personal data (www.garanteprivacy.it).

1. Processing of data related to browsing the Site

1.1 Browsing data

The computer systems used to operate the Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (IP addresses, domain names, URIs of requested resources, request time, method used, response size, server status code, and other parameters relating to the user’s operating environment).

Purpose and legal basis: anonymous statistics on Site usage, monitoring of correct functioning, and establishing liability in the event of computer crimes against the Site (Controller’s legitimate interest, Art. 6(1)(f) GDPR).

Recipients: authorised internal personnel (Art. 29 GDPR) and any external providers appointed as data processors (Art. 28 GDPR) for platform maintenance. No disclosure to third parties except upon request by judicial authorities.

Retention: for the time necessary for the above purposes, normally not exceeding 12 months, save for extensions connected to ongoing investigations.

Provision: not required from the data subject, automatically acquired by technological systems.

1.2 Cookies and other tracking tools

The Site uses cookies and similar technologies according to the categories described below, in compliance with the Garante’s Guidelines of 10 June 2021, No. 231.

What cookies are. Small text files that the browser stores on the user’s device and returns to the Site on each subsequent visit, to recognise the device and personalise the experience.

Consent management. On first access, a banner managed via the Iubenda platform is shown, allowing the user to accept, reject (with an action of equal simplicity to acceptance) or customise preferences, before any non-technical cookies are installed. Consent may be changed or withdrawn at any time by opening the “Manage cookie preferences” panel, accessible via the dedicated button present on every page of the Site, or directly through browser settings.

a) Technical (strictly necessary) cookies

Do not require consent (Art. 122(1) Privacy Code). They ensure the operation of the Site: session management and storage of consent preferences.

b) Analytics cookies

Used, subject to consent, to measure traffic and understand user behaviour in aggregate form, in order to improve the Site.

The Site uses Google Analytics 4 (GA4): data is processed by Google Ireland Ltd. and may involve a transfer of data to the United States by Google LLC, which adheres to the EU-US Data Privacy Framework (European Commission adequacy decision 2023/1795 of 10 July 2023), currently the applicable legal basis for such transfer. For further information: Google’s privacy policy and Google Analytics opt-out page.

c) Functionality cookies

Improve the user experience by remembering user preferences (language, layout, answers already given to surveys) and enabling optional features (e.g. video, forms).

d) Third-party / social cookies

When the user interacts with social content embedded in the Site, third-party cookies not controlled by ELFO may be installed:

For these services, the transfer of data to the USA is based, where applicable, on the EU-US Data Privacy Framework or, absent the provider’s adherence to it, on Standard Contractual Clauses (Art. 46 GDPR).

e) Marketing / advertising targeting cookies

The Site uses, subject to consent, a Google Ads (Conversion Linker) tool, which links clicks on online advertisements to conversions completed on the Site. Data is processed by Google Ireland Ltd. and may involve a transfer of data to the United States by Google LLC, which adheres to the EU-US Data Privacy Framework (adequacy decision 2023/1795 of 10 July 2023).

The Site does not currently use third-party behavioural profiling or retargeting advertising cookies other than as indicated above.

1.3 How to manage cookies from the browser

In addition to the Site’s preference management panel, users can act directly through their browser: Chrome, Firefox, Safari, Edge. Disabling technical cookies may impair the operation of the Site.

1.4 Careers

The “Careers” page allows for the spontaneous submission of job applications (CVs). Purpose: personnel selection, based on the data subject’s specific and informed consent (Art. 6(1)(a) GDPR). In the event of hiring, a dedicated notice regarding the professional relationship will be provided. Retention: for the time necessary for the selection process, unless consent is given to retain data for future opportunities. Provision: necessary to submit an application.

1.5 Information requests / contact

Identification and contact data submitted through the Site’s forms are processed to respond to received requests, based on the data subject’s consent (Art. 6(1)(a) GDPR), and retained for the time necessary to handle the request.

2. Processing of data related to client and supplier relationships

2.1 Purpose of processing

ELFO processes identification data of clients, suppliers, and their operational contacts (name, company name, tax data, address, contact details, payment references) in connection with the provision of its software development services and solutions. ELFO may also process personal data (usually anonymised) in connection with software development activities carried out on behalf of clients. Where ELFO acts as a data processor on behalf of its clients, the terms of such processing are governed by a dedicated Data Processing Agreement (DPA) pursuant to Art. 28 GDPR, separate from this notice.

2.2 Purpose and legal basis

• Conclusion and performance of contractual relationships (Art. 6(1)(b) GDPR);
• fulfilment of pre-contractual, contractual, tax and legal obligations (Art. 6(1)(b), (c) GDPR);
• Controller’s legitimate interest, including legal defence and operational/accounting management (Art. 6(1)(f) GDPR).

Failure to provide the data makes it impossible to establish the relationship. Additional consent will be requested for any further purposes.

2.3 Methods and scope of processing

Processing is carried out using paper-based and electronic tools, in compliance with the principles set out in Art. 5 GDPR and with the security measures required by Art. 32 GDPR. Data is processed by authorised internal personnel and, where necessary, by external parties appointed as data processors (IT providers, hosting providers, consultants). The list of external processors is available upon request to the DPO.

2.4 Extra-EU transfers

Where, in the course of providing its services, certain data is processed by providers based in or operating infrastructure in the United States, the transfer is based on the EU-US Data Privacy Framework (adequacy decision 2023/1795), where the provider adheres to it, or on Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR).

3. Policy updates

This notice may be subject to periodic review in light of regulatory or case-law developments. Any significant changes will be announced on the Site’s home page. Users are advised to review this page periodically.