Privacy
Personal data processing notice.
Notice under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, regarding personal data of users who browse the site and use the contact, project brief and careers forms. Last updated: 30 July 2026.
1. Data controller
The data controller is: ECOS SI.S.MA. SRL Circonvallazione Clodia, 29 — 00195 Rome (RM) VAT / Tax code 03147290609 Email: amministrazionecosismasrls@gmail.com PEC: ecossismassrls@pec.buffetti.it Phone: +39 379 150 7794 To exercise GDPR rights or make any privacy request, write to the addresses above or use the Contact page.
2. Categories of data
Depending on how you interact with the site, we may process: • Browsing data: IP address, connection technical data and system logs that the hosting provider may collect for security and service operation; • Identity and contact data: name, email, phone, company/body, role; • Message content: request text, project briefs, information about works and applications; • Application data: role of interest and any further information you voluntarily provide; • Consents: record of privacy consent and, if given, consent to informational communications. Attachments (CVs, project documents) are processed only if upload is enabled on the site and only to the extent strictly necessary.
3. Purposes and legal bases
Data are processed for the following purposes: a) Responding to contact and information requests — legal basis: pre-contractual steps at the data subject’s request (Art. 6(1)(b) GDPR) and/or legitimate interest in handling institutional communications (Art. 6(1)(f) GDPR); b) Assessing project briefs and potential works — legal basis: Art. 6(1)(b) and/or (f) GDPR; c) Managing applications (including spontaneous ones) — legal basis: Art. 6(1)(b) GDPR and, where required, consent (Art. 6(1)(a) GDPR); d) Complying with legal obligations — legal basis: Art. 6(1)(c) GDPR; e) Sending informational communications about company activity, only if specific revocable consent is given — legal basis: Art. 6(1)(a) GDPR; f) Ensuring security, integrity and proper operation of the site — legal basis: Art. 6(1)(f) GDPR. No automated profiling is carried out to take decisions producing legal effects or similarly significant impacts. No behavioural marketing or personalised advertising tools are active on the site.
4. Nature of provision
Providing data in the forms is optional, but necessary to handle the request. Without the required fields (including required consents), the communication cannot be submitted or processed correctly.
5. Processing methods
Data are processed by electronic means and, where needed, on paper, according to logic related to the stated purposes and with appropriate technical and organisational measures to reduce risks of unauthorised access, loss or unlawful use.
6. Recipients and processors
Data may be accessed by authorised personnel of ECOS SI.S.MA. SRL within their assigned duties. Data may also be disclosed to third parties providing instrumental services (e.g. hosting, site maintenance, email services, technical or professional advisers), appointed as processors under Art. 28 GDPR where required. Data are not publicly disseminated. They may be disclosed to public authorities or entitled parties only where required by law.
7. Transfers outside the EU/EEA
If tools or infrastructure involve a transfer of data outside the EU/EEA, the controller adopts the safeguards under Chapter V GDPR (e.g. adequacy decisions, standard contractual clauses or other permitted measures).
8. Retention
Data are kept only for as long as necessary for the purposes collected: • contact / brief requests: up to 24 months after the matter is closed, unless further needs related to pre-contractual relations or disputes arise; • applications: up to 12 months from receipt, unless otherwise agreed or the relationship continues; • legal obligations: for the periods required by applicable law; • marketing consents (if given): until consent is withdrawn. After these periods, data are deleted or anonymised, unless a different legal need applies.
9. Data subject rights
Where provided by the GDPR, you may exercise rights of: • access (Art. 15); • rectification (Art. 16); • erasure (Art. 17); • restriction (Art. 18); • portability (Art. 20); • objection (Art. 21); • withdrawal of consent where processing is based on consent, without affecting the lawfulness of prior processing. Requests may be sent to amministrazionecosismasrls@gmail.com, PEC ecossismassrls@pec.buffetti.it or via the Contact page. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
10. Minors
The site and related services are not intended for persons under 18. The controller does not knowingly collect minors’ data. If such data are found to have been provided without appropriate authorisation, they will be deleted promptly.
11. Cookies and similar technologies
For information on cookies and tracking technologies used by the site, see the Cookie notice on the dedicated page.
12. Changes
This notice may be updated for organisational or regulatory reasons. The current version is always the one published on this page, with the last-updated date indicated.