PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA by Impresoft Engage S.r.l.

pursuant to Article 13 of Regulation (EU) 2016/679

This notice is provided in accordance with the European General Data Protection Regulation (EU) 2016/679 (“GDPR”) and any subsequent amendments and/or additions, as well as applicable national laws or regulations governing the processing of personal data from time to time (“Privacy Legislation”), to ensure that the processing of personal data is carried out in a manner that respects the rights and freedoms of individuals, with particular regard to the protection of personal data.

The term“personal data” refers to any information relating to an identified or identifiable natural person, even indirectly, by reference to any other information, including a personal identification number.

The term“processing”means any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or any other form of making available, alignment or combination, restriction, erasure, or destruction.

The term“data subject”refers to the natural person to whom the personal data relates.

Impresoft Engage S.r.l. — with registered office at , Via Vecchia Ferriera, 5 (VI), and VAT No. 03184500241 — acts as the data controller (“Controller”or“Impresoft Engage”) for the purposes set forth in paragraph 3 below and is part of the Impresoft Group. The list of companies belonging to the Impresoft Group is available in the following section of the Impresoft S.p.A. website https://www.impresoftgroup.com/it/gruppo (“Group Companies”).
The Data Controller can be contacted at the following email address: privacy@impresoftengage.com.

Pursuant to Article 37 of the GDPR, the Data Controller has also appointed a Data Protection Officer (“DPO”), who can be contacted at the following email address: dpo@impresoft.com.

The data processed by the Data Controller and collected directly from the website https://www.impresoftengage.com/ may include personal information and contact information (first name, last name, email address, phone number, address, job title, company name, resume, and information regarding professional experience in the case of a job application, as well as any other information voluntarily provided by the data subject).

The Data Controller may process the data subject’s personal data for the following purposes:

1. Purposes strictly related to and necessary for the establishment and management of a contract to which the data subject is a party, pursuant to Article 6(1)(b) of the GDPR. The provision of personal data does not require consent but is necessary to enter into, perform, or continue the contractual relationship with the Data Controller.
2. Management of relationships with the data subject arising from their requests to access additional content (white papers, gated content) offered on the Data Controller’s website. The provision of personal data is not mandatory; however, refusal to provide such data may prevent the data subject from obtaining the requested services, products, and/or content, or from receiving the features, information, and informational materials requested from the Data Controller. The provision of personal data does not require consent, as the processing is necessary to fulfill a contract to which the data subject is a party, as provided for in Article 6(1)(b) of the GDPR.
3. Through profiling cookies—if accepted by the user via the appropriate cookie banner—profiling activities are carried out, consisting of the analysis of users’ interests and preferences regarding the type of content downloaded from the website, in order to conduct targeted marketing. The provision of data is not mandatory, and its processing requires the data subject’s consent . Such data will be accessed and processed by other Group companies only if the consent referred to in point 9) below has been provided.
4. Response to requests for information made by the data subject to the Data Controller. The provision of personal data does not require consent, as the processing is necessary to implement pre-contractual measures taken at the request of the data subject pursuant to Article 6(1)(b) of the GDPR.
5. Compliance with legal obligations, regulations, EU legislation, and provisions issued by authorities legitimated by law or by supervisory and regulatory bodies pursuant to Article 6(1)(c) of the GDPR. The provision of personal data for the purposes set forth in this section is mandatory, and the related processing does not require consent.
6. Purposes of anonymous business analysis: to improve operations and services (e.g., measuring customer satisfaction with the quality of services provided and the activities carried out by the Data Controller, and conducting market studies and research). The provision of personal data is not mandatory, and its processing does not require consent due to the Data Controller’s legitimate interest in conducting business analysis pursuant to Article 6(1)(f) of the GDPR.
7. Marketing purposes for the promotion and sale of products and services similar to those already purchased by the data subject (so-called “soft spam”), through commercial communications sent via email. Providing data is not mandatory, and its processing does not require consent because the Data Controller has a legitimate interest, pursuant to Article 6(1)(f) of the GDPR, in conducting marketing activities toward its customers.
8. Own marketing purposes: using automated contact tools (such as automated calls and email) or traditional contact methods (calls with an operator), either directly or through third-party companies, with regard to its own products and services i) to transmit and/or offer, by telephone, informational, commercial, advertising, and promotional material—including personalized content or content of specific interest based on information obtained through the activities described in point 3 above; ii) to send newsletters and invitations regarding events and initiatives. Providing data is not mandatory, and its processing requires consent, which may be granted or revoked—even for only some of the aforementioned activities—by writing to the email address listed below. If the data subject fails to provide personal data, they will not be able to receive information about the products and/or services offered by the Data Controller; however, this will not affect the data subject’s ability to browse the website or any existing contractual relationship with the Data Controller.
9. Disclosure of data to Group Companies which, with regard to their own products and services and those of Group Companies operating in the ICT and consulting sectors, may—using automated contact methods (such as automated calls and email) or traditional contact methods (calls with an operator)— either directly or through third-party companies, i) send and/or offer, by telephone, informational, commercial, advertising, and promotional materials—including personalized content or content of specific interest —based on the information obtained as a result of the activities described in point 3 above; and ii) send newsletters and invitations regarding events and initiatives. The provision of data is not mandatory, and its processing requires the consent of the data subject , which may be revoked at any time without affecting the processing carried out prior to the revocation.
10. Website management (statistical analysis). The provision of personal data is not mandatory, and its processing does not require consent, as the Data Controller has a legitimate interest, pursuant to Article 6(1)(f) of the GDPR, in managing its website.
11. Recruitment and personnel selection activities. The provision of personal data is not mandatory; however, refusal to provide such data may prevent the Data Controller from evaluating the data subject’s professional profile for the purpose of establishing an employment relationship. Such processing does not require the data subject’s consent , as it is necessary for the implementation of pre-contractual measures taken at the data subject’s request pursuant to Article 6(1)(b) of the GDPR.
12. Disclosure of candidates’ data to Group companies for the purpose of personnel recruitment and selection by such companies. The processing of such data requires the data subject’s consent, which may be revoked at any time without affecting the processing carried out prior to the revocation.
13. Legal defense: if necessary to establish, exercise, or defend the Data Controller’s rights in court. The provision of personal data is mandatory, and the related processing does not require consent due to the Data Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR.
14. Sending of marketing newsletters by the Data Controller to the email address provided by the data subject in the designated section of the website. The provision of data is optional, and its processing requires the data subject’s consent, which is necessary to receive the newsletter service from the Data Controller.
15. Tracking of email communications: Impresoft S.p.A. and the Group companies may use, via the HubSpot platform, tracking technologies in email communications to detect the opening of messages and interactions with their content for all email communications. The provision of data regarding the opening of messages and interactions with their content is not mandatory, and the processing of such data requires the data subject’s consent. Consent is collected and applies uniformly to all of the aforementioned Companies: once granted, it enables tracking for all Group email communications falling within the scope indicated above and cannot be modified or revoked separately with respect to individual Companies. Consent may be revoked at any time, resulting in the deactivation of tracking for all of the Group’s email communications, without affecting the lawfulness of processing based on consent given prior to revocation.

4. Location and Methods of Personal Data Processing

In relation to the stated purposes, personal data is processed using manual, computerized, and telematic tools, with logic strictly related to those purposes and, in any case, in a manner that ensures the security and confidentiality of the data.

Impresoft Engage will process the data subject’s personal data exclusively through technical staff designated for such processing, using primarily automated and computerized methods suitable for ensuring—in relation to the purposes for which the data are processed—the security and confidentiality of the data, as well as for preventing unauthorized access to the data. Impresoft Engage does not carry out automated decision-making processes.

The processing of the collected data takes place at the offices of Impresoft Engage and at the offices of service providers identified and appointed by Impresoft Engage, who, where necessary, act as data processors pursuant to Article 28 of the GDPR.

The data collected and processed on the website is stored in the Data Controller’s CRM—which resides on the SugarCRM server—as well as in the CRM shared by the Group companies, which resides on the HubSpot server located in Europe (“HubSpot CRM”).

The data subject’s personal data will be retained only for as long as necessary to achieve the purposes for which it is collected, in accordance with the principle of data minimization pursuant to Article 5.1.c) of the GDPR.

In particular, with regard to processing for marketing purposes, the data will be processed and retained until the data subject revokes their consent. In any case, the data subject may always request the cessation of processing or the erasure of their data, as provided below. Data relating to the opening of messages and interactions with their content will be processed and retained for the same period as data processed for marketing purposes.

The Data Controller may retain certain data even after the termination of the relationship, depending on the time required to fulfill specific contractual or legal obligations, as well as for administrative, tax, and/or social security purposes—for the period required by applicable laws and regulations, as well as for the time necessary to assert any rights in court.

In any case, data is processed not only in compliance with current legislation but also in accordance with the principles of confidentiality that have always guided the Data Controller.

Retention periods will vary depending on the type of data processed, but, in general, Impresoft Engage refers to these criteria to determine the retention period:

• Whether there is a legal or contractual requirement to retain the data.
• Whether the data is necessary to provide its services.
  
  

The Data Controller may disclose the data subject’s personal data to third parties in compliance with legal obligations and to service providers who will act as independent Data Controllers or will be designated as Data Processors pursuant to Art. 28 of the GDPR should they process data on behalf of the Data Controller; these entities essentially fall into the following categories, listed by way of example and not as an exhaustive list:

• entities that provide banking services, including those involved in the management of payment systems;
• individuals, companies, associations, or professional firms that provide services or assistance and consulting to the Data Controllers, with particular but not exclusive reference to matters relating to accounting, administration, law, taxation, finance, and commerce;
• business, marketing, and legal partners; providers of technical services and/or software platforms; system administrators; hosting providers; IT companies; and communications agencies;
• entities that perform control, audit, and certification functions with respect to the activities carried out;
• Group companies that provide IT services;
• all Group companies, only if the data subject has given consent for the purposes set forth in points 9) and/or 12) of paragraph 3 above;
• all Group companies, only if necessary to fulfill a request made by the data subject as indicated in point 4) of paragraph 3 above.

The updated list of entities to which the data subjects’ personal data may be disclosed and/or transferred is available from Impresoft Engage by contacting us at: privacy@impresoftengage.com.

Any transfer of data to third countries outside the EU for the purposes indicated in paragraphs 3 and 4 above may take place in accordance with the procedures permitted by applicable law and, in particular, based on the provisions of the GDPR, specifically: i) Article 44 – General principle for transfers; (ii) Article 45—Transfer based on an adequacy decision; (iii) Article 46—Transfer subject to appropriate safeguards; (iv) Article 49—Derogations in specific situations.

The data subject’s data is shared, subject to specific consent, with Group Companies in the HubSpot CRM. Among the Group Companies is Kipcast Corp, which is headquartered in Canada. The transfer of data to this company is guaranteed by European Commission Adequacy Decision 2002/2/EC of December 20, 2001, pursuant to Directive 95/46/EC of the European Parliament and of the Council regarding the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act.

Pursuant to Articles 15–22 of the GDPR, data subjects are granted specific rights. In particular, the data subject may obtain from the Data Controller: access to, rectification of, erasure of, restriction of processing, withdrawal of consent, and portability of the data concerning him or her. The data subject also has the right to object to processing on legitimate grounds and/or for commercial purposes.

The Data Controller undertakes to respond to the data subject as soon as possible after verifying their identity, where necessary.

In the event that the right to object is exercised, the Data Controller reserves the right not to comply with the request—and therefore to continue processing—if there are compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subject.

With regard to marketing purposes, this is without prejudice to the right of the data subject who has provided consent:

• to request, at any time and free of charge, to receive communications exclusively through traditional contact methods, such as calls handled by an operator;
• to object, at any time and free of charge, to the processing of data for the aforementioned purposes. In this case, the right to object to the processing of data through automated contact methods (such as emails and automated phone calls) extends to traditional contact methods (such as calls via an operator);
• to object, at any time and free of charge, to the processing of data for the aforementioned purposes only in part—that is, by specifying a preference regarding the methods of contact.

The above rights may be exercised by sending a written notice to the following email address addressed to the Data Controller: privacy@impresoftengage.com.

The data subject is hereby informed that, pursuant to Article 12 of the GDPR, if the data subject’s requests are found to be manifestly unfounded or excessive—in particular due to their repetitive nature—the Data Controller may: a) charge a reasonable fee, taking into account the administrative costs incurred in providing the information or communications or taking the requested action; or b) refuse to comply with the request.

The data subject also has the right to file a complaint with the Italian Data Protection Authority.

This website may contain links to other websites. However, once the data subject uses these links and leaves this website, Impresoft Engage will have no control whatsoever over those other websites. Impresoft Engage shall not be liable in any way for the protection and confidentiality of the information you provide when visiting such other sites. We recommend that you carefully read the privacy policy applicable to the site in question.

Impresoft Engage reserves the right to make changes to this policy at any time by notifying data subjects on this page. If a data subject does not accept the changes made to this policy, they must stop using this website and may request that Impresoft Engage delete their personal data.

Last updated: October 2026