On this page

NOTICE ON THE PROCESSING OF PERSONAL DATA pursuant to Article 13 of Regulation (EU) 2016/679 (“Privacy Policy”)
A. DATA CONTROLLER
B. DATA PROTECTION OFFICER (DPO)
C. TYPES OF DATA COLLECTED, PURPOSES, LEGAL BASIS AND RETENTION PERIODS
D. RECIPIENTS OF THE DATA
E. DATA TRANSFER
F. RIGHTS OF DATA SUBJECTS
NOTICE TO CUSTOMERS AND SUPPLIERS – PURSUANT TO ART. 13 OF THE EUROPEAN REGULATION

NOTICE ON THE PROCESSING OF PERSONAL DATA pursuant to Article 13 of Regulation (EU) 2016/679 (“Privacy Policy”)

This notice is provided pursuant to Regulation (EU) 2016/679 (hereinafter the “Regulation” or “GDPR”) and describes how the personal data of users who visit and use this website, accessible at https://dotenv.it/en (hereinafter also the “Site”), or who use the services offered through the Site, is processed. In accordance with the European Regulation on the protection of personal data no. 679/2016 (“GDPR”) currently in force, collection and processing will always follow the principles of lawfulness, fairness and transparency. When the Site is visited, data relating to the user who accesses it may be processed (the user is referred to as the “data subject”, being an identified or identifiable natural person).

A. DATA CONTROLLER

The Data Controller is dotenv S.R.L. Ferrara (FE), Via L.V. Beethoven 15/C 44124 Ferrara (FE), VAT no. 02062960386, which can be contacted at the email address: info@dotenv.it

B. DATA PROTECTION OFFICER (DPO)

The Controller has appointed a Data Protection Officer, whom you may contact to exercise one of your rights, to make a report or simply to obtain information on the processing of your data. To contact the DPO you can use the following contact details: massimo.dimenna@ingpec.eu ; massimo.dimenna@gruppoingegneria.it

C. TYPES OF DATA COLLECTED, PURPOSES, LEGAL BASIS AND RETENTION PERIODS

1. Browsing Data

Personal Data may be collected by the Controller on its own or through third parties. In this case, the IT systems and software procedures used to operate this Site acquire some Personal Data of Users, of a technical nature (e.g. the IP address, the type of browser used, the operating system, the domain name and the addresses of the websites from which the Site was accessed or left, etc.), whose transmission is inherent in the normal functioning of the internet.

Purpose: these Data may be processed for the sole purpose of obtaining anonymous statistical information on the use of the site and/or to check that it is working correctly.

Retention: these Data will be deleted immediately after processing.

Legal Basis: processing is carried out on the basis of the Controller’s legitimate interest in making the Site usable and browsing it secure (Art. 6, para. 1, letter f). Exclusively for the specific activity of profiling, the express consent of the data subject (Art. 6, para. 1, letter a).

2. Contact by the user via email, telephone or by filling in the form

The optional, explicit and voluntary sending of communications by email to the addresses indicated on this site entails the subsequent acquisition of the data communicated by the user, including their email address, and consent to receive any messages replying to their requests.

The Site’s contact form collects: name, company, email address, telephone number (optional), the text of the request, the budget range, any attached document and, if the user states it, how they came to know the Controller. Together with the message, the date, the page from which it was sent, the address of the referring page communicated by the browser and the type of browser are recorded. The data is stored on Amazon Web Services servers located in Italy (Milan region), is forwarded by email to the Controller’s mailbox, and the user receives a confirmation email at the address provided.

In this case, providing the email address and any other data indicated is optional, but essential in order to use the service and receive a reply to your request; without them, we will not be able to proceed with processing it.

Purpose: the personal data provided in this way is used for the sole purpose of fulfilling or responding to the requests submitted and is communicated to third parties only where this is necessary for that purpose.

Retention: the data is kept for the period necessary to deal with the request and in accordance with the legislation in force.

Legal Basis: processing is carried out for the performance of a contractual and pre-contractual obligation undertaken by the Controller with the service (Art. 6, para. 1, letter b).

3. Sending a curriculum vitae through the “Work with us” section

Providing personal data for the purposes indicated is necessary to ensure the specific feature on the site for correctly submitting an application in order to take part in any personnel selection processes. The Candidate’s data collected by the Controller for this purpose includes: first name, surname, email address, telephone number and all the personal information and personal data that may be voluntarily included in the CV and in the free-text field of the application form uploaded by the Candidate. The form and the CV follow the same path described in point 2: they are stored on Amazon Web Services servers located in Italy and forwarded by email to the Controller’s mailbox. No other processing will be carried out by the Controller in relation to Candidates’ personal data.

Purpose: the personal data provided in this way is used for the purposes of recruitment and personnel selection, or to propose other job offers consistent with the candidate’s professional profile (pre-contractual obligations), and for the fulfilment of specific obligations or the performance of specific tasks provided for by laws, regulations or Community legislation (legal obligation).

Retention: personal data relating to the profiles of any candidates for open positions is kept for the time strictly necessary to ensure that the selection procedures are properly carried out. The personal data of candidates not considered suitable for any position is deleted within a final time limit of 14 (fourteen) days from the moment the Controller considered the candidate unsuitable for the open position. The personal data of candidates considered suitable for other open positions is kept for the time strictly necessary to ensure that the selection procedures are properly carried out and, if the outcome regarding suitability for the other positions is negative, it is deleted within a final time limit of 12 (twelve) months.

Legal Basis: processing is carried out for the performance of a contractual and pre-contractual obligation undertaken by the Controller with the service (Art. 6, para. 1, letter b).

4. Newsletters and commercial/promotional communications.

Where explicitly requested by the user, it is possible to provide one’s contact details in order to receive commercial and/or informational communications about the Controller’s activity. Providing such data for these purposes is entirely optional but essential in order to supply the promotional information service described above. The company collects emails and your data, for example, at events and trade fairs. To send you newsletters we use this tool: Odoo.

Anyone who requests a guide or another document from the Site states their name, company and email address, to which the document is sent. The form asks for two separate consents: the first, required, to receive the document; the second, optional, to be contacted again with commercial and informational communications. Only those who give the second consent are added to the recipients of these communications, and consent can be withdrawn at any time by writing to the Controller.

Purpose: the personal data provided in this way (first name, surname, telephone number, email address, company) is used for the sole purpose of fulfilling or responding to the requests submitted and is communicated to third parties only where this is necessary for that purpose and only after the data subject has given explicit consent.

Retention: the data is kept for the period necessary to carry out the activity for which it was provided and in any case, specifically for the purposes described above, for no longer than two years as expressly provided for by law (unless consent is renewed by the data subject or the data is used for other purposes as provided for by the legislation in force).

Legal Basis: processing is carried out on the basis of the explicit consent of the data subject (Art. 6, para. 1, letter a).

5. Links to other websites

The Website may include hyperlinks to other websites. By clicking on one of these links, the user may be redirected to another website or another Internet source that may collect information about the user through cookies or other technologies. The Controller assumes no responsibility for, and has no supervisory authority over, these other websites or Internet resources, nor over their collection, use and disclosure of the user’s personal data. Users should check the privacy statements of these other websites and Internet sources in order to judge whether they act in compliance with privacy legislation.

6. Integration of social media plugins

The Site does not embed plugins, buttons or content from social networks. The footer contains only links to the Controller’s pages on LinkedIn, Instagram and Facebook: these are ordinary links, which transmit no data to the social network until the user selects them. Once on the social network’s site, processing is governed by that service’s privacy notice.

7. Cookies

The Site uses one technical cookie, which remembers the user’s choice on cookies, and, only after explicit consent, the measurement cookies of Google Analytics 4, the Meta pixel and Microsoft Clarity, which records how the pages are used (clicks, mouse movements, scrolling) with form fields masked. Before the choice is made, no third-party script is loaded. For the list of cookies, their duration and how to change your choice, see the cookie policy.

D. RECIPIENTS OF THE DATA

The personal data collected is processed by the Controller’s staff, who act with specific authorisation, on the basis of specific instructions given regarding the purposes and methods of the processing.

In addition, the parties designated as data processors pursuant to Art. 28 of the GDPR, or sub-processors, which the Controller uses to provide the services and to carry out the activities within its remit, may be recipients of the data collected following a visit to the Site or use of the services, within the limits of their respective mandate. These include: Amazon Web Services, which hosts the Site, stores the messages sent through the forms on servers located in Italy (Milan region) and sends the confirmation emails; Microsoft, for the Controller’s email mailbox that receives the messages; and, only after consent to the measurement cookies, Google, Meta and Microsoft (for the Clarity service), as described in section E. The full list can be requested from the Controller using the contact details in section A. Where, through the services offered by the site, a data processor pursuant to Art. 28 of the GDPR or a sub-processor is designated, the data will be communicated to its own Data Controller and/or its own data processor.

E. DATA TRANSFER

No transfer abroad of the personal data provided is envisaged, with one exception, and only after explicit consent: if the user accepts the measurement cookies, the scripts of Google (Google Analytics 4), Meta (pixel) and Microsoft (Clarity) are loaded and the data described in the cookie policy is processed by companies based in the United States. The IP address is anonymised before it reaches Google and Google’s advertising signals are switched off. Before the choice is made, no script is loaded and no data is transferred; the choice can be changed at any time from the cookie policy.

F. RIGHTS OF DATA SUBJECTS

Data subjects – the identified or identifiable natural persons to whom the data refers – may exercise specific data protection rights, set out in the following list:

a) right of access: the right to obtain from the Controller confirmation as to whether or not personal data is being processed and, if so, to obtain access to the personal data and detailed information regarding the origin, the purposes, the categories of data processed, the recipients of communication and/or transfer of the data, and more;

b) right to rectification: the right to obtain from the Controller the rectification of inaccurate personal data without undue delay, as well as the completion of incomplete personal data, including by providing a supplementary statement;

c) right to erasure (“right to be forgotten”): the right to obtain from the Controller the erasure of personal data without undue delay where: i. the data is no longer necessary in relation to the purposes of the processing; ii. the consent on which the processing is based is withdrawn and there is no other legal ground for the processing; iii. the personal data has been processed unlawfully; iv. the personal data must be erased to comply with a legal obligation;

d) right to object to processing: the right to object at any time to the processing of personal data whose legal basis is a legitimate interest of the Controller;

e) right to restriction: the right to obtain from the Controller the restriction of processing where the accuracy of the personal data is contested (for the period necessary for the Controller to verify the accuracy of such personal data), if the processing is unlawful and/or the data subject has objected to the processing;

f) right to data portability: the right to receive the personal data in a structured, commonly used and machine-readable format and to transmit such data to another Data Controller, where technically feasible, only in cases where the processing is based on consent or on a contract and only for data processed by electronic means;

g) right to lodge a complaint with the supervisory authority: without prejudice to any other administrative or judicial remedy, a data subject who considers that the processing concerning them infringes the Regulation has the right to lodge a complaint with the supervisory authority of the Member State in which they habitually reside or work, or of the State in which the alleged infringement occurred.

The rights can be exercised by contacting the Controller using the contact details given in sections A and B, repeated here:

– Data Controller info@dotenv.it

– DPO massimo.dimenna@gruppoingegneria.it

This notice was last updated on 30/09/2026.

NOTICE TO CUSTOMERS AND SUPPLIERS – PURSUANT TO ART. 13 OF THE EUROPEAN REGULATION

In accordance with the Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (Regulation (EU) of the European Parliament and of the Council of 27 April 2016, no. 2016/679/EU – GDPR).

1. Data Controller

The Data Controller is dotenv S.R.L. Ferrara (FE), Via L.V. Beethoven 15/C 44124 Ferrara (FE), VAT no. 02062960386, which can be contacted at the email address: info@dotenv.it

Data processed: master data, identification data of the natural persons who collaborate and interact with the Data Controller by virtue of the contractual relationship in place with it, contact details such as telephone number, personal or general departmental email, addresses, accounting, financial, administrative and banking data, as well as any necessary information provided by you that is needed to perform the contract.

2. Purposes of processing and Legal Basis

The personal data you provide will be processed for purposes connected with the performance of the contract, including any pre-contractual phase, and specifically for compiling master data lists, keeping the accounts, invoicing, sending communications by both paper and electronic means, tax compliance, the organisational management of the services requested and the signing of contracts, the scheduling of appointments, order fulfilment, deliveries, and the administrative formalities relating to the services requested under the supply relationship.

The Data you provide is processed for the following purposes:

a) for the fulfilment of the contractual obligations arising from the contract signed with you and for the protection of the Data Controller’s contractual rights, including the sending of communications relating to the contractual agreements made and for their performance. The legal basis for the processing is the contractual relationship as provided for by Art. 6 letter b)

of the European Regulation;

b) the fulfilment of the legal obligations laid down by law for the requirements of tax and fiscal legislation. The legal basis for the processing is the contractual relationship as provided for by Art. 6 letter c) of the European Regulation. Providing the data is mandatory; refusal to provide the data, or a full objection to its processing for the purposes mentioned, may in any case make it impossible to conclude the contractual relationship with you.

c) the sending of communications by email to the contact details provided to the Controller through the optional and voluntary sending of emails, through telephone contact or during the organisation of trade fairs entails the subsequent acquisition of the data communicated and consent to receive any messages replying to one’s requests. These communications also include emails about initiatives run by the company and invitations to events at which business relationships already begun or under evaluation can be continued.

The personal data provided in this way is used for the sole purpose of fulfilling or responding to the requests submitted and is communicated to third parties only where this is necessary for that purpose. Processing is carried out for the performance of a contractual and pre-contractual obligation undertaken by the Controller with the service (Art. 6, para. 1, letter b).

3. Recipients of the data

Your data may also be communicated to third parties, for technical and operational needs strictly connected with the purposes set out above, and in particular to the following categories of parties:

a) bodies, professionals, companies or other organisations that we have entrusted with the processing connected with the fulfilment of the administrative, accounting and management obligations linked to the ordinary conduct of our business, including for debt recovery purposes;

b) public authorities and administrations, for purposes connected with the fulfilment of legal obligations, or parties entitled to access the data under provisions of law, regulations or Community legislation;

c) banks, financial institutions or other parties to which the transfer of the said data is necessary for carrying out our company’s business in relation to our fulfilment of the contractual obligations undertaken towards you.

d) providers of installation, support and maintenance services for IT and telecommunications equipment and systems, and of all the services functionally connected and necessary for the performance of the services covered by the Contract. The list of data processors is available on request.

4. Data retention periods

We will keep your data in a form that permits identification for a period no longer than is needed to achieve the purposes for which the data was collected; it will therefore be kept for as long as the contractual relationship exists and for no more than 10 years from the termination of the contract (Art. 2946 of the Italian Civil Code, on limitation periods). The data strictly necessary for tax and accounting compliance, once the purpose for which it was collected no longer applies, will be kept for a period of 10 years as laid down by Art. 2220 of the Italian Civil Code.

5. Data transfer

The Data Controller does not transfer personal data to third countries or to international organisations.

6. Rights of Data Subjects