Data Protection Notice - Website

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679

Version 03, June 2026

1.    Introduction

Archiva Group, a brand owned by Archiva S.r.l. (a single-member company), which comprises the companies listed in Annex A to this notice, hereby informs you about the processing of your personal data carried out via the website https://www.archivagroup.com/ (hereinafter referred to as the “website” or “site”). Throughout this policy, Archiva Group may be referred to simply as “Archiva” or, where a specific provision relates solely to a single legal entity within Archiva Group, by the short name of the company to which that provision refers.

This website may include plugins, links to social networks or platforms for the distribution of audiovisual content. Interaction with these elements means that certain data may be transmitted to the provider of the plugin, social media platform or content platform, in order to enable the necessary use of the content available there. The privacy policies regarding the processing of personal data carried out by the aforementioned providers can be found on their respective websites.

2.    Data Controller

With regard to personal data processed via the website, Archiva acts as the Data Controller, in accordance with Article 4(7) of Regulation (EU) 2016/679 (hereinafter the “GDPR”).

However, in specific operational scenarios, Archiva may process personal data on behalf of other companies, or vice versa, acting as a Data Processor pursuant to Article 28 of the GDPR. Such cases include, for example, the provision of infrastructure services, the technical management of the website, or the hosting of online forms and platforms. The roles between the companies within the Archiva Group are formalised through internal joint-controller agreements or appointments as Data Processors, signed between the parties, which transparently regulate their respective responsibilities. The up-to-date list of processing operations for which a Data Processor role is envisaged may be requested from each company via the contact details provided below in this notice.

3.    Joint controllership

Certain processing of personal data carried out via the website may be performed jointly by Archiva and the other companies within the Archiva Group, acting as joint controllers, in accordance with Article 26 of the GDPR. Joint controllership is formalised through internal agreements which transparently govern the respective responsibilities regarding the obligations arising from the GDPR, with particular reference to the exercise of the data subject’s rights and the methods of data processing.

By way of example, the following fall within the scope of joint processing:

  • the joint organisation and management of events, webinars and promotional initiatives published on the website;
  • the analysis of aggregated statistical data arising from the use of shared digital platforms;
  • the handling of contact requests received via the website, where these are addressed to more than one company.

The data subject may obtain further information on the content of the joint controller agreements and exercise their rights under Articles 15 to 22 of the GDPR in relation to each Joint Controller, using the contact details set out in Annex A to this notice.

4.    Purposes, legal basis and duration of processing

The processing of personal data collected via the website serves the following possible purposes:

Purposes of processing Type of data subject Categories of data processed Legal basis for processing Duration of processing
a)    provision of services accessible via the website (e.g. responding to requests made by the user, requests to participate in webinars or in-person events) Prospects, i.e. individuals who may potentially enter into a contractual relationship in the future because they are interested in the data controller’s product or service offerings

Customer (whether a natural or legal person), i.e. the party who uses a product or service provided by the Data Controller pursuant to an existing contractual relationship;		 General data: first name, surname, email address, telephone number Article 6.1.b: processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the data subject’s request.

for a maximum of 12 months from receipt of the Prospect’s request;

for the entire duration of the existing contractual relationship with the Customer;
b)    to enable website users, subject to their consent and until such consent is withdrawn, to learn about and find out more regarding the activities, events and other commercial initiatives organised or carried out by the Data Controller. Common data: first name, surname, email address, telephone number Articolo 6.1.a: the data subject has given consent to the processing of their personal data for one or more specific purposes; for a maximum of 24 months from the date on which consent was given or from the last documented interaction.
c)    within the limits and solely for the purpose of recruitment, management and contact regarding the application for the job position selected in the relevant field; Applicants General data: first name, surname, email address, telephone number, CV, including any special categories of personal data that may be contained therein. Articolo 6.1.b: processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the data subject’s request. for a maximum of 12 months from the date of the first interview with the Data Controller;
d)    to enable the HR department to contact you regarding any future job vacancies offered by the Data Controller. Candidates
e)    for the monitoring of open and closed vacancies within the company, including details of interview arrangements, their outcomes and the identification of candidates who have already been interviewed; Candidates Articolo 6.1.f: the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not override those interests, in particular where the data subject is a child. for a maximum of 36 months from the date of the first interview with the data controller.
f)    provision of the website and its content; All General data:
IP address

Articolo 6.1.a: the data subject has given consent to the processing of their personal data for one or more specific purposes;

Articolo 6.1.f: the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

 Please refer to the cookie policy.
g)    Recording of telephone calls for the purpose of improving the services provided, as well as commercial and technical support; Customers Prospect Personal data collected during telephone contacts is immediately anonymised and not made available to the Data Controller. The transcript of the conversation, thus anonymised, remains associated with the data subject.

Articolo 6.1.f: processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

for a maximum of 12 months from receipt of the Prospect’s request;

for the entire duration of the existing contractual relationship with the Customer;

5. Nature and methods of processing

Archiva Group declares that access to the website requires the provision of personal data, which will be processed in compliance with the applicable national and supranational regulations governing ‘personal data protection’.

In accordance with the aforementioned laws, the processing carried out by Archiva Group will be based on the principles of fairness, lawfulness and transparency, safeguarding the rights and freedoms of data subjects.

The provision of personal data is optional; however, providing only some of the data or failing to provide it at all may prevent the website from functioning correctly or the data subject’s requests from being met.

The Website does not contain any information intended directly for minors; therefore, this category of data subjects must not provide any personal data to the Data Controller via the data request forms on the Website.

This privacy notice does not apply to websites other than the one explicitly mentioned.

Data processing is carried out using appropriate technical and organisational measures, in line with the principles of data protection by design and data protection by default. Archiva carries out regular security checks and has obtained numerous third-party certifications, which can be viewed at https://www.archivagroup.com/it/archiva/sicurezza-e-privacy

Personal data is processed primarily at the Data Controller’s premises and will not be transferred to countries outside the EU.

6. Categories of persons who may become aware of personal data

Personal data processed by Archiva Group may be disclosed to employees or contractors of the Data Controller, for processing within their respective areas of responsibility; these individuals, operating under the direct authority of the Data Controller and in compliance with specific security measures provided to them, will process personal data in accordance with data protection principles.

Personal data may also be disclosed to any Data Processors appointed pursuant to Article 28 of the GDPR who, acting under the direct authority of the Data Controller, will receive appropriate instructions. The same will apply to any Data Processors in relation to their employees or staff members.

Please also note that personal data may be disclosed to parties essentially falling within the following categories; a full list of these may be requested from the Data Controller via the contact details set out in Annex A to this policy:

Companies or other entities carrying out outsourced activities on behalf of Archiva Group: for website management and/or development, support, communication, event organisation and management, providers of video-conferencing software solutions, and operators of electronic platforms for sending marketing campaigns and newsletters;

  • Recruitment agencies: for activities falling within their remit;
  • Certification bodies and accreditation bodies: for audit activities carried out with a view to obtaining and/or maintaining the certifications held by Archiva Group.

7.    Data Protection Officer (DPO)

Archiva Group has appointed a Data Protection Officer who can be contacted by email at the following address: dpo.privacy@archivagroup.it.

The following is a non-exhaustive list of situations in which the DPO may be contacted and/or should be contacted:

  • if you wish to exercise a right recognised by the European General Data Protection Regulation;
  • if you wish to contest the rejection of a request to exercise a right, or if you consider that the response was unsatisfactory or was not provided within the specified timeframe;
  • if you believe that your personal data has been breached during processing carried out by the Data Controller or the Data Processor;
  • if you believe that the information provided to you is not sufficiently clear and transparent;
  • if you consider it necessary to receive clarification or further details regarding the processing of your personal data (purposes, legal basis, retention periods, methods of processing, etc.);
  • if you need information in order to lodge a complaint with the supervisory authority.

8. Rights of the data subject

The data subject may, at any time, exercise their rights vis-à-vis the Data Controller in accordance with Articles 15 to 21 of the GDPR, the full text of which is hereby incorporated by reference.

The data subject shall have the right to request from the Data Controller access to their personal data, the rectification or erasure of such data, or to object to their processing; they shall also have the right to request the restriction of processing, as well as to obtain, in a structured, commonly used and machine-readable format, the data concerning them. Furthermore, the data subject may, at any time, withdraw their consent for processing operations based on that legal basis, without this affecting the lawfulness of any processing carried out on the basis of consent prior to the withdrawal.

Finally, the data subject may lodge a complaint with the competent supervisory authority if they consider that their rights have not been respected, in breach of the principles of the GDPR, in accordance with the procedures set out, for example, on the Data Protection Authority’s website, accessible at www.garanteprivacy.it

These rights may be exercised by completing the relevant form available on the website http://www.archivagroup.com/ or by sending a message to the certified email address privacy@pec.archivagroup.it (which can also be reached via standard email).

9.    Changes to the privacy notice

This privacy notice may be subject to updates in accordance with national and European regulatory provisions, as well as by virtue of operational decisions made by the Data Controller. Unless otherwise specified, it will continue to apply to personal data processed up to that point. In the event of significant changes to the privacy notice, notification will be provided via a banner on the website or a direct email, where applicable.