Privacy notice

Obicon provides this notice pursuant to article 13 of EU Regulation no. 679/2016. Last updated: 5 October 2026.

This is a courtesy translation. The Italian version is the authoritative text: in case of any discrepancy, the Italian wording prevails.

Data controller

OBICON S.r.l. (hereinafter, for brevity, “Obicon”), VAT no. 03733490969, with registered office in Saronno (VA), Via San Solutore 39, is the Data Controller, that is, the party that determines the purposes and means of processing the personal data of users acquired through browsing on this site.

Contact details: 02 960 9324 · privacy@obicon.it

Types of data processed

Through browsing on this web page, Obicon processes browsing data, personal data provided voluntarily by the user and personal data collected through cookies, as set out below.

a) Browsing data

The computer systems and software procedures that operate this website acquire, in the course of their normal operation, some personal data whose transmission is implicit in the use of internet communication protocols. This category of data includes:

• the IP addresses or domain names of the devices used by visitors connecting to the site;
• MAC (Media Access Control) addresses;
• the URI (Uniform Resource Identifier) addresses of the resources requested;
• the time of the request;
• the method used to submit the request to the server;
• the size of the file received in response;
• the numeric code indicating the status of the server’s response (success, error and so on);
• and other parameters relating to the user’s operating system and computing environment.

b) Data provided voluntarily by the user

When contacting Obicon through the channels made available on this site (telephone and e-mail), the user transmits personal data that the company will process.

The data subject is asked not to provide personal data revealing their racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, nor their genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation (also referred to as “sensitive data”). Such data will be deleted immediately in the absence of an explicit declaration of consent to their processing.

Likewise, when requesting the “Remote Assistance” service (through TeamViewer), the user transmits the personal data entered in the assistance request, as well as the technical data of the device from which the request is sent.

c) Cookies

The site uses technical cookies to ensure normal browsing and use of the website and to store the user’s consent preferences. For all information about the processing of personal data carried out through cookies, please refer to the cookie notice, which is reachable from every page of the site.

Purposes and legal bases

The browsing data listed under a) are used to:

• to provide the service and monitor that it works correctly, and to obtain anonymous statistical information on the use of the site. The legal basis legitimising this purpose is art. 6(1)(b) GDPR, that is, the need to provide the user with the service requested;
• to comply with obligations under laws or regulations, or with requests from the judicial authorities. The legal basis is art. 6(1)(c) GDPR, that is, the need to comply with a legal obligation to which the Controller is subject;
• to assert or defend a right of Obicon in court. The legal basis is art. 6(1)(f) GDPR, that is, Obicon’s legitimate interest in establishing, exercising or defending a right in legal proceedings.

The data provided voluntarily by the user, listed under b), are processed to:

• to reply to the user’s requests (by e-mail and telephone). The legal basis is art. 6(1)(b) GDPR, that is, the need to provide the user with the service requested;
• to provide remote assistance. The legal basis is art. 6(1)(b) GDPR, that is, the need to provide the user with the service requested;
• to comply with obligations under laws or regulations, or with requests from the judicial authorities. The legal basis is art. 6(1)(c) GDPR.

Data retention period

Personal data collected and processed as a result of browsing this site are kept for the whole period in which the service is provided and in any case deleted or anonymised within 15 days.

Personal data sent independently by users through the tools available on the site will be deleted after the requested service has been provided or a reply has been given, and in any case within a maximum of 15 days from the end of that activity, except for data needed to comply with tax, accounting and administrative rules or other legal obligations and to document the activities carried out.

How data is processed

The personal data collected by Obicon are kept and stored both on electronic media and on paper, organised in databases, and on any other suitable medium. Processing takes place using electronic tools but does not involve automated decision-making. Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorised access.

Provision of personal data

Providing browsing data is a necessary requirement for supplying the requested service (browsing the website) and is therefore mandatory for that purpose: failure to provide personal data will make it impossible for Obicon to allow browsing on this website.

Providing the data supplied voluntarily by the user is a necessary requirement for supplying the requested service (a contact request or “Remote Assistance”) and is therefore mandatory for that purpose: failure to provide personal data will make it impossible for Obicon to reply to the contact requests received from the user and/or to provide remote assistance.

Parties who may come to know the personal data

Obicon may disclose users’ personal data solely and exclusively to the following categories of parties:

• the company’s own staff;
• parties entitled and with an interest in accessing them under provisions of law;
• companies, associations or professional firms that provide services and activities on behalf of the Controller, such as the supply of ICT services (for example web hosting services, cloud providers and so on), compliance with legal obligations, and any organisational and administrative need relating to the activities carried out by the Controller.

The names of the parties who may come to know users’ personal data, as data processors, may be requested from Obicon by writing to the contact details given above.

Transfer of data outside the European Economic Area or to international organisations

Users’ personal data will not be transferred to countries outside the European Economic Area, nor to international organisations.

Applications sent through the site

Through the form on the Careers we collect the data needed to assess the application: name and surname, e-mail, telephone, LinkedIn profile if any, role of interest, covering message and curriculum vitae in PDF format. The curriculum vitae is sent by e-mail to the company function in charge of recruitment and is not stored on the website’s servers. The legal basis is the performance of pre-contractual measures taken at the data subject’s request (art. 6(1)(b) GDPR).

We ask candidates not to include in their curriculum vitae data belonging to special categories (art. 9 GDPR: health, religious beliefs, trade union membership and the like), except where strictly necessary, for example for membership of protected categories under law 68/1999; in that case the processing takes place pursuant to art. 9(2)(b) GDPR and art. 111-bis of the Italian Privacy Code.

To have an application deleted it is enough to write to privacy@obicon.it.

Rights of the data subject

In relation to the processing of personal data governed by this notice, the user may exercise at any time the rights provided for by EU Regulation no. 679/2016 (GDPR).

• Right to be informed of any processing of their personal data (pursuant to art. 13 GDPR). The user has the right to obtain confirmation as to whether or not processing of their personal data is taking place and, in that case, to be informed of every aspect of the processing operations, including, for example, information about: the data processor (that is, the party that processes personal data on behalf of the Controller); any other recipient of the data (to whom the personal data may be disclosed); the purposes and the legal basis; the types of data processed; the data retention period; the transfer of personal data to third countries or international organisations.
• Right of access to their personal data, together with the right to rectify inaccurate data and the right to complete incomplete data.
• Right to erasure (the so-called right to be forgotten) under the conditions laid down in art. 17 GDPR, for example when the personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• Right to restriction of processing to the purposes and/or methods for which their personal data were collected, under the conditions set out in art. 18 GDPR.
• Right to data portability, that is, the right to receive a copy of all the personal data provided to the Controller, or to transmit such data to another Controller without hindrance.
• Right to withdraw consent, where consent was given to legitimise the processing of personal data. This right may be exercised at any time, without affecting the lawfulness of processing based on consent given before its withdrawal.
• Right to lodge a complaint with a supervisory authority, if they believe that the processing concerning them infringes the legislation in force. In that case they should contact the authority of the member state where they habitually reside, where they work, or where the alleged infringement took place. The contact details of the Italian supervisory authority are on the website of the Italian Data Protection Authority (Garante per la protezione dei dati personali).
• Right to object to the processing of personal data where the processing is necessary for the performance of a task carried out in the public interest, is necessary for the pursuit of a legitimate interest of the controller, or is for direct marketing purposes, including profiling.

To exercise the rights listed above, the data subject may send a specific request by e-mail to privacy@obicon.it. Obicon will reply within a maximum of 30 days.