Courtesy translation. This English text is provided for reference only. The Italian version is the only binding text and prevails in case of any difference.

Privacy Policy

The purpose of this document is to inform the natural person (hereinafter the “Data Subject”) about the processing of their personal data (hereinafter “Personal Data”) collected by the controller, TreZeroQuattro S.r.l., single-member company, with registered office at Piazza del Fante 2, 00195 Roma, Tax Code/VAT No. 18715061000, email address admin@trezeroquattro.com, certified email (PEC) address trezeroquattro@namirialpec.it (hereinafter the “Controller”), through the website trezeroquattro.com (hereinafter the “Application”).

Changes and updates will be binding as soon as they are published on the Application. If the Data Subject does not accept the changes made to the Privacy Policy, the Data Subject is required to stop using this Application and may ask the Controller to erase their Personal Data.

1. Categories of Personal Data processed

The Controller processes the following types of Personal Data provided voluntarily by the Data Subject:

• Contact data: first name, surname, email, any further information sent by the Data Subject, etc.
• Application data, namely the data contained in the curriculum vitae, the role of interest, any link to the LinkedIn profile and the accompanying message.

The Controller processes the following types of Personal Data collected automatically:

• Technical data: Personal Data generated by the devices, applications, tools and protocols used, such as, for example, information on the device used, IP addresses, browser type, type of Internet provider (ISP).
• Browsing and Application usage data: such as, for example, pages visited, etc.

Failure by the Data Subject to provide Personal Data that are required by law or by contract, or that are a necessary requirement for entering into the contract with the Controller, will make it impossible for the Controller to establish or continue the relationship with the Data Subject.

In the contact form, name, email and message are required. In the application form, name, email, role of interest and message are required, while the curriculum vitae and the link to the LinkedIn profile are optional. Without the required data the Controller cannot receive the request or the application or reply to it.

A Data Subject who discloses Personal Data of third parties to the Controller is directly and solely responsible for their origin, collection, processing, communication or dissemination.

2. Cookies and similar technologies

3. Legal basis and purposes of the processing

The processing of Personal Data is necessary:

a) for the performance of the contract with the Data Subject, namely:

• fulfilment of any obligation arising from the pre-contractual or contractual relationship with the Data Subject
• support and contact with the Data Subject: to respond to the Data Subject’s requests

b) for compliance with a legal obligation, namely:

• compliance with any obligation laid down by the regulations in force, laws and regulations, in particular in tax and fiscal matters

c) on the basis of the legitimate interest of the Controller, for:

• management, optimisation and monitoring of the technical infrastructure: to identify and resolve any technical problems, to improve the performance of the Application, to manage and organise information in an IT system (e.g. servers, databases, etc.)
• security and fraud prevention: to ensure the security of the Controller’s assets, infrastructure and networks
• reply to messages not related to a contract, to reply to messages that the Data Subject sends through the Mail window of the Application or to hello@trezeroquattro.com when they do not concern entering into or performing a contract
• protection of the forms against abuse, to limit the number of submissions from the same IP address and the same email address through temporary counters that record only a keyed hash of those addresses and never the content of the messages

d) to follow up on unsolicited applications sent by the Data Subject through the Application or to hello@trezeroquattro.com, namely:

• assessment of the application, to review the Data Subject’s profile and contact them with a view to a possible selection or to an employment or collaboration relationship

This processing is based on the pre-contractual measures taken at the request of the Data Subject (Art. 6(1)(b) of Regulation (EU) 2016/679) and, under Art. 111-bis of Italian Legislative Decree 196/2003, does not require the Data Subject’s consent.

The Controller asks the Data Subject not to include in the curriculum vitae special categories of data (Art. 9 of Regulation (EU) 2016/679), such as data concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or sexual orientation, nor data relating to criminal convictions and offences. If the curriculum vitae contains them and they are not necessary for the assessment, the Controller does not use them.

On the basis of the legitimate interest of the Controller, the Application allows interactions with external web platforms or social networks, whose processing of Personal Data is governed by their respective privacy policies, to which please refer. The interactions and the information acquired by this Application are in any case subject to the privacy settings that the Data Subject has chosen on such platforms or social networks. This information, in the absence of specific consent to processing for further purposes, is used solely to allow use of the Application and to provide the information and services requested.

The Data Subject’s Personal Data may also be used by the Controller to defend itself in legal proceedings before the competent courts.

The Controller does not take decisions based solely on automated processing, including profiling, which produce legal effects concerning the Data Subject or similarly significantly affect them (Art. 22 of Regulation (EU) 2016/679). Every application is assessed by a person at TreZeroQuattro.

4. Methods of processing and recipients of Personal Data

Personal Data are processed using paper and electronic tools, with organisational methods and logic strictly related to the purposes indicated and through the adoption of appropriate security measures.

Personal Data are processed exclusively by:

• persons authorised by the Controller to process Personal Data who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• parties acting independently as separate controllers, or parties appointed by the Controller as processors in order to carry out all the processing activities necessary to pursue the purposes set out in this policy (for example, consultants, IT companies, service providers, hosting providers);
• parties or bodies to which Personal Data must be disclosed by law or by order of the authorities.

The parties listed above are required to use appropriate safeguards to protect Personal Data and may access only the Personal Data necessary to perform the tasks assigned to them.

In particular, to receive the messages and applications sent through the Application, the Controller relies, as processors, on Netlify, Inc. (United States), which hosts the Application and handles the sending without retaining its content, and on Microsoft Ireland Operations Limited (Ireland), which provides the Microsoft 365 mailbox where messages and applications are received and stored. Within the Controller, messages and applications are read only by the persons authorised by the Controller.

Personal Data will not be disseminated indiscriminately in any way.

5. Place

Some Personal Data are transferred outside the European Economic Area (EEA). Netlify, Inc. is based in the United States and processes the technical data of visits and, while they are being sent, the content of messages and applications. Microsoft Ireland Operations Limited stores the Controller’s mailbox in data centres located in the European Union and may transfer a limited part of the data to the United States, for example for security and technical support purposes. These transfers are based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), for the providers that participate in it, and on the standard contractual clauses approved by the European Commission included in the respective data processing agreements. Whenever Personal Data are transferred outside the EEA to other parties, the Controller will adopt every suitable and necessary contractual measure to ensure an adequate level of protection of Personal Data. To receive information on the safeguards adopted or a copy of them, the Data Subject may contact the Controller at admin@trezeroquattro.com.

6. Retention period of Personal Data

Personal Data will be retained for the period of time necessary to fulfil the purposes for which they were collected, in particular:

• for purposes relating to the performance of the contract between the Controller and the Data Subject, they will be retained for the entire duration of the contractual relationship and, after its termination, for the ordinary limitation period of 10 years. In the event of litigation, for its entire duration, until the time limits for bringing appeals have expired
• for purposes relating to the legitimate interest of the Controller, they will be retained until that interest has been fulfilled
• for compliance with a legal obligation, by order of an authority and for the defence of legal claims, they will be retained in accordance with the time limits laid down by those obligations and regulations, and in any case until the expiry of the limitation period provided for by the rules in force
• messages sent through the Mail window of the Application or to hello@trezeroquattro.com that do not lead to an offer or a contract will be retained for 12 months from the last communication with the Data Subject. If they lead to an offer or a contract, they will be retained according to the periods set for the performance of the contract
• curricula vitae and other application data will be retained for 12 months from receipt, so that the Data Subject can also be considered for positions that open in that period. If the Data Subject takes part in a selection, they will be retained until it ends and for the following 12 months. If the application leads to an employment or collaboration relationship, the data become part of the records of that relationship and follow its retention periods. The Data Subject may ask at any time for the earlier erasure of their application
• the counters used to protect the forms against abuse have a window of at most 24 hours, after which they are no longer used and are erased automatically. The technical logs of the Application do not contain the name, the email address or the content of messages and are kept by the hosting provider for a limited period

At the end of the retention period, all Personal Data will be erased or kept in a form that does not permit identification of the Data Subject.

7. Rights of the Data Subject

Data Subjects may exercise certain rights with regard to the Personal Data processed by the Controller. In particular, the Data Subject has the right to:

• be informed about the processing of their Personal Data
• withdraw consent at any time
• object to the processing of their Personal Data
• access their Personal Data
• verify and request the rectification of their Personal Data
• obtain the restriction of the processing of their Personal Data
• obtain the erasure of their Personal Data
• transfer their Personal Data to another controller
• lodge a complaint with the supervisory authority for the protection of their Personal Data (in Italy the Garante per la protezione dei dati personali, www.garanteprivacy.it) and/or take legal action.

Right to object. Where the processing is based on the legitimate interest of the Controller, the Data Subject may object at any time, on grounds relating to their particular situation, by writing to admin@trezeroquattro.com (Art. 21 of Regulation (EU) 2016/679).

To exercise their rights, Data Subjects may send a request to the following email address admin@trezeroquattro.com. Requests will be taken up by the Controller immediately and fulfilled as quickly as possible, and in any case within 30 days.

Last updated: 13 October 2026