Privacy Notice Regarding the Processing of Personal Data
pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”)
This privacy policy describes how TIMESIS S.r.l. processes the personal data of users who visit the website www.timesis.it, with particular reference to requests for information submitted via the contact form and job applications sent via email.
1. Data Controller
The Data Controller is:
TIMESIS S.r.l.
Via Niccolini, 7
56017 San Giuliano Terme (PI) – Italia
VAT 01164510503
E-mail: timesis@timesis.it
2. Data Processed
Requests for Information
Through the contact form on the website, data voluntarily provided by the user may be collected, such as:
- name and surname;
- email address;
- any organization or company to which you belong;
- information contained in the message;
- any additional information voluntarily provided by the user.
In addition, any data strictly necessary for the proper management and security of the form submission is processed, provided it has been technically recorded by the system.
Applications and Resumes
Interested candidates may submit their resumes unsolicited to the email addresses listed on the website.
TIMESIS may therefore process the personal data contained in the resume and accompanying cover letter, such as identification and contact information, details regarding education, professional experience, skills, and qualifications, as well as any other information voluntarily provided by the candidate that is relevant to the evaluation of the application.
Please do not include in your resume any information falling under special categories of personal data, as defined in Article 9 of the GDPR, unless such information is strictly necessary for the purposes of your application or required by applicable law.
3. Purposes and Legal Basis for Data Processing
A. Requests for Information
The data collected through the contact form is used exclusively for:
- receive and process the user’s request;
- provide the requested information;
- contact the user when necessary;
- handle any preliminary activities leading up to the conclusion of a professional or contractual relationship.
The legal basis for the processing is Article 6(1)(b) of the GDPR, as the processing is necessary for the implementation of precontractual measures requested by the data subject.
In cases where the request is not of a pre-contractual nature, processing may be carried out on the basis of the Data Controller’s legitimate interest, pursuant to Article 6(1)(f) of the GDPR, in managing the communications received and responding to users.
Providing the information requested in the form is necessary in order to respond to your request. Failure to provide the required information will prevent us from sending or processing your message.
The data collected through the form is not used for marketing purposes or to send newsletters, unless specific and separate consent is requested in the future.
B. Applications
The data provided in a resume is processed exclusively for the following purposes:
- evaluate the candidate’s professional profile;
- check for potential matches with job openings or collaboration opportunities;
- contact the candidate;
- carry out any preliminary activities necessary for establishing an employment or contractual relationship.
The legal basis for the processing is Article 6(1)(b) of the GDPR, as the processing is necessary for the implementation of precontractual measures requested by the data subject.
In the case of unsolicited resumes, the data subject’s consent to the processing of the data contained in the resume is not required within the scope of the purposes indicated above.
Any specific categories of personal data will be processed only when relevant and necessary for the position or employment relationship in question, and in compliance with applicable laws.
4. Methods of Processing
Personal data is processed using computerized tools and, when necessary, manually, in accordance with the principles of lawfulness, fairness, transparency, data minimization, accuracy, and storage limitation set forth in the GDPR.
TIMESIS implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration, or improper disclosure.
5. Retention Period
Data related to requests for information will be retained for as long as necessary to process the request and, as a general rule, for a period not exceeding 12 months from the conclusion of the relevant communication, unless it is necessary to retain them for a longer period to manage a contractual relationship, to comply with legal obligations, or to protect the rights of the Data Controller.
The data contained in the resumes will be retained for a maximum period of 24 months from the date of receipt, unless the applicant updates their application, a professional relationship is established, or a different retention period is required by law.
Upon expiration of the respective retention periods, the data will be deleted or anonymized, unless required by law to be retained for a longer period.
6. Recipients of the Data
Personal data may be processed by expressly authorized TIMESIS personnel and, when necessary, by third parties that provide services essential to the management of the website and communications, such as:
- hosting and IT infrastructure service providers;
- email service providers;
- suppliers and technicians responsible for maintaining the website and IT systems;
- consultants and professionals, as needed;
- public entities or authorities in the cases provided for by law.
When required by law, third parties that process personal data on behalf of TIMESIS are designated as data processors pursuant to Article 28 of the GDPR.
Personal data is neither sold nor disclosed.
7. Transfer of Data to Countries Outside the EEA
If any service providers used by TIMESIS involve the processing or transfer of personal data outside the European Economic Area, such transfers will be carried out in accordance with Chapter V of the GDPR and through the mechanisms provided for by applicable law, such as adequacy decisions, standard contractual clauses, or other safeguards recognized by the GDPR.
8. Rights of the Data Subject
The data subject may exercise, in the cases provided for by law, the rights recognized by Articles 15–22 of the GDPR, including:
- to obtain confirmation as to whether or not personal data concerning him or her exists;
- access your personal data;
- request the correction of inaccurate data;
- request the deletion of your data;
- request the restriction of processing;
- to object to the processing in the cases provided for;
- obtain data portability, when applicable.
Requests may be sent to:
The data subject also has the right to file a complaint with the Data Protection Authority, in accordance with the procedures established by the Authority.
9. Changes to the Privacy Policy
TIMESIS may update this privacy policy to reflect regulatory, technical, or organizational changes.
The updated version will be posted on this page.
Last updated: August 2026.
