Data protection

1. Introduction

Thank you for visiting our website. This notice provides an overview of its technical structure and explains how your personal data is processed during your visit. The following information is provided for information only and has no regulatory effect.

In addition to this website privacy policy, please also read our separate information on the processing of personal data for applicants, prospective customers and business customers.

2. Name and contact details of the controller

Nuviax GmbH

Voitsbergstraße 2, 39040 Vahrn (BZ), Italy

Email: info@nuviax.it

Hereinafter, ‘we’, as the website operator, are the controller of website users' personal data (hereinafter ‘you’) within the meaning of the General Data Protection Regulation (‘GDPR’).

3. Data protection contact

We have not appointed an (external) data protection officer because there is no legal obligation to do so.

If you have questions about the processing of your personal data or wish to exercise your data-subject rights, you can contact us at: dpo@nuviax.it.

If your request concerns one of our clients for whom we have been appointed as external data protection officer, please write to the following email address: privacy@nuviax.it and kindly state our client’s company name in the email.

4. Processing of personal data, purposes and legal bases

For the purposes of this privacy policy, personal data means any information relating to an identified or identifiable natural person (hereinafter ‘data subject’).

Personal data also includes information about your use of our website. In this context, we collect information such as the volume of data transferred, the location from which you access data on our website, and other connection data and resources you access.

We use your personal data in particular for the following purposes:

• to provide the website;
• to ensure that our website is presented to you as effectively and engagingly as possible;
• to provide the services you request (e.g. contacting us or accessing the customer portal);
• to fulfil our obligations arising from any contracts concluded between you and us;
• to enable you to participate in interactive features, should you wish to do so;
• to inform you about changes to our services.

4.1 Provision of the website and creation of log files

When you access our website, your browser transmits data to our web server for technical reasons. The following data is processed during an active connection between your browser and our web server:

• IP address of the device
• date and time of the request
• content requested (specific page)
• access status / HTTP status code
• amount of data transferred
• website from which the request originated
• operating system used by the device
• language, product and version information of the browser software

Processing your IP address is necessary to deliver the website to your device, identify and correct website errors, determine website load, and make adjustments or improvements. Your IP address must be stored for the duration of the session for these purposes. Where we collect your IP address, it is stored only while you use the website and then immediately deleted or anonymised by truncation. The legal basis for processing log files is our legitimate interest pursuant to Art. 6(1), first sentence, point (f) GDPR. Server-side log data is stored for a limited period and then deleted.

5. Cookies and integrated services

In some circumstances, we collect information about your use of our website through browser cookies. These are small text files stored on your device that retain certain settings and data for exchange with our system via your browser. A cookie usually contains the name of the domain from which the cookie data was sent, information about the cookie’s age and an alphanumeric identifier.

This website uses technically necessary cookies or comparable technologies (e.g. local storage) that are required for its operation and secure provision. Analytics, statistics or marketing/tracking technologies are also used. The legal basis for technically necessary cookies is Art. 6(1)(f) GDPR (legitimate interest in uninterrupted operation) or Art. 6(1)(b) GDPR where they serve performance of a contract.

Any processing of personal data that is not strictly necessary—particularly through cookies for analytics, tracking or advertising—requires your consent (Art. 6(1), first sentence, point (a) GDPR). Such data is processed only with your express consent, which you may withdraw at any time with effect for the future.

5.1 Google Maps

We embed Google Maps on our contact page. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’). The map is loaded only after you have expressly consented. When the map loads, your IP address is transmitted to Google and may be transferred to the United States. The legal basis is your consent under Art. 6(1), first sentence, point (a) GDPR. For transfers to the United States, Google relies on the European Commission’s adequacy decision concerning the EU–US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46 GDPR). You may withdraw your consent at any time with effect for the future.

5.2 Google Tag Manager

We use Google Tag Manager provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (represented in the EU by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Tag Manager is a tool that enables us to manage tracking and statistics tools and other technologies on our website. Google Tag Manager itself does not create user profiles, store cookies or perform independent analyses. It merely manages and deploys the tools integrated through it.

Legal basis: Depending on the tags loaded in each case (Art. 6(1)(a) or (f) GDPR).

Google privacy policy: https://policies.google.com/privacy

5.3 Google Analytics

We use Google Analytics 4 (GA4), a web analytics service provided by Google LLC. Google Analytics uses cookies (including _ga and _gid) that enable analysis of website use. The information generated about your use of this website is generally transferred to a Google server in the USA and stored there.

Legal basis: Art. 6(1)(a) GDPR (consent). You can prevent collection by Google Analytics by not granting, or by withdrawing, your consent in the cookie banner.

Opt-out: https://tools.google.com/dlpage/gaoptout

6. Contacting us

You can contact us in various ways, particularly by email (info@nuviax.it) or through the contact form on our website.

Email: if you contact us by email, the personal data transmitted with the email is stored and processed solely for the correspondence. The legal basis is Art. 6(1), point (f) GDPR; our legitimate interest is responding to your enquiry. If the contact concerns entering into a contract, Art. 6(1), point (b) GDPR provides an additional legal basis. The data is deleted once the relevant correspondence has ended and retention is no longer required.

Contact form: when you use our contact form, the data entered in the form is transmitted to us and stored. The following data is processed when the form is submitted:

• company name
• telephone number (optional)
• first and last name
• business email address
• company size
• other personal data voluntarily provided in the message field
• IP address of the requesting computer
• date and time of contact

The data is processed solely to handle your enquiry or take steps towards entering into a contractual relationship. The legal basis is Art. 6(1), point (f) GDPR; if the contact is intended to lead to a contract, Art. 6(1), point (b) GDPR also applies. The data is deleted as soon as it is no longer required for the purpose for which it was collected.

7. Applications via the website

You can apply to us through the ‘Careers’ section of our website. Personal data submitted as part of an application is processed in accordance with our separate privacy policy for applicants, which we provide separately during the application process.

8. Customer portal (login area)

Registered customers can log in to our customer portal to access documents and services made available to them. During registration and use, we process in particular your login details (email address and encrypted password), master and contact data, and usage and log data (e.g. login times and content accessed). The purpose is to provide, manage and secure portal access and to perform our contractual relationship with you.

The legal basis is Art. 6(1), point (b) GDPR (performance of the user or contractual relationship) and, for security logging, Art. 6(1), point (f) GDPR. Your login details and portal content are stored for the duration of the account relationship and deleted afterwards unless statutory retention obligations apply.

9. Online presence on other platforms (social media)

We maintain company profiles on professional and social platforms for communication and information exchange. Publications may include information about our products and services, contact with customers and prospective customers, job vacancies, and news or PR. We are present on the following platforms:

• LinkedIn – LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
• Instagram – Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

The legal basis for processing data we collect in connection with our company profiles is Art. 6(1), point (f) GDPR. You may object to processing at any time and exercise your data-subject rights by sending an informal message using the contact details provided. If you interact with our company profiles (e.g. comments, posts or likes), you may make personal data (e.g. your real name or profile photo) publicly available. Further information on exercising data-subject rights with LinkedIn: Privacy Policy (https://www.linkedin.com/legal/privacy-policy) and Opt-Out (https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out).

10. Place of processing and data security

This website is hosted on servers operated by a service provider we have commissioned: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are geographically located in Germany (European Union).

Unfortunately, transmitting information over the internet is not completely secure, so we cannot guarantee the security of data sent to our website via the internet. However, we protect our website and other systems against loss, destruction, unauthorised access, alteration or dissemination of your data through technical and organisational measures. In particular, your personal data is transmitted in encrypted form using SSL (Secure Socket Layer) or TLS (Transport Layer Security).

11. Recipients of data

We disclose your data to third parties only with your consent or on a statutory basis. We use the following categories of recipients in our business processes:

• Employees of our company and service providers that support us as processors (e.g. hosting by Hetzner Online GmbH, website support and maintenance by our web agency, and CDN operators). We have concluded data processing agreements with them pursuant to Art. 28 GDPR.
• Authorities or natural/legal persons where we are legally required to disclose data (e.g. requests for information from investigative authorities) or where disclosure is necessary to assert claims.

Our service providers are carefully selected, bound by our instructions and regularly monitored. They provide sufficient guarantees of appropriate technical and organisational measures.

12. Your rights as a data subject

Because your personal data is processed in connection with your use of this website, you generally have the following rights under the GDPR:

• right of access to the data processed (Art. 15 GDPR);
• right to rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR);
• right to erasure (Art. 17 GDPR);
• right to restriction of processing (Art. 18 GDPR);
• right to data portability (Art. 20 GDPR);
• Right to withdraw consent at any time with effect for the future. To do so, contact us at dpo@nuviax.it;
• right to object, on grounds relating to your particular situation, to processing based on Art. 6(1), point (f) GDPR (Art. 21 GDPR); this also applies to direct marketing.

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. Our competent supervisory authority is:

Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy – Tel.: +39 06 696771 – Email: garante@gpdp.it – https://www.gpdp.it.

13. External links / third-party websites

The website may contain hyperlinks to and from third-party websites. If you follow a hyperlink to any such website, please note that we cannot accept responsibility or provide any warranty for third-party content or privacy terms. Please check the applicable privacy terms before submitting personal data to these websites.

14. Amendments

This privacy policy may need to be amended. The current privacy policy is available on our website at any time. You may request older versions using the contact details above.

Last updated: July 2026 · Version 1.0

Compliance with European and Italian data protection law is very important to us. This notice explains how we process your personal data in connection with your application and outlines your rights under the General Data Protection Regulation (Regulation (EU) 2016/679 – ‘GDPR’) and Italian data protection law (Legislative Decree No. 196/2003, as amended by Legislative Decree 101/2018 – ‘Privacy Code’).

1. Controller

The controller responsible for processing data in connection with your application or possible employment is:

Nuviax GmbH

Voitsbergstraße 2, 39040 Vahrn (BZ), Italy

Email: info@nuviax.it

(hereinafter ‘employer’, ‘Nuviax’, ‘we’, ‘us’ or ‘our’).

2. Data protection contact

We have not appointed an (external) data protection officer because there is no legal obligation to do so. If you have questions about data protection or wish to exercise your rights, you can contact us at: dpo@nuviax.it.

3. Data processing during the application procedure, sources and categories of personal data

For the purpose of deciding whether to establish an employment relationship, we process your personal data to the extent necessary. In particular, we process the data you provide during the application procedure for the following purposes:

• deciding whether to offer an employment relationship;
• preparing the employment contract and other contractual documents (including any prepared subsequently);
• adding you to our applicant pool at your request so that we can consider you for future recruitment procedures.

3.1 Sources of personal data

We receive your personal data primarily as follows:

• from you: from the data supplied in your application documents (e.g. CV and certificates);
• from third parties/partners: if you apply through careers platforms on which we have an online presence, we may also receive data from your profiles there (e.g. LinkedIn or XING profile);
• references: where you have consented, we may collect data from reference discussions with former colleagues.

3.2 What data do we process?

As a rule, we process only information that you provide in your application and that we learn during the application procedure. This may include in particular:

• personal master data (e.g. first and last name, title, date and place of birth, marital status and gender), address and contact details, photograph and nationality;
• where applicable, information about family members or partners;
• bank details (e.g. IBAN, BIC and bank name);
• employment-contract data (e.g. start/end date, fixed term and employment conditions);
• qualifications (e.g. application documents, certificates, employment references and other references);
• organisational information (e.g. desired position and responsibilities);
• where applicable, information concerning membership of protected categories under Law No. 68/1999 (categorie protette) or comparable special categories.

3.3 Legal bases

We process your personal data on the basis of the GDPR, the Privacy Code and the applicable employment-law provisions.

The primary purpose of processing is to decide whether to establish an employment relationship. The legal basis is Art. 6(1), point (b) GDPR (taking pre-contractual steps at your request), in conjunction with Art. 88 GDPR and the relevant provisions of the Privacy Code on employee data protection.

Where processing is necessary to comply with our legal obligations—particularly in tax and social-security matters (e.g. INPS, INAIL and Agenzia delle Entrate)—the legal basis is Art. 6(1), point (c) GDPR. We also process your data to safeguard legitimate interests (Art. 6(1), point (f) GDPR), for example to maintain operational security and order and to enforce legal rights.

Any workplace monitoring and surveillance measures are governed by Art. 4 of Law No. 300/1970 (Statuto dei Lavoratori), as amended by Legislative Decree 151/2015, and—where required by law—are subject to a trade-union agreement or official authorisation.

Where special categories of personal data under Art. 9(1) GDPR are processed, this is done to exercise rights or fulfil obligations under employment and social-security law (e.g. information on membership of protected categories under Law No. 68/1999). The legal basis is Art. 9(2), point (b) GDPR in conjunction with the relevant Italian provisions. Processing may also be based on consent under Art. 9(2), point (a) GDPR.

If you agree to be included in our applicant pool, the processing is based on your active and informed consent under Art. 6(1), point (a) GDPR.

4. Recipients of personal data

Your personal data is disclosed to the following categories of recipients only where a relevant legal basis exists or with your prior express consent:

• employees: where our employees are involved in the decision-making process, they have access to your personal data to the extent necessary;
• employee representatives: within their statutory participation rights, trade-union representatives (rappresentanza sindacale unitaria—RSU—or rappresentanze sindacali) may also process your data to the extent prescribed by law;
• processors: service providers that support us with data processing (e.g. recruitment and placement providers and IT service providers that supply and maintain our IT systems);
• third parties: public-law bodies where legally necessary or requested (e.g. employment services / Centro per l’impiego and social-security institutions), and companies that help us make bookings (e.g. airlines, rail operators, hotels and travel agencies).

As our company develops (e.g. a change of legal form or the establishment, purchase or sale of parts of the business), relevant employee information may be transferred together with the part of the business concerned. For every disclosure, we ensure compliance with this privacy policy and applicable data protection laws.

5. Processing and storage period

We process your personal data and delete it as soon as it is no longer required for the purposes stated above. After the application procedure ends, data is generally retained for [six] months. If you have consented to inclusion in our applicant pool, we retain your data for [three] years.

Booking and accounting records are retained for as long as required by law. This follows in particular from civil and tax-law documentation and retention obligations under Italian law (including Art. 2220 of the Italian Civil Code and Presidential Decrees 600/1973 and 633/1972), which regularly require retention for up to ten years. In cases defined more specifically by law, retention may continue until a tax audit or court proceeding has been finally concluded.

6. Why we need your personal data

Without your data, we cannot decide whether to establish an employment relationship with you. This may mean that your application cannot be processed further.

7. Transfers of personal data to a third country

As a rule, personal data collected during the application procedure is stored on servers within the European Union.

Because providers of certain software or cloud solutions (e.g. careers platforms) offer their services using globally available resources, your personal data may in individual cases be transferred outside the EU/EEA—particularly to the United States—or accessed from there. For transfers to the United States, the European Commission has adopted an adequacy decision concerning the EU–US Data Privacy Framework under Art. 45 GDPR (DPF). Where the relevant provider is DPF-certified, the customary GDPR level of protection applies to the transfer. In addition, transfers are based on appropriate safeguards under Art. 46 et seq. GDPR, particularly standard contractual clauses under Art. 46(2), point (c) GDPR.

8. Data subject rights

You have the right to obtain information at any time about the data stored concerning you. Where the relevant conditions are met, you also have the following rights:

• right to rectification of inaccurate personal data concerning you;
• right to erasure, for example where your data is no longer required for the purposes of processing;
• right to restriction of processing, particularly where the accuracy of the data is disputed between you and us;
• right to data portability where we process your data on the basis of a contract or your consent and you provided the data to us;
• right to withdraw consent with effect for the future; the lawfulness of processing carried out before withdrawal remains unaffected;
• right to object, on grounds relating to your particular situation, to processing based on a legitimate interest.

To exercise these rights or ask questions about data protection, you can contact us using the contact details above (dpo@nuviax.it).

You also have the right to lodge a complaint with a supervisory authority at any time, particularly in the EU Member State of your habitual residence, place of work or place of the alleged infringement. Our competent supervisory authority is:

Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy – Tel.: +39 06 696771 – Email: garante@gpdp.it – https://www.gpdp.it.

9. Version and amendments to this privacy policy

This privacy policy was last updated in July 2026.

As our company develops, the way we handle personal data may also change. We therefore reserve the right to amend this privacy policy in accordance with applicable data protection law. We will notify you separately of material changes.