Cookie Policy | HR Flow

1. Data Controller

The Data Controller is:

This Cookie Policy concerns the website:

https://www.hrflow.it

2. What cookies are

Cookies are small text files that websites can store on the user's device while browsing.

Cookies may be used to:

• ensure website operation;
• remember preferences and choices;
• protect the website from abusive use;
• distinguish sessions and browsers;
• collect statistics;
• analyse page usage.

Similar technologies, such as local storage, pixels, SDKs, or online identifiers, may perform similar functions.

3. Categories used by the website

The HR Flow website uses:

• technical and necessary cookies;
• cookies for preference management;
• analytics and statistics cookies, installed only after consent.

The website does not use:

• advertising cookies;
• remarketing cookies;
• cookies for personalised advertising;
• commercial profiling systems;
• Google Signals;
• Google Analytics advertising features.

Non-technical cookies may be used only after the user has expressed free, informed, specific, and demonstrable consent. Refusal must be as easy as acceptance.

4. Technical and necessary cookies

Technical cookies are used exclusively to enable:

• website operation;
• security;
• technical session management, where necessary;
• protection against abusive requests;
• storage of the preferences expressed in the banner;
• proper application of consent or refusal.

These cookies are not used for advertising or profiling purposes.

Their use does not require prior consent, but it must be described in the notice.

Technical cookie for preferences

The preference may be requested again:

• after at least six months;
• when tools, providers, or purposes change significantly;
• when it is not possible to recover the previous choice;
• when the user deletes browser cookies or data.

The Italian Supervisory Authority's guidelines provide that, in the absence of significant changes, the banner should not be shown again before at least six months have passed since the previous choice.

5. Google Analytics 4

The website uses Google Analytics 4, a service provided by:

Google Analytics is used to:

• measure traffic;
• count visits and sessions;
• identify the most visited pages;
• understand browsing behaviour in statistical form;
• identify errors and usability issues;
• improve content and performance;
• produce aggregated reports.

The standard Google Analytics implementation may collect data relating to users, sessions, approximate geographic location, browser, and device.

6. Activation subject to consent

Google Analytics is blocked by default.

Before consent:

• the Google Analytics tag is not loaded;
• no Analytics cookies are installed;
• no Analytics events are sent to Google;
• the Analytics status remains denied;
• only the necessary technical tools are active.

Google Analytics is activated only after the user has accepted the category:

"Analytics and statistics"

The website uses a configuration equivalent to the basic consent mode, in which the Analytics tag is not loaded before acceptance.

Refusal of Google Analytics:

• does not prevent browsing;
• does not limit the demo request form;
• does not prevent access to essential functions;
• does not cause negative consequences for the user.

7. Google Analytics cookies

GA4 tags use first-party cookies to distinguish users and sessions. Google indicates, by default, the cookies _ga and _ga**, both with a maximum duration of two years, without prejudice to lower limits that browsers may apply.

Expected list

The exact value of the second cookie depends on the identifier of the configured Google Analytics property.

The actual duration may be shorter depending on:

• browser settings;
• manual deletion;
• withdrawal of consent;
• configurations applied by IGESA;
• restrictions introduced by the device or browser.

8. Adopted configuration

Google Analytics is configured with the following limitations:

• activation only after consent;
• Google Signals disabled;
• advertising personalisation disabled;
• remarketing disabled;
• no intentional use of User-ID;
• no intentional sending of names, email addresses, or direct identifiers;
• no intentional collection of demographic data or interests;
• no advertising connection with Google Ads, unless the policy is updated in the future and new consent is collected;
• user and event data retention set to 14 months;
• use solely for statistical and website improvement purposes.

Google Analytics normally stores the Client-ID in the _ga cookie; when Analytics storage is disabled through consent management, the Client-ID is not stored.

9. Data processed through Google Analytics

Subject to consent, Google Analytics may process:

• visited pages;
• URLs;
• events and interactions;
• visit date and time;
• indicative session duration;
• traffic source;
• browser type;
• device;
• operating system;
• language;
• screen resolution;
• approximate geographic location;
• online identifiers;
• the IP address technically used for communication and approximate location.

The website does not intentionally configure events containing:

• first name;
• last name;
• email;
• phone number;
• demo form content;
• employee data;
• documents;
• credentials;
• special categories of data.

10. Legal basis

Technical cookies

The legal basis is:

• technical necessity to provide the website;
• legitimate interest in security and proper operation;
• compliance with obligations relating to preference management.

Google Analytics

The legal basis is:

• user consent.

Consent may be withdrawn at any time without affecting the lawfulness of the processing carried out before withdrawal.

11. Cookie banner

On first access, a banner is displayed that allows the user to:

• accept all tools;
• reject non-essential tools;
• customise preferences;
• consult this Cookie Policy;
• continue using only technical cookies.

The acceptance and refusal buttons must be:

• clearly visible;
• understandable;
• keyboard accessible;
• presented without steering the user toward a specific choice;
• equivalent in ease of use.

Simply continuing to browse, scrolling, or closing the banner does not constitute consent.

12. Management and withdrawal of preferences

The user may change their choice at any time through the link:

"Manage cookie preferences"

available in the footer.

Through the panel it must be possible to:

• verify the current status;
• accept Google Analytics;
• withdraw consent;
• keep only technical cookies active;
• consult provider information.

Following withdrawal:

• the Analytics tag is no longer activated;
• no new Analytics data are collected;
• existing Analytics cookies are removed, where technically possible;
• data already collected remain processed according to the applicable retention periods.

13. Browser settings

Users may also manage or delete cookies through their browser settings.

General cookie disabling may impair some technical website functions.

Cookie deletion may result in:

• loss of preferences;
• the banner being shown again;
• deletion of Analytics identifiers;
• the need to express the choice again.

Instructions depend on the browser used.

14. Duration of data and preferences

Cookie preference

The user's choice is stored for 6 months.

Google Analytics cookies

_ga

up to 2 years;

_ga**

up to 2 years.

Analytics user and event data

Retention in the Google Analytics property is set to 14 months.

Aggregated reports

Aggregated reports may remain available according to the technical characteristics of Google Analytics, even after user and event data have expired.

15. Recipients

Data collected through cookies and analytics tools may be processed by:

• authorised IGESA personnel;
• technical providers engaged in website management;
• the provider of the consent management system;
• Google Ireland Limited;
• Google group companies and providers involved in the delivery of Google Analytics;
• competent authorities where required by law.

Consent management system

Provider:

IGESA S.r.l.

The consent management system is implemented directly in the website frontend and uses the technical cookie hrflow_cookie_preferences.

16. International transfers

Use of Google Analytics may involve access or processing by companies or providers located outside the European Economic Area.

Transfers are governed through the instruments provided by applicable law, according to the conditions and safeguards adopted by Google.

Users can avoid Analytics processing by refusing or withdrawing consent.

17. No advertising profiling

Google Analytics is used exclusively for statistical analysis and website improvement.

The website does not use Analytics data for:

• personalised advertising;
• remarketing;
• commercial profiling;
• employee evaluation;
• staff selection;
• automated decisions;
• creation of advertising segments;
• intentional sharing with Google Ads.

Any future introduction of such purposes will require:

• updated notices;
• modification of the banner;
• specific indication of providers;
• collection of separate consent, where required.

18. Data subject rights

Where applicable, users may exercise:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• portability;
• withdrawal of consent;
• complaint to the supervisory authority.

Requests may be sent to:

privacy@igesa.it

or via PEC:

igesa@pec-legal.it

19. Updates to this Cookie Policy

IGESA may update this Cookie Policy in the event of:

• changes to cookies;
• introduction of new tools;
• changes to the consent management system;
• changes to Google Analytics;
• variations in purposes;
• connection with additional Google services;
• changes to retention periods;
• regulatory updates.

Where a change affects consent, the user may be asked to express preferences again.

20. Contacts

Last updated: 1 August 2026