Privacy Policy | HR Flow

1. Data Controller

The Data Controller is:

This notice concerns the public HR Flow website available at:

https://www.hrflow.it

The HR Flow application, accessible through a separate domain and used by customers, is subject to additional notices and to the data processing agreements applicable to the purchased service.

2. Types of data processed

2.1 Browsing data

During normal browsing, the computer systems used to operate the website collect technical information such as:

• IP address;
• date and time of the request;
• requested URL and resource;
• response method and status;
• browser type;
• device type;
• operating system;
• user agent;
• referring page;
• information required for security and technical diagnostics.

These data are processed through hosting, network, reverse proxy, monitoring, and technical logging systems.

Browsing data may be used to:

• make the website available;
• prevent abuse;
• identify errors;
• protect the infrastructure;
• analyse security events;
• protect IGESA's rights.

2.2 Browser language

When the user accesses the main page, the website detects the preferred language communicated by the browser through navigator.languages or navigator.language.

This information is used solely to direct the user to the Italian, French, or English version of the website.

The detected language:

• is not used for profiling;
• is not communicated to external services for that purpose;
• is not stored in local storage;
• is not used to directly identify the user.

2.3 Data provided through the demo request form

When the user fills in the demo request form, the following data are processed:

• full name;
• work email;
• company or organisation;
• optional message content;
• confirmation that the privacy notice has been read;
• technical data required for security and abuse prevention.

The message field must not be used to send:

• health data;
• judicial data;
• credentials;
• personal documents;
• unnecessary third-party data;
• confidential information or special categories of personal data.

2.4 Anti-spam data

The form may use technical anti-spam controls, including:

• a hidden honeypot field;
• request rate limitation;
• timing checks;
• technical analysis of requests;
• IP address and technical security identifiers.

These data are processed exclusively to protect the website and the service from automated, fraudulent, or abusive requests.

2.5 Voluntarily provided data

The voluntary sending of communications to IGESA's addresses involves the processing of:

• the sender's address;
• the identification data communicated;
• the content of the request;
• any attachments;
• the information needed to respond.

Users must transmit only relevant and necessary data.

2.6 Data collected through Google Analytics 4

The website uses Google Analytics 4, a statistical analysis service provided by:

Google Analytics is used to collect statistical information about website usage.

The processed data may include:

• visited pages;
• URLs;
• events and interactions;
• visit date and time;
• indicative session duration;
• traffic source;
• browser type;
• device type and category;
• operating system;
• language;
• screen resolution;
• approximate geographic location;
• online identifiers contained in Analytics cookies;
• the IP address technically used for transmission and geographic determination.

Google states that the browser may communicate the page URL and IP address to Google when the site integrates Google Analytics. For traffic from the European Economic Area, Switzerland, and the United Kingdom, Google Analytics states that it does not record or store individual IP addresses after their initial technical use.

3. Purposes and legal bases

3.1 Website operation and security

Technical data are processed to:

• provide the website;
• ensure proper operation;
• prevent abusive access;
• detect anomalies;
• analyse incidents;
• protect systems and infrastructure;
• perform technical diagnostics;
• protect IGESA's rights.

Legal basis:

• the Controller's legitimate interest in the security and operation of the website;
• compliance with legal obligations, where applicable.

3.2 Management of demo requests

Data provided in the form are processed to:

• respond to the request;
• contact the data subject;
• organise a demonstration;
• understand the potential customer's needs;
• provide requested commercial information;
• prepare an offer;
• take pre-contractual measures.

Legal basis:

• performance of pre-contractual measures taken at the data subject's request.

The privacy checkbox confirms that the notice has been read and does not constitute marketing consent.

3.3 Statistical analysis through Google Analytics

Google Analytics is used to:

• measure traffic;
• understand which pages are visited;
• analyse general browsing behaviour;
• identify errors or usability issues;
• improve content and performance;
• produce aggregated statistics;
• assess the website's technical and informational effectiveness.

Legal basis:

• user consent.

Google Analytics is not activated before consent is given for the "Analytics and statistics" category.

Refusal does not prevent use of the essential functions of the website.

3.4 Recording cookie preferences

The website records preferences expressed through the banner in order to:

• remember the choice;
• prevent the activation of unauthorised tags;
• demonstrate consent management;
• allow subsequent change or withdrawal.

Legal basis:

• compliance with obligations relating to consent management;
• legitimate interest in properly documenting the choice;
• technical necessity to store preferences.

The cookie or tool used to remember the choice is strictly technical.

3.5 Management of communications and protection of rights

Data may be processed to:

• keep evidence of requests;
• manage disputes;
• prevent fraud;
• exercise or defend rights;
• respond to authorities.

Legal basis:

• legitimate interest;
• legal obligation;
• establishment, exercise, or defence of a right.

3.6 Promotional communications

Data from the demo request are not automatically used for newsletters or ongoing marketing.

If IGESA introduces separate promotional communications, a specific separate consent will be requested where necessary.

4. Privacy configuration of Google Analytics

Google Analytics is configured according to the following criteria:

• use of Google Analytics 4;
• activation only after consent;
• Consent Mode set with Analytics denied by default;
• no loading of the Analytics tag before consent;
• Google Signals disabled;
• advertising personalisation features disabled;
• no remarketing activity;
• no intentional collection of demographic and interest data;
• no use of User-ID;
• no intentional sending of names, emails, or other direct identifiers;
• user and event data retention set to 14 months;
• Analytics cookie duration configured consistently with the Cookie Policy;
• possibility for the user to withdraw consent at any time.

The basic consent mode prevents data from being sent to Google before user acceptance. Google distinguishes this mode from the advanced mode, in which signals may be transmitted without cookies even in the absence of consent; the HR Flow website uses the basic mode.

Google Analytics allows user and event data retention to be set to 2 or 14 months for standard properties. The configuration chosen by the website is 14 months.

5. Cookies and similar tools

The website uses:

Technical cookies

Required for:

• operation;
• security;
• preference management;
• storage of the cookie choice.

These tools do not require prior consent.

Analytics cookies

Used by Google Analytics to:

• distinguish browsers;
• reconstruct statistical sessions;
• measure visits and events;
• produce aggregated reports.

These cookies are installed only after consent.

The detailed list of cookies, purposes, providers, and durations is available in the Cookie Policy.

6. Banner and preference management

On first access, the website shows a banner that allows the user to:

• accept all cookies;
• reject non-essential tools;
• customise preferences;
• continue without Analytics cookies;
• view the Cookie Policy.

Without a positive choice:

• Google Analytics remains blocked;
• no Analytics cookies are installed;
• only the necessary technical tools remain active.

The user may change or withdraw consent at any time through the link:

"Manage cookie preferences"

available in the website footer.

The choice is remembered for at least six months, except in the event of:

• deletion of cookies by the user;
• substantial changes to the processing;
• changes to providers;
• need to request consent again.

The Italian Supervisory Authority states that the choice should not be requested again before six months have elapsed, except in the case of significant changes or technical impossibility to recognise the previously expressed preference.

7. Nature of the provision of data

Data marked as mandatory in the demo form are necessary to manage the request.

Failure to provide them prevents IGESA from:

• identifying the requester;
• responding;
• organising a demonstration;
• preparing any requested offers.

The free-text message is optional.

Consent to Google Analytics is optional.

Refusal or withdrawal of Analytics consent does not limit access to the website and its essential functions.

8. Processing methods

Data are processed using IT and organisational tools according to the principles of:

• lawfulness;
• fairness;
• transparency;
• minimisation;
• accuracy;
• storage limitation;
• integrity;
• confidentiality.

IGESA adopts technical and organisational measures proportionate to the risks.

Access to data is permitted only to:

• authorised personnel;
• authorised technical administrators;
• providers that need the information for the entrusted activities.

9. Data recipients

Data may be communicated or made accessible to:

• authorised IGESA personnel;
• hosting providers;
• technical providers and maintainers;
• providers engaged to manage the demo form;
• email communication providers;
• security and monitoring providers;
• professional advisers;
• public authorities, where required by law.

The main providers are:

Hetzner

Used for hosting and infrastructure in Germany.

Google Ireland Limited

Used for Google Analytics 4 and the processing of statistical data collected after consent.

The Google Analytics terms for the European area identify Google Ireland Limited as the contractual counterparty for the service.

Additional providers actually used for the demo form, email, monitoring, and technical management will be indicated in the updated version of this notice and in the Cookie Policy.

Data are not publicly disclosed.

10. International transfers

The main website infrastructure is located in Germany, within the European Economic Area.

Use of Google Analytics may involve access or processing by Google group companies or providers located outside the European Economic Area.

Such processing is carried out on the basis of the instruments and safeguards provided for by applicable law and by Google's contractual arrangements.

Users can avoid Analytics collection by refusing or withdrawing consent.

11. Retention periods

11.1 Browsing data and technical logs

Ordinary browsing and security data are retained for a maximum period of 30 days.

Data may be retained longer when necessary to:

• analyse an incident;
• prevent abuse;
• respond to authority requests;
• exercise or defend a right.

11.2 Demo requests

Data relating to demo requests that do not lead to a contractual relationship are retained for a maximum of 12 months from receipt or the last significant interaction.

They are subsequently deleted or anonymised, except in the event of:

• commencement of a contractual relationship;
• legal obligations;
• disputes;
• need to protect a right.

11.3 Google Analytics

Google Analytics user and event data are retained for 14 months, according to the property configuration.

Standard aggregated reports may remain available according to the technical characteristics of Google Analytics.

11.4 Cookie preferences

Cookie preferences are retained for at least 6 months, unless withdrawn earlier or unless significant changes to the processing occur.

11.5 Voluntary communications

Communications are retained for the time necessary to:

• respond;
• manage the request;
• document activities;
• comply with legal obligations;
• protect rights.

11.6 Backups

Copies contained in backups are deleted according to the ordinary technical retention cycles applicable to the relevant system.

12. Automated decision-making processes

Data collected through the website are not used for:

• fully automated decisions producing legal effects;
• employment profiling;
• automated evaluation of candidates;
• personalised advertising;
• remarketing;
• automated commercial profiling.

Google Analytics is used solely for statistics and website improvement.

13. Data subject rights

Where applicable, the data subject may exercise the rights provided by law, including:

• obtaining confirmation that processing exists;
• accessing their data;
• requesting rectification;
• requesting erasure;
• requesting restriction;
• objecting to processing;
• requesting portability;
• withdrawing consent;
• lodging a complaint with the supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Requests may be sent to:

privacy@igesa.it

or via PEC:

igesa@pec-legal.it

IGESA may request information necessary to verify the requester's identity.

14. Complaint to the Authority

The data subject may lodge a complaint with the:

Garante per la protezione dei dati personali

according to the procedures available on the Authority's institutional website.

The right to refer the matter to the competent judicial authority remains unaffected.

15. Links to external sites

The website may contain links to external services, including the HR Flow application.

External sites operate according to their own terms and notices.

Users are invited to read the notices of the services they visit.

16. Minors

The HR Flow website is intended for companies, professionals, and organisations.

It is not directly intended for minors and is not designed to knowingly collect minors' data through the demo form.

17. Security

IGESA adopts technical and organisational measures intended to protect data from:

• unauthorised access;
• loss;
• alteration;
• disclosure;
• destruction;
• unlawful use.

No system can, however, guarantee absolute security.

In the event of an incident, IGESA applies the procedures required by law and by its organisational measures.

18. Changes to this notice

IGESA may update this notice in the event of:

• regulatory changes;
• changes to the processing;
• introduction of new tools;
• changes to Google Analytics;
• changes to providers;
• changes to retention periods;
• activation of new features.

The updated version is published on the website with the effective date.

Where changes concern cookie consent, the website may ask the user to express preferences again.

19. Contacts

For information or requests concerning data protection:

Last updated: 1 August 2026