This notice explains how we process the personal data collected through the website infrastrutturapersone.com and the domain infrastrutturapersone.it, which redirects to it (together, the “Site”), and through the services connected to it, in compliance with Regulation (EU) 2016/679 (“GDPR”) and the applicable rules on personal data protection and cookies.
This is an English translation of our Italian privacy policy. If the two versions differ, the Italian version prevails.
1.Data controller
The data controller is MARDEF CONSULTING FZCO, with registered office at IFZA Business Park, DDP, Dubai Silicon Oasis, Dubai, United Arab Emirates (License no. 18873), which operates under the brand “Infrastruttura Persone” (also “we” or “us”).
For any question about the processing of your data, to exercise your rights or for general requests, you can write to amministrazione@infrastrutturapersone.com.
Representative in the European Union (art. 27 GDPR). Since the controller is based outside the European Union, it has appointed DataRep (Data Protection Representative Limited) as its representative in the EU. You can contact DataRep for any question about the processing of your personal data:
- by filling in the form at www.datarep.com/data-request;
- by writing to datarequest@datarep.com;
- by post, addressing the letter to “DataRep” and not to us directly, at Viale Giorgio Ribotta 11, Piano 1, 00144 Rome, Italy, or at 77 Camden Street Lower, Dublin, D02 XE80, Ireland.
In every communication, please state that your request concerns MARDEF CONSULTING FZCO (Infrastruttura Persone).
2.What data we collect
Depending on how you use the Site, we may process the following categories of data:
a) Data you give us voluntarily
When you fill in a form (contact request, multi-step popup, quiz, candidate or freelance form) or book a call, we collect the data you enter, in particular:
- contact details: first name, last name, email address, phone number;
- professional and B2B commercial qualification data: type of business, sector, role being sought, urgency, type of sale, channel, source of contacts, scope, expectations and characteristics of the profile being sought, as well as the answers given in the quiz;
- for those who apply as freelance professionals (freelance list): specialisation, years of experience, rate, professional background, LinkedIn profile and any free-text messages;
- the content of the communications you send us (emails, messages in forms).
b) Data collected automatically while you browse
When you visit the Site, for technical and statistical reasons data such as IP address, type of device and browser, pages visited, referring page and date/time of access may be collected, through cookies and similar technologies (see the Cookie Policy, in Italian).
c) Marketing data and identifiers
If you reach the Site from an ad or a campaign, we may collect the tracking parameters (UTM: source, medium, campaign, term, content) and the click identifiers Google Click ID (gclid) and Facebook Click ID (fbclid), and link them to your request. With your consent, we also use the pixels and advertising tools of Meta (Facebook/Instagram) and Google to measure conversions and optimise campaigns (see the Cookie Policy).
3.Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering requests for information and contacting you back | Pre-contractual measures and/or legitimate interest in following up on your request (art. 6.1.b / 6.1.f GDPR) |
| Providing the services (e.g. “Assunzioni Chiavi in Mano”, Employer Branding, Talent Acquisition in Affitto, Campaign Management) | Performance of the contract (art. 6.1.b GDPR) |
| Managing the list of freelance professionals and matching them with client companies | Consent and/or pre-contractual measures (art. 6.1.a / 6.1.b GDPR) |
| Sending marketing communications, remarketing and measuring advertising campaigns | Consent (art. 6.1.a GDPR and ePrivacy rules) |
| Statistical and marketing cookies | Consent (art. 6.1.a GDPR) |
| Inviting clients to leave a public review on the Trustpilot platform at the end of the service | Legitimate interest in collecting feedback on the quality of the service and in making clients’ experience public (art. 6.1.f GDPR). You can object at any time |
| Complying with legal and accounting obligations, and defending ourselves in legal proceedings | Legal obligation and legitimate interest (art. 6.1.c / 6.1.f GDPR) |
Providing the data marked as mandatory in the forms is necessary for us to contact you back or provide the service: without it we cannot follow up on your request. Providing data for marketing purposes is optional and can be withdrawn at any time.
4.Tools and recipients of the data
The data are processed by our authorised staff and by suppliers acting as data processors or as independent controllers. In particular, we use:
- HighLevel Inc. (GoHighLevel / LeadConnector): the CRM where leads arrive, management of communications, of booking calendars (widgets embedded in the Site) and document hosting;
- Vercel Inc.: hosting and delivery of the Site;
- Meta Platforms, Inc. and Google LLC / Google Ireland Ltd.: pixels, statistics and advertising tools (Google Analytics, Google Ads, Meta Ads), subject to consent;
- Google LLC (YouTube) and Wistia, Inc.: playback of the videos embedded in some pages of the Site;
- Trustpilot A/S (Denmark): review platform. At the end of the service we give Trustpilot the client’s name and email address, for the sole purpose of sending an invitation to leave a review on our public page;
- Hostinger International Ltd.: dedicated private server hosting the candidate database and our work tools, in a data centre in the European Union (France);
- Google LLC / Google Ireland Ltd. (Google Workspace): email, documents shared with client companies and storage of CVs;
- Anthropic PBC: artificial intelligence tools used to support the reading of applications (see section 5, “No automated decisions”);
- Resend: sending emails to candidates;
- WhatsApp (Meta Platforms Ireland Ltd.): messages with candidates who gave us their phone number;
- consultants, professionals and authorities, where required by law.
The data are not disclosed or sold to third parties for purposes other than those stated.
Invitations to leave a review
At the end of the service, and in any case not before the engagement has been invoiced, we send clients an invitation to leave a review through Trustpilot. The invitation is sent only once to each client and according to an automatic criterion that is the same for everyone: we do not select recipients based on their presumed satisfaction and we do not influence the content of the review in any way.
For this purpose we give Trustpilot only the name and email address. Trustpilot acts as an independent controller for the collection, publication and moderation of reviews, under its own privacy policy, available at legal.trustpilot.com. Once published, the review is publicly visible together with the name chosen by its author.
You can object at any time to receiving review invitations by writing to amministrazione@infrastrutturapersone.com, with no effect whatsoever on the service.
5.Candidates’ data in selection processes
Who is the controller of a candidate’s data depends on where the application was collected. Every form always states, before you send it, who receives the data and under which privacy notice.
a) Applications collected on a system built for a Client company
When we build the selection system on a Client company’s accounts, candidates’ data (CV, personal details, test answers, assessments) land directly on systems owned by the Client, which is the independent controller. MARDEF CONSULTING FZCO provides the technology and marketing infrastructure and acts as data processor on behalf of the Client, for the purposes of the service only. We delete the copies in our possession within 30 days of the end of the search or of the delivery of the system, subject to legal obligations. Those candidates are not reused for other companies: consent was given to the Client, not to us.
b) Applications collected on our own channels
When a company entrusts us with the search and we use our own tools, ads and campaigns, we are the controller, MARDEF CONSULTING FZCO. The application is passed on to the company concerned only with the candidate’s specific consent for that single presentation: from that moment the company becomes an independent controller of that candidate’s data. We keep the data of those who did not agree to be contacted again until the search is closed; for those who agreed, for up to 24 months, after which the data are deleted or consent is renewed.
What we pass on to the company
The company receives only the data it needs to assess you: name, email address, CV, results of the tests and of any practical test, a summary of the interview you had with us, and the availability and expectations you told us. Your phone number is not passed on: we handle the contacts up to the interview with the company. We do not ask you for data about your health, political or religious opinions, trade union membership or criminal convictions, and if you tell us, we do not report them to the company. Until the company has given us a final answer on your profile, we do not present it to other companies.
c) Professional network and open positions
For the “Entra nel Network” and “Lavora con noi” sections, we collect the professional’s contact details directly and we are their controller. Applications sent through “Posizioni aperte” are processed only to assess a possible collaboration with Infrastruttura Persone.
Two separate consents, never combined
In every application form you find two separate boxes: a mandatory one for the processing of data for that application, and an optional one to be contacted in the future about other opportunities. The second is never pre-ticked and you can send the application leaving it empty. You can withdraw your consent at any time: every email we send contains instructions on how to do it.
No automated decisions
We use artificial intelligence tools to analyse and sort applications, but no candidate is excluded by an automated system. Every assessment produced by AI is reviewed by a person before it has any consequence, and we do not send negative outcome messages automatically. We therefore do not make decisions based solely on automated processing within the meaning of art. 22 GDPR. In any case you have the right to ask for human intervention, to express your point of view and to contest the assessment by writing to the addresses given in this notice.
6.Transfer of data outside the EU/EEA
Candidates’ data are stored on a server in the European Union (France). The controller is based in the United Arab Emirates, a country for which there is no adequacy decision: authorised staff work in Italy and in the Emirates, and access the data from both countries. The GDPR applies in any case to the processing we carry out (art. 3(2)). Since some suppliers (e.g. HighLevel, Vercel, Meta, Google, Wistia, Anthropic, Resend) are based or have servers in the United States, data may also be transferred outside the European Economic Area. These transfers take place in compliance with arts. 44 et seq. GDPR, on the basis of Standard Contractual Clauses (SCC) approved by the European Commission and/or adequacy decisions (including, where applicable, the EU-US Data Privacy Framework for certified suppliers), with adequate safeguards to protect your data.
7.Retention period
- data of leads who did not become clients: up to 24 months from the last contact, unless withdrawn earlier;
- clients’ data: for the duration of the relationship and afterwards for the limitation periods and legal obligations (generally up to 10 years for accounting documents);
- data processed for marketing: until consent is withdrawn or you object;
- data given to Trustpilot for the review invitation: kept by Trustpilot under its own retention policy; any published review remains online until you ask Trustpilot to remove it;
- data collected through cookies: for the duration stated in the Cookie Policy.
8.Your rights
At any time you can exercise the rights provided by arts. 15-22 GDPR, namely:
- access your data and obtain a copy;
- ask for them to be corrected or updated;
- ask for them to be deleted, restrict their processing or object to it;
- obtain data portability;
- withdraw the consent you gave, without affecting the processing carried out before the withdrawal.
To exercise your rights, write to amministrazione@infrastrutturapersone.com, or to our representative in the EU, DataRep, at the contacts given in section 1. You also have the right to lodge a complaint with the competent supervisory authority: in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).
9.Minors
The Site and the services are aimed at a professional (B2B) audience and are not intended for people under 16. We do not knowingly collect data of minors; if we become aware of it, we will delete them.
10.Changes to this notice
We may update this notice to reflect changes in the law or in our processing. The version published on this page, with its date of update, is the one in force.