Privacy notice on the processing of personal data

This notice explains how HODA SpA (“Hoda” or the “Company”) processes the personal data of people who visit the website hoda.digital, including its English pages (hoda.digital/en/), and of people who use the forms on the site. It is provided under Article 13 of Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”).

1. Who processes your data

The Data Controller is the party that decides the purposes and means of the processing. For the website hoda.digital the Controller is:

For any question about this notice, about the processing of your data or about the parties involved, and to exercise your rights (§ 9), you can write to info@hoda.digital or to DPO@hoda.digital. Hoda is glad to clear up any doubt you may have.

2. Which data we process

2.1 The data you enter in the forms

The site has two forms addressed to companies. By filling them in you give us:

• “Contact” form (on the home page and on the For companies page): full name, email address and your message, that is, the goal you are writing to us about; optional: company and telephone number;
• “Wekosmos AI preview” form (on the For companies page): full name, company and work email address; optional: your role in the company.

The mandatory data are those indicated as such above: without them we cannot follow up on your request; the others are optional. In the message, write only what is needed for the request: we do not need any other data.

2.2 Browsing data

Like every website, hoda.digital runs on a server that records in its log files some technical information generated automatically by the connection: the IP address of the device, the date and time of the request, the page requested, the outcome of the request, the type of browser and operating system. This information is needed for the operation and security of the site (for example to recognise an attack or a malfunction) and is not associated with identified persons. From these logs we derive only aggregate statistics — how many visits, to which pages, at what times — which contain no personal data.

2.3 Applying as a Weople³ tester

The Weople³ page lets you apply as a tester of the forthcoming app. This application collects no personal data: we do not ask for a name, an email address or a telephone number. The site generates a random code, which is the only key to the application, and the program that records it keeps only the code, the language of the page and the time of registration — not the IP address nor anything else. The code is not linked to any identity and does not allow anyone to trace it back to you; for this reason, if you lose it, we cannot recover it. What remains are only the technical server logs described in § 2.2, which are not linked to the code.

3. Why we process your data

Your personal data are processed for the following purposes:

1. to answer your request: to follow up on a contact or to arrange the Wekosmos AI preview. Data processed: those in § 2.1;
2. to run the site and protect it. Data processed: those in § 2.2;
3. to produce aggregate statistics on the use of the site (visits, pages, times) from the server logs, without any personal data. Data processed: those in § 2.2;
4. to comply with obligations laid down by law, by a regulation, by European legislation or by an order of the Authority. Data processed: those in § 2.1 and 2.2;
5. to protect the rights and interests of Hoda, including in court. Data processed: those in § 2.1 and 2.2.

4. On which legal basis

Article 6 of the GDPR allows personal data to be processed only where there is a legal basis: before the processing begins you have the right to know what the “justification” for each purpose is. For the purposes in § 3:

• purpose a): your consent, which you give with the checkbox in the form before sending (Art. 6(1)(a)), and the performance of steps you ask us to take prior to a possible contract (point (b)). You can withdraw your consent at any time by writing to the addresses in § 1; withdrawal does not affect the lawfulness of the processing carried out before it;
• purposes b) and c): Hoda’s legitimate interest in keeping the site working and secure and in knowing how it is used in aggregate form (point (f));
• purpose d): compliance with a legal obligation (point (c));
• purpose e): Hoda’s legitimate interest in protecting its own rights (point (f)).

We are always available to clear up any doubt about the legal basis used for the various purposes.

5. How and for how long we process the data

The processing is carried out with electronic tools, in compliance with the principles of lawfulness, fairness, transparency, data minimisation and proportionality laid down by the GDPR, and with measures suitable to guarantee the integrity, availability and confidentiality of the data.

The data are processed by Hoda staff who are expressly authorised and by external suppliers acting on behalf of Hoda as Data Processors (Art. 28 GDPR). In particular, the site, its database and the mailbox that receives the forms are hosted by OVHcloud, a provider of hosting and email services, on servers located in the European Union. You can ask us at any time for the up-to-date list of Processors.

The data from the forms (§ 2.1) are kept for the time needed to handle the request and in any case no longer than 24 months from the last contact with you, except where the law requires otherwise or where they are needed for protection in court. Browsing data (§ 2.2) are kept for the time strictly necessary for the security and operation of the site.

6. Where we process the data

The data are processed at Hoda’s offices in Milan and on the servers of the Processors indicated in § 5, all within the European Union. Your data are not transferred outside the European Union.

7. To whom we disclose the data

Your data are not disclosed to third parties nor disseminated. They can be accessed only by Hoda’s authorised staff and by the Data Processors indicated in § 5; they may be disclosed to the Authorities in the cases provided for by law.

8. Cookies and tracking tools

This site uses no cookies, nor any other tracking tool or storage on your device. It uses no traffic-analysis services (such as Google Analytics), embeds no third-party content — even the typefaces are hosted on the site itself — and does not profile you. This is why there is no banner to accept. The only information the site receives is the browsing data described in § 2.2 and what you choose to write in the forms.

9. Your rights

Within the limits and under the conditions laid down in Articles 15 to 22, the GDPR gives you the right to:

1. obtain access to your data and the rectification of inaccurate data, as well as the completion of incomplete personal data;
2. obtain the erasure of data processed in breach of the law, including data whose retention is not necessary in relation to the purposes for which they were collected or subsequently processed. A request for erasure cannot be granted where the Company needs to process the data to comply with a legal obligation or to establish, exercise or defend a right in court;
3. obtain the restriction of processing where the accuracy of the personal data is contested, for the period the Company needs to verify their accuracy; or where the processing is unlawful; or where the data, although no longer needed for the purposes of the processing, are nevertheless needed by the data subject to establish, exercise or defend a right in court; or where the data subject has objected to the processing, for the period needed to verify whether the Company’s legitimate grounds override those of the data subject;
4. receive the personal data concerning you in a commonly used, machine-readable format;
5. object, on grounds relating to your particular situation, to processing that is necessary for the performance of a task carried out in the public interest or for the pursuit of the legitimate interests of the Company or of third parties. The Company may continue the processing where it demonstrates compelling legitimate grounds for the processing which override the rights, interests and freedoms of the data subject, or for the establishment, exercise or defence of a right in court. The data subject may also object to the processing of data for direct-marketing purposes, including profiling to the extent that it is related to such direct marketing;
6. ask not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject, except where the profiling is necessary for entering into or performing a contract;
7. withdraw at any time the consent given, without affecting the lawfulness of the processing based on consent before its withdrawal;
8. lodge a complaint with a supervisory authority — in Italy the Garante per la protezione dei dati personali, www.garanteprivacy.it — or bring proceedings before a court to protect your rights.

You can exercise these rights by writing to info@hoda.digital or to DPO@hoda.digital, or by post to Hoda’s registered office indicated in § 1. The Controller facilitates the data subject’s requests and undertakes to reply within one month of receiving the communication; the deadline may be extended by two months in the cases provided for by Article 12 of the GDPR.

10. Updates to this notice

This notice may be updated, for example if the site’s forms or suppliers change. The version in force is always the one published on this page, with the date of the last update shown at the top.

Back to home