INFORMATION ON THE PROCESSING OF PERSONAL DATA

pursuant to Art. 13 of Regulation (EU) 679/2016 (the “GDPR”)

This notice describes the processing of personal data of users (collectively, “Users”) of the AchilleS Vaccines website, which can be reached at https://www.achillesvaccines.com/ (“Site”).

1. HOLDER OF DATA PROCESSING
The data processing holder is Achilles Vaccines S.r.l. with registered office in Siena, 53100, Via Fiorentina, 1, VAT number 01457150520 (“Holder”).
In case of doubts about how the Holder processes the data, it is always possible to contact them:

• at the email address privacy@achillesvaccines.com
• at the address Via di Città, 43 – Siena, 53100.

*************

The information found on this page does not apply to sites, apps, social networks and third party content of any kind, even if accessible from the Site by clicking on links in it or on the appropriate social buttons.

In these instances, the data protection provisions of such third parties may be applicable, which may be different from these and which we advise you to consult before disclosing any data.

2. COLLECTED DATA

2.1. Navigation data collected automatically by the Site
Whenever Users access the Site, the computer systems and software procedures used to operate the Site acquire, during their normal operation, the access and navigation data (for example: information on the browser used by the User, pages visited, date, time and duration of each visit, as well as other parameters relating to the operating system and the IT environment of the User).
The data collected is exclusively anonymous and aggregated data, and therefore cannot lead to the identification of Users. The information collected simply makes it possible to detect and resolve any technical problems.

2.2. Data communicated by Users to get in touch with the Holder
Through the Site it is possible to contact the Holder, by using the contact details of the various seats and offices (address, telephone and e-mail) or by filling out the appropriate online form on the “Contacts” page of the Site, to request information on the activities and services of the Holder or to get in touch with the Holder and propose partnerships and clinical collaborations.

The data collected includes identification and contact data of Users (e.g. name and e-mail address), as well as personal data transmitted voluntarily and included in communications to the Holder.
We recommend that Users only provide updated and relevant data that does not exceed the specific purposes of the processing. Any unnecessary data will be immediately deleted or anonymized.

2.3. Data provided by Users to submit professional applications
In the “Career” section you can send your job application to the Holder and allow the Holder to evaluate your professional profile. To submit your application, you must fill out the form in the “Careers” section of the Site, enter your personal data and attach your curriculum vitae. The personal data collected include identification data (name and surname), contact details (e-mail and telephone), as well as personal data voluntarily provided by the User within the curriculum vitae and in the message sent to the Holder.
We advise that Users only provide updated and relevant data that does not exceed the specific purposes of the processing. Any unnecessary data will be immediately deleted or anonymized.

2.4. Cookies
The site uses computer techniques for the direct acquisition of the user’s personal identification data consisting of “code strings”: “cookies”.
All information on active cookies on the Site and on the related processing of personal data are listed in point 9 below.

3. PURPOSE OF THE DATA PROCESSING
The personal data of the Users of the Site may be processed for the following purposes.

3.1. Navigation data
The navigation data will be used: (i) in order to monitor the correct functioning of the Site, (ii) in anonymous and aggregate form, for statistical purposes related to the understanding of how the Site is used by Users, to improve ease of access and increase its attractiveness, as well as (iii) to detect any technical problems as soon as possible.
The information is collected automatically by the Site and does not require any action on the part of the User.
This processing finds its legal basis in the legitimate interest of the Holder to improve its digital services, especially in relation to the use of the Site, and it is compatible with the position of the interested parties as: (a) monitoring the functioning of the Site and statistical data related to its use does not involve direct identification; and (b) the interest of the holder reasonably appears to be also shared by the users, who will thus be able to benefit from an increasingly efficient and optimized site.

3.2. Respond to Users’ requests
The data communicated by Users by filling out the “Contacts” form or transmitted voluntarily using the contact and address data of the Holder indicated in the Site, will be processed to respond to requests made by Users and sent to the Holder.

The legal basis of this data processing is the legitimate interest of the Holder to respond to Users’ requests for information; the interest of the Holder appears reasonably also shared by the Users, who will thus be able to receive an answer or be contacted by the Holder.

The provision of data takes place on a voluntary basis and it is necessary to allow the Holder to receive and respond to Users’ requests. In case of failure to communicate the data, Users can still browse the Site but it will not be possible for the Holder to follow up on the User’s requests.

3.3. Professional applications
The data collected by filling out the form in the “Careers” section of the Site and by sending your curriculum vitae will be processed for the evaluation of the professional application submitted by the User and for the start of the selection procedure aimed at establishing a working relationship with the Holder.
The legal basis of this data processing is the need to carry out pre-contractual and contractual measures adopted upon request of the User, and to fulfill the related legal obligations.
The provision of data takes place on a voluntary basis and it is necessary to allow the evaluation of the User’s professional profile. In case of failure to communicate the requested data, it will not be possible for the Holder to follow up on the User’s request and evaluate his application.
The data collected by the Holder for the purposes referred to under point 3 above (from point 3.1 to point 3.3), hereinafter jointly the “Data”.

4. METHODS OF DATA PROCESSING
The Data will be processed both in paper form and with electronic, IT or automated tools, through systems that ensure their protection, security and confidentiality. The Data will be stored by the Holder on the company’s servers and will be processed by subjects (employees and collaborators) duly authorized to process and to whom the Holder has given adequate operating instructions with particular reference to the security measures adopted.
Furthermore, the Holder has adopted specific and adequate logical, legal, organizational and technical security measures to prevent the loss of Data, illicit or unauthorized use of the same and unauthorized access.

5. COMMUNICATION OF DATA and RECIPIENTS OF DATA
The Data may be known by employees and / or collaborators of the Holder, specifically designated as persons authorized to process (such as, by way of example, the persons in charge of the administrative, accounting and information systems functions).
The User Data may also be disclosed to third parties who provide ancillary or related services to the management of the Site and its functions. In this case, the third party recipients of the Data – independent data holders or duly designated as data holders – belong to the following categories:
A. companies providing software and IT services for internal business management (i.e. Silog Srl for Achilles’ 1st and 2nd level Help Desk service; Microsoft Office 365 provided by Microsoft Corporation; and software for managing the personnel provided by the company Zucchetti S.p.A.).

6. DISCLOSURE OF DATA
The data will not be disclosed.

7. RETENTION PERIOD
The Data collected and processed by the Holder, for the purposes identified under point 3 above, may be stored in a form that allows the identification of the User for the period necessary to achieve the objectives of the processing and, in particular:

• the navigation data are not kept for more than [seven days] and are deleted immediately after their aggregation (except for any need to ascertain crimes by the competent judicial authority);
• for the processing referred to under point 3.2 aimed at answering the User’s requests, the data communicated by the User are kept for up to 12 months after receiving the request;
• for the processing referred to under point 3.3, i.e. for the evaluation of the User’s candidacy, the data are kept for no more than 12 (twelve) months from the date of receipt of the application if the profile is not in line with the needs of the Holder; or, in the case of the establishment of a contractual, work, collaboration or internship relationship, the data are kept for the entire duration of the relationship and for the subsequent period necessary to fulfill the related legal obligations in relation to tax and accounting matters

The Data may be kept for longer periods where necessary to fulfill legal obligations, or to protect the rights of the Holder, until the related limitation period expires.

8. USER RIGHTS AND CONTACT DATA
The User may, at any time and to the extent that the rights are applicable: (I) obtain confirmation of the existence or not of personal data concerning him/her; (II) request access to their personal data; (III) request the rectification, cancellation or limitation of the processing of personal data; (IV) oppose the processing, or revoke the consent to the processing, without prejudice to the lawfulness of the processing on the basis of the consent given before the revocation; (V) receive in a structured format, commonly used and readable by an automatic device, the personal data concerning him/her provided to the Holder, as well as request that such data be transmitted to another Holder (right to the portability of personal data); (VI) lodge a complaint with the Guarantor for the protection of personal data, or appeal to the competent judicial authority.
Requests to exercise the above rights must be sent to one of the following addresses:

• by email at the address privacy@achillesvaccines.com
• by post to the Administrative Office at AchilleS Vaccines S.r.l., Via di Città 43, Siena.

Requests relating to the recipients of the Data, as well as requests for clarification regarding this notice may also be addressed to the same addresses.