Skip to main content
What are you looking for?

Type a word: we look through the titles and the text of every page.

Privacy

Notice on the processing of personal data

Provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). It concerns people who visit this site and people who write to us through its forms.

Last updated: 19 October 2026

1. Who the data controller is

The data controller is Skill-box S.r.l.. For any question about this notice, or to exercise your rights, you can write to privacy@skill-box.com.

Registered office
Via Guelfa 76 – 40138 Bologna (BO)
E-mail
privacy@skill-box.com
PEC
skill-box@pec.it
Phone
0733 815791
VAT no.
02588581203

Skill-box S.r.l. is not required to appoint a data protection officer (DPO).

2. What data we process

  • Browsing data. Like any web server, the server hosting this site records the IP address, the date and time of the request, the page requested and the browser used.
  • Data you write in the forms. Request for information or a demo: name, company (optional) and e-mail. Contact page and a course's «Ask for information»: name, e-mail and, if you wish, surname, company, phone and message. «Work with us»: name, e-mail and, if you wish, a message.
  • Data that comes with every request. Together with what you write we record the language and address of the page the request was sent from, including any campaign parameters that brought you to us (UTM codes), the course it refers to if it started from a course page, the date, the version of this notice you were shown, the browser used and the IP address in pseudonymised form: a code derived from it that does not show it in clear, used only to counter automated submissions and abuse.
  • Statistical data about your visit, only if you accept analytics cookies: see section 5.

We do not ask for special categories of data, meaning those listed in Art. 9 of the GDPR: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data used to uniquely identify a person; data concerning health, sex life or sexual orientation. Please do not write them in the message field.

If you write more data in the message than we ask for, we process it in compliance with the law, and we delete whatever is not needed to answer your request.

3. Why we process it, and on what legal basis

  • Running and protecting the site, including countering automated form submissions: the controller's legitimate interest in the security of the service (Art. 6(1)(f) GDPR).
  • Answering a request you made — information, a demo, a quote, a course: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).
  • Assessing an application sent with «Work with us»: pre-contractual measures at your request (Art. 6(1)(b) GDPR). Consent is not required for unsolicited applications (Art. 111-bis of the Italian Privacy Code).
  • Producing visit statistics with Google Analytics: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code), which you can withdraw at any time.
  • Complying with legal obligations and, where necessary, establishing or defending our rights: legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR).

We do not use form data to send you marketing you have not asked for. We make no decisions based solely on automated processing and we do no profiling.

Our newsletter is published on LinkedIn: you subscribe there, under LinkedIn's privacy notice. This site does not collect subscriptions.

4. Do you have to give us your data?

Browsing data is needed to show you the site. In the forms only the fields marked as required are mandatory: without them we cannot answer you. Consent to analytics cookies is free, and refusing it changes nothing in how you can use the site.

5. Visit statistics (Google Analytics)

We use Google Analytics 4, loaded through Google Tag Manager, and only if you accept analytics cookies in the banner. Until you accept, the site loads nothing from Google: no script, no request, no cookie.

If you accept, Google Analytics records information about the visit: the pages viewed and time spent, the referring page, the type of device and browser, the language and an approximate location derived from the IP address, which Google Analytics does not store. It recognises you from one visit to the next through a random identifier saved in the «_ga» cookies: this is pseudonymous data, not anonymous data.

It also records some actions on the site, as codes and never as content: a successfully sent form (which form and, if it concerns a course, which course — never the data you entered), opening a course page and clicks on «Ask for information», «Watch the demo», «Request a demo» and «Request a call».

Advertising features are switched off. The site tells Google that your consent covers analytics only and not advertising, and Google Signals is disabled: the data is not used to profile you or to show you ads, on this site or elsewhere.

The provider is Google Ireland Limited, which processes the data on our behalf as a processor; the data may be transferred to Google LLC in the United States (section 8). Data collected by Google Analytics is kept for no longer than 14 months.

You can withdraw your consent at any time from the «Manage cookie preferences» link at the bottom of every page: from then on Google Analytics is no longer loaded and its cookies are deleted from your browser. Each cookie is described in the cookie policy.

6. How we process the data

Data is processed electronically, by the people at Skill-box S.r.l. authorised to do so and with appropriate security measures. Requests sent through the forms reach our contact management system and, as a notification, an internal mailbox.

Fonts, images and icons are hosted on our own domain. Course covers and demo videos — the latter only when you choose to play them — come from other Skill-box S.r.l. domains. Without your consent to analytics, the site contacts no third-party service.

Links to our LinkedIn profiles take you to LinkedIn's website: until you open them, LinkedIn receives nothing from this site.

7. Who we share the data with

  • The people at Skill-box S.r.l. authorised to process it.
  • The providers of the technical services the site uses — hosting of the site and systems, e-mail — appointed as processors under Art. 28 GDPR.
  • Google Ireland Limited, for visit statistics, only if you have given consent.
  • Public authorities, when the law requires it.

We do not sell your data and we do not publish it. The up-to-date list of processors is available by writing to privacy@skill-box.com.

8. Transfers outside the European Union

With Google Analytics, data may be transferred to Google LLC in the United States. Google LLC participates in the EU-US Data Privacy Framework, recognised as adequate by the European Commission in its decision of 10 July 2023; the transfer is also covered by the standard contractual clauses approved by the Commission.

Should another provider process data outside the Union, this will only happen towards countries with an adequacy decision or with the safeguards set out in Articles 44-49 GDPR, and we will say so on this page.

9. How long we keep the data

  • Browsing data in the server logs: for as long as needed to keep the site secure and working, unless it is needed to investigate a computer crime.
  • Requests sent through the forms: for as long as needed to handle the request and any business relationship that follows; then they are deleted.
  • Applications: up to 12 months from when they are sent, so that we can also consider them for positions that open in that period; then they are deleted.
  • Google Analytics statistics: no longer than 14 months. How long the cookies last is in the cookie policy.
  • Your cookie choice: 6 months, in your browser; then the banner asks you again.

If data is needed to comply with a legal obligation or to defend our rights, we keep it for as long as that obligation or defence requires.

10. Your rights

At any time you can ask us:

  • to access your data and to know how we process it (Art. 15 GDPR);
  • to correct it (Art. 16) or erase it (Art. 17);
  • to restrict its processing (Art. 18);
  • to receive it in a machine-readable format, to pass it to another controller (Art. 20);
  • to object to processing based on our legitimate interest (Art. 21);
  • to withdraw your consent to analytics, without affecting the lawfulness of what was done before the withdrawal (Art. 7).

To exercise them, write to privacy@skill-box.com: we answer within one month. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

11. If this notice changes

When the processing changes we update this page and the date at the top. If the change concerns analytics cookies, the banner asks for your choice again.

Events – Webinars Notice

1. Types of data processed/processable

For the purposes of the GDPR, “personal data” means any information that relates to you, directly or indirectly, as a Data Subject, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to your physical, physiological, genetic, mental, economic, cultural or social identity. The user’s personal data (first name, surname, e-mail address, tax and banking details, etc.) will be processed for the purpose of taking part in the training course, whether in person or in other forms, including teleconference (webinar).

2. Data controller

The data controller of the personal data is Skill-box S.r.l..

The Data Controller does not carry out activities that require the appointment of a Data Protection Officer.

3. Purposes of processing

  • Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the data subject’s request prior to entering into a contract (contract/service, performance of the requested measures, participation in a training event, whether in person or in other forms including teleconference, attendance checks, issue of a certificate).
  • Video recording of the event, which also involves identifying the Data Subject when they join the event as a participant by teleconference (webinar), and recording the chat messages and questions they submit.

4. Legal basis

  • Art. 6(1)(b) GDPR: processing is necessary for the performance of a contract/service to which the data subject is party.
  • Art. 6(1)(f) GDPR: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

5. Types of data and retention period

The personal data processed will be those needed to use the service (first name, surname, e-mail, company and role, which you enter in the registration form), attendance data recorded by Teams (time of joining and leaving and length of attendance), and any data you choose to provide in the chat and questions section. The data will be kept for as long as necessary for participation in the training event, whether in person or by teleconference, and then deleted. Video recordings will be kept for 24 months from the date of recording.

6. Whether providing the data is mandatory

Providing the data for the purposes set out in section 3 is necessary for the performance of the contract and/or the provision of the service. If the data is not provided, it will not be possible to take part in the training event, whether in person or in other forms, including teleconference.

7. How the data is processed

Webinars take place on Microsoft Teams after registration through the Microsoft Teams event registration site, which operates as a third party; the account created is governed by Microsoft’s terms of use and privacy statement. For data concerning participation in the event, the data controller is Skill-box S.r.l..

The personal data will be processed manually and/or electronically and kept in dedicated paper and/or electronic archives. Paper and electronic records will be properly maintained and protected for as long as processing requires, using appropriate security measures to minimise the risks of destruction or loss, unauthorised access, or processing that is not consistent with the purposes for which the data was collected. There is no automated decision-making and no profiling is carried out.

8. Transfer of data to a third country

To perform the contract, we will mainly use video/teleconferencing services provided by third parties, whose privacy policies can be consulted; we will select platforms that comply with the safeguards set out in Regulation (EU) 2016/679 and do not involve transfers of data to third countries or, where they do, we will verify that the platform provider participates in the Data Privacy Framework (the new EU-US agreement on transfers of data to the United States – adequacy decision of 10 July 2023). The platform used is Microsoft Teams, whose providers have been verified as participating in the Data Privacy Framework.

9. Recipients or categories of recipients of the data

Data will be disclosed to the identified recipients only where they are involved in, and needed for, achieving the purposes stated above; the personal data collected and processed may therefore be:

  • used in anonymised form for statistical purposes;
  • made available to the Controller’s Collaborators, as Processors or persons authorised to process personal data;
  • disclosed to third parties, whether natural or legal persons, public administrations, professional bodies, organisations, trade associations, professionals, law enforcement, government agencies, regulators, courts or other public authorities authorised by law;
  • parties providing services for managing the information system and communication networks (including e-mail);
  • webinar platform operators.

The list of Processors of personal data is available at the Data Controller’s registered office.

10. Rights of data subjects

As a Data Subject, you have all the rights provided by Articles 15 to 22, including:

  • The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed and, where that is the case, access to the personal data and the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; d) where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject, or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
  • the existence of the right to data portability, including any available information as to the source of the data; and the right to obtain the erasure of personal data concerning them without undue delay under Article 17 («right to be forgotten»).
  • where processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
  • the right to lodge a complaint with a supervisory authority;
  • to obtain from the controller a copy of the personal data undergoing processing, provided that this does not adversely affect the rights and freedoms of others; for any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the request is made by electronic means, and unless otherwise requested, the information will be provided in a commonly used electronic form;

The above information will be provided within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed; if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or, if disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

All the data subject’s rights under the GDPR are exercised by an informal request addressed to the Data Controller, including through a representative, and will be answered without delay.