Privacy Policy

Data provided through the contact form

By filling in the contact form on the Website, you voluntarily provide the following data: name, email address, organization (optional), and message text. Submitting the form also records confirmation that you have reviewed this privacy policy.

Providing your name, email address and message text is necessary to allow the Data Controller to respond to your inquiry: without them the form cannot be submitted. Providing your organization is optional and its omission has no consequence. Ticking the box confirming that you have reviewed this privacy policy is likewise required in order to submit, and serves solely to document that the policy was made available to you.

Email communications

The Website publishes certain contact email addresses. By writing directly to these addresses, you provide the Data Controller with your email address and any data contained in your message. Such data is processed for the same purposes and on the same legal bases as inquiries submitted through the contact form, and is retained for the period set out in section 6. Unsolicited job applications are governed by the following paragraph.

Unsolicited job applications

If you send an unsolicited application to one of the email addresses published by the Data Controller, the Data Controller processes the data contained in your message and in your curriculum vitae — typically identification and contact details, education, professional experience and any other information you choose to include — solely in order to assess the application and, where appropriate, to contact you with a view to possibly entering into an employment or collaboration relationship. The Website has no dedicated application form and does not allow files to be uploaded; this paragraph nevertheless applies to any application sent through the contact form, without prejudice to what section 4 says about the delivery of contact form messages. Pursuant to Art. 111-bis of Italian Legislative Decree 196/2003, within the limits of the purposes referred to in Art. 6(1)(b) of the GDPR, consent is not required for the processing of the data contained in spontaneously submitted curricula; the information required by Art. 13 of the GDPR is contained in this privacy policy, to which the Data Controller refers in its first reply to the candidate.

To assess an application the Data Controller does not request special categories of personal data (Art. 9 of the GDPR) or data relating to criminal convictions and offences (Art. 10): please do not include them. Any data relating to criminal convictions or offences that is nevertheless present is not used and no decision is based on it. The same applies to special categories of data that are not relevant to the application: the Data Controller does not use them, does not extract them from the document and does not copy them elsewhere, and they remain in the document received until it is deleted. Only those special categories of data that you have chosen to disclose because they are necessary for carrying out obligations or exercising rights in the field of employment law — for example, belonging to the protected categories referred to in Italian Law 68/1999 — are processed for that purpose pursuant to Art. 9(2)(b) of the GDPR, in compliance with the requirements laid down by the Italian Data Protection Authority (provision no. 146 of 5 June 2019). This is without prejudice, as regards special categories of data, to the case where such data is strictly necessary for the establishment, exercise or defence of legal claims in a dispute that has already arisen (Art. 9(2)(f) GDPR).

Sending an application is entirely voluntary. Failure to provide the data, or providing it only in part, has the sole consequence that the Data Controller will be unable to assess the application in whole or in part.

Special categories of data

The contact form and the published email addresses are intended for professional and business communications. For communications received through these channels the Data Controller neither requests nor requires special categories of personal data within the meaning of Art. 9 of the GDPR — in particular health data — or data relating to criminal convictions and offences (Art. 10): please do not include them in your messages. The Data Controller bases no decision on such data, does not extract it from the communication or organise it in dedicated archives, and deletes it as soon as the inquiry has been answered, without waiting for the ordinary retention period set out in section 6. Between receipt and deletion, no operation is carried out on such data other than deleting it. The only exception, limited to special categories of data, is where such data is strictly necessary for the establishment, exercise or defence of legal claims in a dispute that has already arisen (Art. 9(2)(f) GDPR). The foregoing does not concern unsolicited job applications, which are governed by the dedicated paragraph.

IP address used to limit contact form submissions

To prevent abusive or automated submissions, on each request to submit the contact form the Website's server reads the IP address the request comes from and uses it to limit submissions from the same address to three per minute; for IPv6 addresses the limit applies to the network prefix (the first 64 bits of the address) rather than to the full address. The count is entrusted to a service of Cloudflare, the provider on whose network the Website runs (section 4): on each request to submit the form the server passes that service the address, or the prefix, as the key to count on, and receives back only whether the limit has been exceeded. The counters are kept by Cloudflare at the data centre that received the request; as part of this limit the Website does not write the address to any other store or database and does not associate it with the data entered in the form. Only where that service is unavailable does the count take place in the server's volatile memory. As part of this limit the IP address is not disclosed to anyone other than Cloudflare. The anti-abuse check, in which Cloudflare receives the IP address directly from your browser, is described in the following paragraph. The submission request is also recorded in the server's logs like any other request that reaches it, as described in the paragraph "Navigation data".

This processing is automatic and takes place on every submission of the form: the form cannot be submitted without the IP address being read for this purpose.

Data processed by the anti-abuse check on the contact form

The contact form is protected by Cloudflare Turnstile, a service of Cloudflare, Inc. that checks that the form is being used by a person and not by an automated program. The service is not loaded when the page opens: your browser downloads it from Cloudflare's servers (domain challenges.cloudflare.com) only when, after a page has loaded, you first change one of the fields of the form — name, email, organization, message — or the checkbox: when you type the first character, paste or dictate text, tick the checkbox, or when the browser fills in a field on your behalf (autofill). It does not download it when you merely select a field — with the mouse, by touch or with the keyboard — without changing it. With one exception: if the fields were filled in before the page had finished loading, or were restored by the browser when the page was reloaded, and are not changed again, the browser downloads the service when you submit the form. A line at the top of the form, before the fields, gives notice of the check and of the saving of a code in the browser. From the moment the service is loaded Cloudflare receives, directly from your browser, the technical information (so-called signals) the service relies on; in the course of the check the browser exchanges data with that domain and, from what we observed, with one of its subdomains. According to what Cloudflare states in its own notice on the service (the Turnstile Privacy Addendum), these include the IP address, the fingerprint of the encrypted connection (TLS fingerprint), the browser's User-Agent header, the key that identifies the Website to the service, and the address of the Website; according to the technical documentation of the service, the check also runs programs in the browser which detect its technical characteristics and the signs of its being used by a person. In requesting the service your browser also tells Cloudflare, as the Website configures it, the language of the page, the theme the page is shown in, the format of the check's box and a label saying that the check concerns the contact form. According to the documentation of the service, the verification code described below expires after about five minutes and, for as long as the page stays open, the service renews it by itself, contacting Cloudflare again. Lastly, the service stores a code in your browser, distinct from the verification code, which has no set expiry and whose content and specific function Cloudflare does not publicly document: from our checks it differs for each browser and can therefore allow Cloudflare to recognise the same browser on later occasions and, depending on the browser and its settings, on other websites that use the service too. It is an online identifier (recital 30 of the GDPR), described in the Cookie Policy. This processing does not concern a visit during which neither a field of the contact form nor the checkbox is changed, whether by you or by the browser on your behalf, and the form is not submitted.

Once the check is passed, the service gives your browser a single-use code, which is sent to the Website's server together with the form data. To have the check confirmed the server sends the Turnstile service, of the data concerning you, only that code: it does not add your IP address or the data entered in the form to the confirmation request, and it delivers the message only if the confirmation is positive. The Data Controller does not keep the code on its own systems. According to the documentation of the service, the check does not access what you write in the form, does not store it and does not transmit it.

This processing is automatic and starts at the first change to a field of the form or to the checkbox, including a field filled in automatically by the browser, or, in the case described above, when the form is submitted: the form cannot be submitted without the check. If the check fails the message is not delivered, and the submission can be repeated. Anyone who prefers to avoid this processing can write directly to the email addresses published on the Website.

Navigation data

During normal browsing, the computer systems responsible for operating the Website automatically collect certain technical data. The Website is delivered through Cloudflare's network (section 4), which receives every request addressed to the Website and processes the technical data needed to answer it, including the IP address. For the requests that reach the Website's server — in particular the pages, including redirects and pages not found, the robots.txt and sitemap.xml files and the requests to submit the contact form; not static files such as style sheets, scripts and fonts — Cloudflare also records, in the logs it makes available to the Data Controller, one entry per request: the address of the page requested, the method and outcome of the request, date and time, browser type and version (User-Agent header) and network metadata, such as the country, the approximate location and the network operator the request comes from. According to the documentation of the service the entry includes the request headers, that is the technical information that accompanies every request — for example the preferred language and the referring page — among which is the IP address. To these entries are added the diagnostic messages written by the Website's server, which contain neither the data entered in the contact form nor the IP address. The Data Controller uses this data exclusively to ensure the proper functioning of the Website, to diagnose malfunctions and for cybersecurity purposes; as regards the processing the provider carries out for its own purposes, see section 4.

The collection of navigation data is automatic and inherent to the operation of internet communication protocols: it does not result from any voluntary act on your part and cannot be disabled while continuing to use the Website.

Cookies

The Website uses technical cookies only. As of the last update, no statistical analysis or marketing cookies are active; should any be introduced, they will be installed only with your prior consent and this privacy policy will be updated accordingly. For detailed information about the cookies used, their purposes, and how to remove or block them, please refer to our Cookie Policy. The Cookie Policy also describes whatever is stored in the browser's local storage without being a cookie, including what the anti-abuse check on the contact form stores there.

Brevo

Transactional email delivery service provided by Sendinblue SAS (France), which trades as Brevo. When you submit the contact form, the Website's server transmits the data entered — name, email, organization, message and the confirmation that this policy was reviewed — to Brevo so that it is delivered by email to the Data Controller's mailbox. The transmission is server-to-server: your browser does not contact Brevo. Brevo keeps in its sending log the data relating to the delivery, including recipient, sender, subject line (which carries your name and, if provided, your organization), reply-to address (your email address), and the date, time and outcome of the sending. The text of the message is not kept in the log. For this processing Brevo acts as a Data Processor, under the data processing agreement (DPA) that forms Appendix 3 of its Terms of Service. The same DPA provides that Brevo may process data as an independent controller, in accordance with its own privacy policy, in order to manage the customer's account, for billing, to produce statistics and to defend its rights. According to the list published in the DPA, Brevo's hosting infrastructure is located in France and Belgium; as regards the sub-processors Brevo engages, see section 5.

Cloudflare

Cloudflare, Inc. (USA) provides the Data Controller with four services. First, running and delivering the Website: the Website runs on Cloudflare's network (the Cloudflare Workers service), which receives every request from visitors, answers it and records the logs described in section 2; the data submitted through the contact form also passes through it, for the time needed to forward it to the delivery service, without the Website recording it on that infrastructure in persistent form. Second, the DNS service of the domain operalife.eu: Cloudflare answers the queries by which the names of the domain are translated into network addresses, queries which as a rule reach it from the DNS server used by the visitor or by the sender of an email and not directly from their device; the Data Controller's ordinary mailboxes are hosted by a different provider (Aruba, named below). Third, counting contact form submissions per IP address (section 2). Fourth, the Turnstile anti-abuse check, described in the next paragraph. For these services, and subject to what follows, Cloudflare acts as a Data Processor on the Data Controller's behalf, under the data processing agreement (Data Processing Addendum, published at www.cloudflare.com/cloudflare-customer-dpa) referred to in the contractual terms of the service (www.cloudflare.com/terms). According to those terms and to its own privacy policy (www.cloudflare.com/privacypolicy), Cloudflare also uses for its own purposes — including the security, maintenance and improvement of its network — the traffic data generated by providing the services. The Data Controller accesses the logs and the statistics through the management dashboard of its own account. The basis for the transfer to the United States and the information on the place of processing are set out in section 5.

As for the Turnstile anti-abuse check, which protects the contact form as described in section 2, Cloudflare collects the signals directly from your browser and, according to what it states in the Turnstile Privacy Addendum (www.cloudflare.com/turnstile-privacy-policy), processes them in two distinct capacities. When it uses them to protect the Website's form it acts as a Data Processor on the Data Controller's behalf, under the same Data Processing Addendum. When it uses the same signals to improve its own ability to detect automated programs it states instead that it acts as a data controller, on the basis of its own legitimate interest: that processing is governed by the Turnstile Privacy Addendum and by Cloudflare's privacy policy. The collection of the signals from your browser, which also makes this use possible, takes place because the Data Controller has chosen to protect the form with this service, for the purpose and on the legal basis set out in section 3; as of the last update, neither the Turnstile Privacy Addendum, nor the Data Processing Addendum, nor the documentation of the service indicates a way for the Data Controller to exclude that use. An objection to this use, and the other rights concerning it, may be exercised directly against Cloudflare, which in the Turnstile Privacy Addendum gives its data protection officer as the contact (dpo@cloudflare.com) and in its privacy policy, for objections, the address sar@cloudflare.com; you may in any case contact the Data Controller, at the addresses given in section 8, as regards the collection of the signals through the Website. According to the documentation of the service, Cloudflare also makes available to the Data Controller, in the management dashboard, statistics on the use of the check which include the IP addresses from which the largest number of requests originate.

Aruba

Email hosting service provided by Aruba S.p.A. (Italy). Emails addressed to the Data Controller's ordinary mailboxes, including those generated by the contact form and those sent to the addresses published on the Website, are received and stored on servers located within the European Union. Aruba acts as a Data Processor pursuant to Art. 28 of the GDPR, under the relevant data processing agreement. The foregoing does not concern certified email (PEC): messages sent to the Data Controller's PEC address are received and stored by the provider of that service, under the terms of that service.