Legal

Privacy Policy

This page sets out the personal data processing and security policies implemented by LibraCyber S.p.A. for users who browse the website and, more generally, for data subjects who interact with the Company in various capacities.

This privacy notice is provided pursuant to Article 13 of Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter also referred to as the “GDPR”), in particular for persons who interact with the web services of LibraCyber S.p.A. accessible online at: https://www.libracyber.com/

This privacy notice applies exclusively to this website and not to any other websites that users may access through links.

DATA CONTROLLER

Pursuant to Article 4(7) of the GDPR, the Data Controller of your personal data is LibraCyber S.p.A., with registered office at Piazza Cermenati 11 – 23900 Lecco (LC), Tax Code and VAT No. 03442930131, registered with the Como-Lecco Companies Register, REA No. LC-316898, share capital EUR 80,000.00, certified e-mail (PEC): [email protected].

LibraCyber S.p.A. is a European company operating in the cybersecurity sector, combining e-mail security and human risk management solutions, including security awareness tools, phishing simulations and user protection, with an approach focused on privacy and data sovereignty.

DATA PROCESSORS

In accordance with Article 37 of the GDPR, LibraCyber S.p.A. has appointed a Data Protection Officer (hereinafter also referred to as the “DPO”), who may be contacted at [email protected].

The DPO is available to data subjects for any information concerning the processing of their personal data and for the exercise of their rights.

PLACE OF DATA PROCESSING

Processing operations connected with the web services of this website take place at the premises of the Data Controller and are carried out only by technical personnel assigned to the service and authorised to process the data.

No data deriving from the web service are disclosed or disseminated. Personal data provided by users who request information materials are used solely to provide the requested service or response and are disclosed to third parties only where necessary for that purpose.

TYPES OF DATA PROCESSED

Browsing data

The information systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified data subjects, but by its very nature it could, through processing and association with data held by third parties, make it possible to identify users. This category of data includes the IP addresses or domain names of the computers used by users connecting to the website, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response provided by the server (successful, error, etc.), and other parameters relating to the user’s operating system and IT environment. These data are used solely to obtain anonymous statistical information on the use of the website and to verify its proper functioning and are deleted immediately after processing. The data may be used to ascertain liability in the event of hypothetical cybercrimes against the website; except in such circumstances, data relating to web contacts are currently retained for no longer than thirty days.

Data provided voluntarily by the user

The optional, explicit and voluntary sending of communications to the addresses indicated on the website, as well as the completion and submission of the forms available on the relevant pages, entails the acquisition of the personal data provided by the user, including contact details and any further information entered in the fields or in the content of the communication, as necessary to respond to requests or provide the requested service. Specific concise privacy notices will progressively be provided or displayed on the pages of the website dedicated to particular services requested by users.

METHODS OF PROCESSING

Personal data are processed using IT tools for the time necessary to achieve the purposes for which they were collected. Specific security measures are implemented to prevent loss of data, unlawful or improper use and unauthorised access.

PURPOSES, LEGAL BASIS AND NATURE OF THE PROVISION OF DATA

Personal Data provided through the Website will be processed by LibraCyber S.p.A. for the following purposes:

1. a) to manage and respond to requests for information or contact submitted by data subjects through forms or other channels made available on the website. The legal basis for the processing is Article 6(1)(b) of the GDPR, as the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract. Consent not required;
2. b) to manage requests to book a demo, contact the data subject, organise the requested demonstration and carry out related activities, also taking into account the information provided regarding the organisation to which the data subject belongs and the solutions of interest. The legal basis for the processing is Article 6(1)(b) of the GDPR, as the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract. Consent not required;
3. c) to send by e-mail promotional and commercial materials relating to LibraCyber products, services and initiatives following voluntary subscription to the newsletter. The legal basis is Article 6(1)(a) of the GDPR, namely the data subject’s explicit consent;
4. d) to assess potential job applications by receiving CVs by e-mail. The legal basis is Article 111-bis of Italian Legislative Decree No. 196/2003, in accordance with Article 6(1)(b) of the GDPR;
5. e) research and statistical analyses based on anonymous aggregated data, aimed at measuring the operation of the Website and its traffic, and assessing usability and interest in order to make it more functional and efficient; consent is not required because no processing of personal data takes place;
6. f) profiling through third-party cookies. The legal basis is Article 6(1)(a) of the GDPR, in accordance with Directive 2009/136/EC of 25 November 2009 and with the provisions of the Italian Data Protection Authority’s measure of 10 June 2021 (Guidelines on cookies and other tracking tools). Consent is required as set out in the Cookie Policy;
7. g) compliance with legal and regulatory obligations. The legal basis is Article 6(1)(c) of the GDPR. Consent not required;
8. h) to establish, exercise or defend legal claims or whenever courts act in their judicial capacity. The legal basis is Article 6(1)(f) of the GDPR, namely legitimate interest. Consent not required.

The provision of data necessary to respond to requests made by the data subject is required; failure to provide such data will make it impossible to respond to the relevant request. The provision of data for marketing purposes is, however, optional.

TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS

The Data Controller undertakes to limit the circulation and processing of personal data (e.g. storage, archiving and retention of data on its servers) to countries belonging to the European Economic Area, expressly prohibiting transfers to non-EU countries that do not ensure an adequate level of protection, unless safeguards provided for under Chapter V of Regulation (EU) 2016/679 are in place (adequacy decision, Standard Contractual Clauses or the data subject’s explicit consent).

RECIPIENTS OF PERSONAL DATA

Personal data acquired through this website may be disclosed to:

• Public Bodies or Public Offices where required by legal and/or contractual obligations;
• any specifically appointed consultants and external companies providing tax and fiscal consultancy services.

DATA RETENTION

LibraCyber S.p.A. will process your Personal Data for the period strictly necessary to achieve the purposes set out in this privacy notice.

Without prejudice to the above, LibraCyber S.p.A. will process the Personal Data for the period permitted under Italian law to protect its interests (Article 2947(1) and (3) of the Italian Civil Code). Further information regarding the retention period of Personal Data and the criteria used to determine that period may be requested by contacting the Data Controller.

“WORK WITH US” SECTION – CV MANAGEMENT

This privacy notice, addressed to data subjects who wish to submit an application and/or send their curriculum vitae through the “Careers” section of the website, is provided in accordance with Article 13 of Regulation (EU) 2016/679. The notice therefore also applies in relation to Article 111-bis of Italian Legislative Decree No. 196/2003 and may also be used by the Data Controller for any job advertisements published on websites or portals not directly managed by the Data Controller (third-party recruitment companies).

Candidates are nevertheless invited to comply with the following rules when submitting CVs electronically:

1. Prepare the curriculum vitae in European format (using, where possible, the template available here);
2. submit the curriculum vitae in .pdf format;
3. avoid including in the curriculum vitae special categories of personal data as defined in Article 9(1) of the GDPR (data relating to health, religious, philosophical or political beliefs, etc.) that are not relevant to the job opportunity;

The Company reserves the right not to collect, and to delete, CVs that do not comply with the above requirements.

Data Processors. Pursuant to Article 28 of the GDPR, the Company has formally appointed external parties involved in the processing as Data Processors and, in particular where relevant and applicable, the companies engaged in the recruitment process.

The full list of Data Processors and Sub-Processors may be requested from the Data Controller or the Data Protection Officer using the contact details indicated above.

Place of data processing. Processing connected with the activity in question will be carried out at the premises of the Data Controller and the Data Processors and only by personnel assigned to and expressly authorised to carry out the processing.

Types of data processed. The data provided by the user in any cover letters and the data contained in the Curriculum Vitae will be processed.

With regard to the processing in question, the personal data necessary to assess the application, as set out in the curriculum vitae submitted by the candidate, will be processed. Personal data falling within the so-called special categories are excluded from processing, except as specified below.

Methods of processing. Personal data are processed mainly using IT tools, except for CVs received by ordinary mail, and in any event will be processed for the time necessary to achieve the purposes for which they were collected. Specific security measures, implemented pursuant to Article 32 of the GDPR, are applied to prevent loss of data, unlawful or improper use, unauthorised access and unwanted changes.

Purposes, Legal Basis and Nature of the Provision of Data. The Personal Data provided by the user through the curriculum vitae will be processed by the Data Controller for the following purposes:

1. i) assessment, recruitment or selection of personnel, with a view to collaboration, fixed-term or permanent employment and/or internships. As regards so-called “ordinary” personal data, the legal basis for processing is Article 6(1)(b) of the GDPR, as the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract (in accordance with Article 111-bis of Italian Legislative Decree No. 196/2003). As regards any processing of data falling within special categories, where necessary for the same purpose, the condition for lawfulness is Article 9(2)(b) of the GDPR, as the processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the Data Controller or the data subject in the field of employment and social security and social protection law (e.g. membership of so-called “protected categories”).

The data in question will be processed by ensuring the application of appropriate security measures and, in accordance with the principle of data minimisation, only the personal data necessary to manage the operations essential for fulfilling the obligations, including pre-contractual obligations, undertaken by the Data Controller in its field of activity will be processed.

Recipients of personal data. Personal data acquired in connection with the processing in question may be disclosed to:

• Public Bodies or Public Offices where required by legal and/or contractual obligations;
• any specifically appointed consultants and external companies providing legal, tax and fiscal consultancy services;

Data retention. CVs will be retained at the Company’s premises for a period not exceeding 18 months and will be processed in full compliance with appropriate technical and organisational measures pursuant to Article 32 of the GDPR.

After this period, the CVs will be deleted in accordance with the applicable legislation.

In any event, CVs will be retained at the Company’s premises and will not be disclosed to third parties.

MINORS

LibraCyber S.p.A. specifically requests that minors do not use this Website and do not send or post information on it. Should the Company inadvertently acquire personal information or other data relating to a minor, any disclosure of such data to third parties would be solely due to the fact that the minor user used the Website and disclosed personal information without requesting or receiving permission from the Company.

AUTOMATED PROCESSING

The Company does not carry out processing based on automated decision-making, including profiling, that produces legal effects concerning the data subject or similarly significantly affects them.

SOCIAL BUTTONS

The Company’s website may use certain third-party platforms as social plug-ins (including, by way of example, LinkedIn and YouTube). This means that, by clicking on specific “buttons” (known as social buttons/widgets), the user is automatically and directly redirected to the provider of the selected social network, where the user may interact with the Company’s corporate profile.

Data subjects are therefore invited to consult and review the privacy policy of the selected platform and to visit the section of the website dedicated to the Company’s Cookie Policy for a more complete and detailed description of this functionality.

DATA SUBJECTS’ RIGHTS

Users may freely exercise the rights referred to in Articles 15 et seq. of the GDPR, including the right to:

• withdraw consent at any time. The User may withdraw consent previously given to the processing of their Personal Data;
• object to the processing of their Data. The User may object to the processing of their Data where the processing is based on a legal basis other than consent;
• access their Data. The User has the right to obtain information about the Data processed by the Data Controller, about certain aspects of the processing, and to receive a copy of the Data being processed;
• verify and request rectification. The User may verify the accuracy of their Data and request that it be updated or corrected;
• obtain restriction of processing. Where certain conditions apply, the User may request the restriction of the processing of their Data. In such cases, the Data Controller will not process the Data for any purpose other than their storage;
• obtain erasure or removal of their Personal Data. Where certain conditions apply, the User may request the erasure of their Data by the Data Controller;
• receive their Data or have them transferred to another controller. The User has the right to receive their Data in a structured, commonly used and machine-readable format and, where technically feasible, to have them transmitted to another controller without hindrance. This provision applies where the Data are processed by automated means and the processing is based on the User’s consent, on a contract to which the User is party, or on pre-contractual measures related thereto;
• lodge a complaint. The User may lodge a complaint with the competent data protection supervisory authority or seek judicial remedies.

Requests should be sent by e-mail to [email protected].

UPDATES AND REVISIONS

This Privacy Policy was updated on 01.10.2026 and may be subject to future revisions.