Privacy Policy

This Privacy Policy explains how Mostrum Srl processes the personal data of visitors to the mostrum.com website, of people who contact us and of the contact persons of our clients and suppliers, in accordance with Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 ("Privacy Code").

The demo and staging applications that we develop for our clients are covered by a dedicated privacy policy.

1. Data controller

Mostrum Srl, registered office Via Generale Antonio Chinotto 24, 36100 Vicenza (VI), Italy. VAT number IT04448080244.

• Email: [email protected]
• PEC: [email protected]
• Phone: +39 0444 162 0970

We have not appointed a Data Protection Officer, as it is not required under Art. 37 GDPR. For any privacy matter, write to [email protected].

2. Data we collect

Data you provide, when you fill in the contact, quote or landing page forms, subscribe to our newsletter, apply for a job or contact us by email or phone:

• name, email address and phone number;
• company name;
• project budget and needs;
• the content of your message;
• job application data (position, skills, experience, town of residence, public links and anything you choose to tell us), submitted through the application form on our website and stored on Google Workspace.

Data collected automatically, when you browse the website:

• IP address, browser and device type, date and time of access, collected in technical and security logs and by the anti-spam check on forms (Cloudflare Turnstile);
• browsing data collected through cookies and similar technologies (Google Analytics, Google Ads, Microsoft Clarity and the B2B visitor identification tools Leadfeeder, Albacross, Apollo and Lusha), only after your consent. Details are in the Cookie Policy.

Data from third parties: with your consent, B2B visitor identification tools match the network you browse from with their own databases to identify the company you work for and the pages it visited, and may add business information such as company name, sector, size and, for some tools, the business contact details of its representatives.

We do not collect special categories of personal data (Art. 9 GDPR). Please do not include such data (e.g. health data) in your messages or CV unless strictly necessary.

3. Purposes and legal bases

• Replying to contact and quote requests and preparing offers: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Managing contracts with clients and relationships with suppliers: performance of a contract (Art. 6(1)(b) GDPR).
• Complying with legal, tax and accounting obligations: legal obligation (Art. 6(1)(c) GDPR).
• Sending our newsletter and marketing communications: your consent (Art. 6(1)(a) GDPR), given through a double opt-in confirmation.
• Sending our clients communications about services similar to those already purchased, at the email address provided in the context of a service: legitimate interest (Art. 6(1)(f) GDPR and Art. 130(4) Privacy Code). You can object at any time, free of charge, through the unsubscribe link in each email.
• Website analytics and improvement (Google Analytics, Microsoft Clarity) and identification of companies visiting the website (Leadfeeder, Albacross, Apollo, Lusha): your consent (Art. 6(1)(a) GDPR), given through the cookie banner.
• Measuring our advertising campaigns and showing you relevant ads on third-party platforms (Google Ads): your consent (Art. 6(1)(a) GDPR), given through the cookie banner.
• Evaluating job applications: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). We keep your application for future openings only with your consent.
• Protecting the website against spam, abuse, fraud and cyber attacks: legitimate interest (Art. 6(1)(f) GDPR).
• Establishing, exercising or defending legal claims: legitimate interest (Art. 6(1)(f) GDPR).
• Managing business transfers (merger, acquisition, sale of all or part of the business): legitimate interest (Art. 6(1)(f) GDPR).

Where we rely on legitimate interest, we have assessed that it is not overridden by your rights and freedoms. You can object at any time to processing based on legitimate interest by writing to [email protected].

4. Is providing your data mandatory?

Providing the data marked as required in our forms is necessary to reply to your request: without it, we cannot reply. Consent to the newsletter and to analytics and marketing cookies is optional: refusing it has no effect on your use of the website or on our replies to your requests.

5. Who we share your data with

Your data is processed by authorized Mostrum staff and, where necessary, shared with:

• service providers acting as data processors under a data processing agreement (Art. 28 GDPR): Cloudflare (hosting, network security, anti-spam), Mailgun (transactional email, EU region), Google (Analytics, Ads, Tag Manager and Workspace, where we store job applications), Microsoft (Clarity), Dealfront (Leadfeeder), Albacross, Apollo.io, Lusha, CookieYes (consent management), our accounting firm and the agency that manages our advertising and analytics accounts;
• public authorities, when required by law or by an order of a judicial or administrative authority;
• buyers or successors of all or part of our business, in the event of a merger, acquisition or sale.

Our content management system and our newsletter platform are hosted on our own infrastructure. The full list of data processors is available on request at [email protected]. We do not sell your personal data.

6. Transfers outside the EU

Some providers (in particular Google, Microsoft, Cloudflare, Apollo.io and Lusha) may process data outside the European Economic Area, including in the USA and Israel. Transfers are based on European Commission adequacy decisions (Art. 45 GDPR), such as the one for Israel and the one for recipients certified under the EU-US Data Privacy Framework or, where this does not apply, on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR). You can request a copy of the safeguards at [email protected].

7. How long we keep your data

• Contact and quote requests: 24 months from the last contact, unless a contract follows.
• Client data (contracts, invoices, project communications): for the duration of the contract and 10 years after its end, to comply with tax and accounting obligations (Art. 2220 Italian Civil Code).
• Newsletter: until you unsubscribe or withdraw your consent.
• Communications to clients about similar services: until you object.
• Job applications: 12 months from receipt; longer only with your consent.
• Technical and security logs: no longer than 90 days, unless needed to investigate a security incident.
• Cookies: as described in the Cookie Policy.

Data may be kept longer where necessary to establish, exercise or defend legal claims, for the duration of the proceedings and the applicable limitation periods. At the end of the retention period, data is deleted or irreversibly anonymised. Data in backup archives is isolated from any further processing until it is deleted.

8. Automated decisions

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you (Art. 22 GDPR).

9. Your rights

Under Articles 15 to 22 GDPR, you have the right to:

• access your data and receive a copy of it;
• have inaccurate or incomplete data rectified;
• have your data erased ("right to be forgotten");
• restrict the processing of your data;
• receive your data in a structured, commonly used and machine-readable format and transmit it to another controller (data portability);
• object to processing based on legitimate interest and, at any time, to processing for direct marketing purposes;
• withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of the EU country where you live or work.

To exercise your rights, write to [email protected]. We reply within one month of your request. To withdraw consent to cookies, use the cookie settings link in the footer of every page.

10. Cookies and "Do Not Track"

For information about the cookies we use and how to manage them, see our Cookie Policy.

Our website does not currently respond to "Do Not Track" browser signals. However, non-essential cookies and tracking technologies (analytics, marketing) are blocked by default and are activated only after you give your consent through the cookie banner. You can change or withdraw your consent at any time via the cookie settings link available on every page.

11. Children

Our website is aimed at companies and professionals. We do not knowingly collect personal data of minors. If you believe a minor has provided us with personal data, write to [email protected] and we will delete it.

12. Security

We apply appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), access restricted to authorized staff and protection against attacks and spam. No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security.

13. Links to other websites

Our website may contain links to websites and services operated by third parties, which are not covered by this Privacy Policy. We recommend that you read their privacy policies.

14. Changes to this policy

We may update this Privacy Policy to reflect changes in the law or in our practices. The current version is always published on this page, with the date of the last update. Where changes are significant, we will inform you through the website or by email.