pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) – courtesy translation of the Italian notice

This notice explains how personal data of visitors to convergo.it (the “Website”) and of people using the contact forms on the Website are processed. Applications sent through the Academy section have a dedicated notice.

1. Data controller

The Data Controller is GBSAPRI S.p.A. a Socio Unico, an insurance broker operating under the Convergo brand, in the person of its legal representative.

Registered office: Viale Erminio Spalla 9, 00142 Rome, Italy. Rome Companies Register no. 12079170150 – Tax Code 12079170150 – VAT no. 18242091009 – REA RM 985506. Share capital subscribed and fully paid-up € 2,700,000. Company subject to the direction and coordination of Appia Holding S.p.A. Entered in the RUI (Italian register of insurance intermediaries) under no. B000054892. PEC (certified e-mail): gbsapri@legalmail.it.

To exercise your rights or for any question about the processing of your data: privacy@convergo.it.

2. Data Protection Officer (DPO)

The Data Protection Officer can be reached at dpo@convergo.it.

3. What data we process and where it comes from

Browsing data. When you visit the Website, the systems hosting it automatically record some technical data: IP address, date and time of the request, page requested, outcome, browser and device type. They are used to run the Website, keep it secure and detect abuse. They are not used to identify you and are not combined with other data. The Website is hosted by Kinsta on servers located in Milan (Italy). The provider keeps the log files for up to 4 days; the data derived from them for the service's statistics, IP address included, are kept for up to 30 days and then automatically deleted (source: Kinsta's public documentation, “Server Logs” and “Files and database storage”, kinsta.com/docs).

Data you send us. If you fill in a form on the Website, we process the data you enter:

“Let's talk about your needs” form (home page and industry pages): first name, last name, e-mail address, industry of interest, message and, if you wish, your Italian tax code (optional);
“Let's talk about your establishment” form (Hotels and accommodation facilities page): full name, e-mail, phone, name and location of the establishment, text of the request;
e-mail messages you write to the addresses published on the Website: sender's address and content of the message.

The forms do not store data on the Website: the request is sent by e-mail, from the address noreply@convergo.it, to the destination mailbox (for example info@convergo.it) and handled from there by the Controller. Please do not write special categories of data (for example health data) or data on criminal convictions and offences in your messages: if needed for a case, we will ask for them later, with the appropriate safeguards.

The Italian tax code is optional.

Cookies and Website tools. The Website uses a cookie consent system (Cookiez); cookies are described in the Cookie Policy (/en/cookie-policy-en/). Accessibility tool. The Website offers a tool to adapt reading (larger text, contrast, readable font and similar), provided by Elementor (Ally). When a page loads it, your browser connects to Elementor's servers (cdn.elementor.com) to download the tool and the language files: Elementor therefore receives your IP address and the technical data of the request. The preferences you choose are saved only in your browser's memory (localStorage and sessionStorage), on your device: they are not cookies and are not sent to us. Loading from Elementor's CDN, however, entails a technical cookie, __cf_bm, set by the CDN (a Cloudflare service) on the elementor.com domain to tell legitimate traffic from automated traffic. Usage statistics for the tool are switched off. The Website uses no profiling tools.

Statistics on the use of the Website (Google Analytics). If you accept the “Statistics” category in the cookie banner, the Website loads Google Analytics 4, a service of Google Ireland Limited, through Google Tag Manager. Google receives data about your browsing (pages visited, length of the visit, events such as clicks, type of device and browser, approximate geographic area) linked to a random code stored in the _ga and _ga_RPPZG5CB3G cookies. The Controller uses it only for aggregate statistics on the use of the Website. Google Analytics does not record or keep IP addresses; Google Signals and the collection of user-provided data are switched off, and the Website is not linked to Google Ads. If you refuse or make no choice, nothing is loaded or sent to Google. You can change your choice at any time from “Cookie preferences”, the cookie-shaped icon at the bottom right of every page. Details are in the Cookie Policy (/en/cookie-policy-en/).

4. Why we process data and on what legal basis

Replying to your requests and following them up, including proposals and quotes: performance of pre-contractual measures taken at your request (Art. 6(1)(b) GDPR). Without the data marked as mandatory we cannot reply.
Complying with legal obligations, regulations and requirements of Authorities, including insurance supervisory authorities (Art. 6(1)(c)).
Website security, prevention of fraud and abuse, protection of the Controller's rights, including in court: legitimate interest of the Controller (Art. 6(1)(f)).
Statistics on the use of the Website with Google Analytics: only if you accept the “Statistics” category in the cookie banner (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). You may withdraw consent at any time from “Cookie preferences”.
Sending information and advertising material about the Controller's products and services by e-mail: only if you tick the first consent box (Art. 6(1)(a)).
Sending personalised offers and services suited to your needs by e-mail: only if you tick the second consent box (Art. 6(1)(a)).
Service-quality surveys and market research: only if you tick the third consent box (Art. 6(1)(a)).

The three consents are optional, independent of one another and not pre-ticked. Not ticking them does not prevent you from sending your request. You may withdraw them at any time by writing to the addresses in section 1, without affecting processing already carried out.

5. How we process data

Data are processed with IT and electronic tools, with adequate security measures (Art. 32 GDPR), by persons authorised and instructed by the Controller and by suppliers appointed as data processors. Data are not disseminated.

6. Who we may share data with

Data may be accessed by the Controller's authorised staff and collaborators, and shared with companies of the group to which it belongs when needed to answer your request. The suppliers of the Website's technical services may also process them, as data processors:

Website hosting: Kinsta (servers in Milan), which also relies on Cloudflare network and security services;
accessibility tool: Elementor (Ally);
sending of form e-mails: Elementor's Site Mailer, which uses the SendGrid service. A technical log of the e-mails sent is kept on the Website, with the date, recipient and subject of each e-mail; the text of the message is not stored on the Website;
the Controller's e-mail: Microsoft 365;
statistics on the use of the Website: Google Analytics and Google Tag Manager of Google Ireland Limited, only with your consent;
cookie consent management: Elementor's Cookiez.

Authorities and public bodies entitled by law may also receive the data. If your request leads to a professional relationship with the Controller, data will be processed according to the client notice, which will be given to you at that point.

7. Transfers outside the European Economic Area

The Website servers are in Milan. Some technical service providers, however, also have offices or infrastructure outside the European Union: Kinsta (a company based in the United States, whose data processing agreement includes the European Commission's standard contractual clauses), Cloudflare (network and security services), Elementor (a company based in Israel, a country covered by a European Commission adequacy decision) the SendGrid e-mail sending service (a US company) and Google (Google Ireland Limited, which may transfer data to Google LLC in the United States; Google LLC adheres to the EU-U.S. Data Privacy Framework, covered by a European Commission adequacy decision). In these cases the transfer takes place only to countries with an adequacy decision or with the safeguards of Articles 46 ff. GDPR. You may ask the Controller for a copy of the safeguards adopted.

8. How long we keep data

Requests sent through the forms: for the time strictly necessary to handle the request.
Data relating to pre-contractual, contractual and legal obligations: 10 years from the end of the relationship, unless acts interrupting or suspending the limitation period apply.
Data for marketing, personalised offers and surveys: no longer than 24 months or until consent is withdrawn.
Google Analytics data (user-level and event-level): 14 months, then deleted automatically by Google.
Browsing data: log files up to 4 days; data derived for statistics (IP included) up to 30 days, at the hosting provider (section 3).

After that period, data are deleted or anonymised.

9. Your rights

Where the conditions are met, you may ask the Controller, by writing to the addresses in section 1, for: access to your data and a copy; rectification; erasure; restriction of processing; data portability; objection to processing based on legitimate interest; and withdrawal of consent at any time (Art. 7 GDPR). On the Website you will find the form to exercise your rights and the form to submit a privacy complaint.

10. Complaint to the Authority

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or to take legal action. If you prefer, you may first write to the Controller or the DPO: we will try to resolve the matter quickly.

11. Minors

The Website is aimed at adults. Persons under 16 must not send data without the consent of the holder of parental responsibility.

12. Updates

This notice may be updated, and the version in force is always the one published on this page.

Privacy policy