Privacy Policy

This privacy notice is provided pursuant to Art. 13 of EU Regulation 2016/679 (GDPR) and describes how the personal data of users who visit the OUTSOURCING GROUP srl website and fill in the contact forms on the site are processed.

1. Data Controller

The Data Controller is:

1.1 Data Protection Officer (DPO)

OUTSOURCING GROUP srl has appointed a Data Protection Officer (DPO), who can be contacted using the following details:

2. Types of data processed

Personal data collected through the website includes:

• Full name
• Email address
• Company (if provided)
• Message (if provided)

Such data is voluntarily provided by the user by filling in the forms on the site.

3. Purposes and legal bases for processing

Personal data collected through the site's forms is processed for distinct purposes, each with its own legal basis, as specified below:

a) Handling the contact or quote request

When a user submits a request through the site's forms, the data is processed to:

• record the request in the company's CRM system (Brevo)
• commercially qualify the request
• contact the user by phone or email to follow up on the request

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures taken at the request of the data subject).

b) Continuation of the business relationship

After the initial request, the Data Controller may continue the interaction with the user (e.g. sending further information strictly related to the requested service, managing the commercial negotiation) on the basis of its legitimate interest in pursuing the pre-contractual relationship initiated by the data subject (Art. 6(1)(f) GDPR), balanced against the rights and freedoms of the data subject, who may object to this processing at any time.

c) Commercial classification of contacts

The Data Controller may classify the contacts it receives based on basic information (e.g. industry sector, company size) to organise its commercial activities. This activity is not necessary to respond to the user's request and is based on the Data Controller's commercial legitimate interest (Art. 6(1)(f) GDPR). The data subject may object at any time, with no consequences for the handling of their request, by writing to the contacts listed in section 9.

d) Marketing and newsletter

Commercial, promotional and newsletter communications are sent exclusively on the basis of the data subject's specific and separate consent (Art. 6(1)(a) GDPR), expressed through the dedicated, optional and separate checkbox on the site's forms, independent of having read this notice. Consent can be withdrawn at any time, without affecting the lawfulness of processing based on consent given before its withdrawal.

4. Processing methods and data retention

Data is processed using electronic and digital tools, in compliance with the principles of lawfulness, fairness, transparency and minimisation as required by the GDPR.

Appropriate technical and organisational security measures are in place to prevent unauthorised access, disclosure, modification or destruction of data.

Data retention periods differ depending on the purpose of processing:

• Request handled with no further commercial follow-up: data is retained for 12 months from the closing of the request, after which it is deleted or anonymised.
• Ongoing commercial negotiation or established contractual relationship: data is retained for the entire duration of the relationship and, afterwards, for the period required by applicable legal obligations (e.g. statutory retention terms for tax and contractual documentation).
• Marketing and newsletter (data processed on the basis of consent): data is retained until the data subject withdraws consent and, in any case, for no longer than 24 months from the last interaction, unless consent is renewed.

5. Third-party access to data

Personal data may be processed by third parties acting on behalf of the Data Controller, as Data Processors, such as:

• Web hosting and infrastructure service providers
• Brevo (Sendinblue) – CRM platform used to manage contacts and requests submitted through the site forms. Data (name, email, company, message) is transmitted to Brevo under a Data Processing Agreement (DPA). More information: brevo.com/legal/privacypolicy
• Web traffic analysis service providers
• Google Maps – interactive map embedded on the Contact page to show the company's location, provided by Google LLC. Loading the map connects to Google's servers and may set cookies on Google's behalf.

These parties process data solely in accordance with the Data Controller's instructions and in compliance with applicable regulations.

6. Analytics and external services

The site uses Google Analytics 4 (GA4), a web traffic analysis service provided by Google LLC. Through GA4, data such as pages visited, time spent on the site, traffic source, device and browser type, and the user's approximate geographic area is collected via cookies and online identifiers (e.g. client ID).

GA4 does not store the user's full IP address: the IP is used transiently to determine the user's geographic area and is not subsequently retained in readable form, in line with the technical architecture Google applies to this service.

The retention period for event data in GA4 is configured in the Data Controller's Google Analytics admin panel (a setting to be verified periodically and, in any case, not exceeding 14 months). Data is shared with Google LLC, which also processes it as an independent controller under its own privacy policy, available at policies.google.com/privacy.

7. Data transfers outside the EU

For the third-party services used on the site, the transfer of data outside the European Economic Area (EEA) and the related safeguards are as follows:

• Google (Google Analytics, Google Maps) – US-based company, adhering to the EU-U.S. Data Privacy Framework (DPF), the adequacy mechanism recognised by the European Commission for data transfers to the USA.
• Brevo – France-based company; contact data collected through the forms is stored on servers located within the European Union, with no extra-EU transfer.
• Any additional technical providers (e.g. hosting) operate, where possible, with infrastructure located within the European Union; where this is not possible, the transfer is based on the Standard Contractual Clauses (SCC) adopted by the European Commission.

8. Rights of the data subject

As a data subject, the user may exercise the following rights under Articles 15–22 of the GDPR at any time:

• Right of access to personal data
• Right to rectification of inaccurate data
• Right to erasure (right to be forgotten)
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

9. How to exercise your rights

To exercise your rights or request information about the processing of your personal data, you can contact the Data Controller at the following email address:

info@osgdigitaleconomy.com

Alternatively, the data subject may contact the Data Protection Officer (DPO) directly, using the details provided in section 1.1 (email: r.castroreale@rcsrl.it).

10. Updates to this Privacy Policy

This Privacy Policy may be subject to changes or updates.

Any changes will be published on this page and will take effect from the date of publication.

Last updated: 25 September 2026