This Privacy Notice was last updated on 12 October 2026.
The purpose of this document (the "Notice") is to inform the user (the "Data Subject") about how their personal data will be collected and processed by the Controller in accordance with Regulation (EU) 2016/679 (GDPR) and other applicable personal data protection rules.
This Notice may be amended at any time, without obligation and at the Controller’s sole discretion, in whole or in part, by updating it. In that event, the Controller will give notice by email to the Data Subject and/or publication on the Website.
This Notice covers the management of Personal Data in the Controller’s database, receipt of newsletters and marketing communications, and the Website.
1. Data controller
The data controller is Finnovaction S.r.l., with registered office at viale Andrea Doria 48, Milan, VAT number 10932500969.
Website: https://finnovaction.com
2. Categories of data
The categories of personal data collected include:
- identity and contact details;
- data needed to identify the data subject;
- data collected automatically when browsing the website (IP addresses, URIs, access times, etc.);
- data collected through cookies and similar technologies;
- data provided voluntarily through contact forms, job applications or service requests.
3. Purposes of processing
Personal data are processed for:
- managing the relationship with the data subject;
- operating the website;
- registration for newsletters, events and webinars;
- responding to contact requests;
- sending commercial and marketing communications (with prior consent);
- protecting the controller’s rights;
- market research and statistical analysis;
- compliance with legal obligations;
- management of data subject databases;
- website traffic analysis;
- sending communications via WhatsApp;
- recruitment.
4. Data processing
Data are processed using manual and electronic means. The controller may entrust processing to external suppliers appointed as data processors.
5. Legal basis for processing
Processing is based on:
- the data subject’s consent;
- performance of contractual obligations;
- compliance with legal obligations;
- the legitimate interests of the controller or third parties.
6. Storage location and data transfers
Personal data are stored at the controller’s premises and with service providers, including those located abroad, in accordance with applicable law.
7. Retention period
Data are retained for as long as necessary for the purposes for which they were collected and in compliance with legal obligations.
8. Automated processing
The data collected are not subject to automated decision-making or profiling with significant legal effects on the data subject.
9. Rights of the data subject
The data subject may:
- withdraw consent;
- obtain information about processing;
- object to processing;
- access their data;
- request updates or rectification;
- request restriction of processing;
- request erasure of data;
- obtain data portability;
- lodge a complaint with the competent authority.
10. Recipients of personal data
Data may be disclosed to:
- employees and collaborators of the controller;
- suppliers and external data processors;
- persons authorised to process data for purposes connected with the services offered.
Data are not made public.
11. Contact details
For information or to exercise your rights:
Competent authority:
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Rome, Italy
Certified email (PEC): protocollo@pec.gpdp.it
12. Newsletter
The data subject may subscribe to the newsletter by giving consent and may unsubscribe at any time using the link in the communications received.
13. Marketing
The data subject may consent to receiving promotional communications, including via WhatsApp, and may withdraw consent at any time.
14. Website request archive
When you submit the contact form, Finnovaction records your name, email, topic, message, receipt date, accepted privacy notice version and email sending status. The archive is used to receive and handle your request based on the consent given in the form and, where applicable, pre-contractual steps you request. It does not subscribe you to newsletters or marketing. Application access is restricted to the authorised administrator account owner; infrastructure providers and Brevo process data to provide their respective services.
Requests are retained for 12 months from receipt. They are then excluded from the restricted area and deleted from the database on subsequent site activity. Copies in email inboxes are managed separately under the purposes and obligations described in this notice. To request access, correction, deletion or consent withdrawal, contact privacy@supernovaelabs.com. The form database does not store IP addresses or tracking identifiers.