Privacy Policy
1. Purpose and scope of this notice
This Privacy Policy describes how ATENA SRL processes the personal data of users who visit and use the Finance Atena® website (the “Website”) and its related digital features.
Finance Atena® is a product of ATENA SRL and is not a separate data controller. Personal data collected through the Website is therefore processed under the responsibility of ATENA SRL.
This notice is provided pursuant to Regulation (EU) 2016/679 (the “GDPR”), Italian Legislative Decree No. 196 of 30 June 2003, as amended (the “Italian Privacy Code”), and the applicable rules on electronic communications.
This notice covers the Website and the contact, meeting booking and newsletter activities connected with it. Processing carried out in connection with the use of the Finance Atena platform by clients or professional users may be governed by separate privacy notices, agreements or data-processing arrangements.
2. Data Controller
The Data Controller is:
ATENA SRL
Via G. Amendola, 1 – 20063 Cernusco sul Naviglio (MI), Italy
VAT No. 08577730156
E-mail for privacy rights requests: financeatena@atenait.it
Website: https://financeatena.it
3. Categories of personal data processed
Depending on how the Website is used, the Controller may process the following categories of personal data:
- identification and contact data, such as first name, surname and e-mail address;
- any business or professional data voluntarily provided by the user during contacts or meetings;
- information voluntarily entered in contact forms or included in requests;
- data required to book and manage meetings or appointments;
- newsletter and marketing communication preferences;
- technical and browsing data, such as IP address, browser and device information, logs, pages visited and usage data;
- information collected through cookies and similar tracking technologies, as described in the Cookie Policy and consent-management system.
Users are requested not to submit special categories of personal data under Article 9 GDPR or data relating to criminal convictions and offences through the Website forms, unless strictly necessary and specifically requested.
The Website forms currently require first name, surname and e-mail address. Any additional information voluntarily provided by the user, together with technical data required to handle the request, may also be processed.
4. Purposes and legal bases
| Purpose | Description | Legal basis | Provision of data |
|---|---|---|---|
| Website operation and security | Delivery and technical management of the Website, system security, prevention of abuse and unauthorised access. | Article 6(1)(f) GDPR – legitimate interests of the Controller; applicable rules for processing strictly necessary to provide the requested service. | Necessary for technical use of the Website. |
| Information and contact requests | Responding to user requests and managing commercial or informational discussions initiated by the user. | Article 6(1)(b) GDPR – steps taken at the request of the data subject prior to entering into a contract. | Necessary to respond to the request. |
| Meeting booking and management | Scheduling appointments, contacting the user and managing preliminary activities. | Article 6(1)(b) GDPR – pre-contractual steps at the data subject’s request. | Necessary to arrange the meeting. |
| Newsletter and direct marketing | Sending newsletters and promotional communications concerning Finance Atena and/or ATENA SRL products, services, events and initiatives. | Article 6(1)(a) GDPR – consent; Article 130 of the Italian Privacy Code where applicable. | Optional. Consent may be withdrawn at any time. |
| Non-essential analytics and tracking | Website performance measurement and statistical analytics through non-essential tools, including Google Analytics and any similar tools that may be configured. | Article 6(1)(a) GDPR – consent where required. Choices are managed through the cookie/consent platform. | Optional. |
| Legal obligations and protection of rights | Compliance with legal obligations and authority requests, and establishment, exercise or defence of legal claims. | Article 6(1)(c) GDPR – legal obligation; Article 6(1)(f) GDPR – legitimate interest in protecting legal rights. | Where necessary. |
ATENA SRL does not use HubSpot for lead scoring or behavioural profiling of contacts based on user behaviour.
5. Collection methods and whether data is mandatory
Personal data may be provided directly by the user through forms, e-mail or other contact channels, or collected automatically while browsing, limited to technical data and enabled tracking technologies.
Data marked as mandatory in the forms is required to handle the user’s request. Failure to provide such data may make it impossible to provide a response or the requested service. Data requested for newsletter or marketing purposes is optional, and refusal to consent does not prevent the use of other Website features.
Any mandatory checkbox associated with contact or meeting-booking forms should confirm that the user has read this Privacy Policy and does not constitute consent to processing that is necessary to handle the request. Consent for newsletters and marketing, where required, must be separate, specific and optional.
6. CRM, hosting and technology providers
The Website is currently built and/or managed using HubSpot infrastructure. Depending on the actual configuration, ATENA SRL may also use HubSpot for forms, contact management, Customer Relationship Management (CRM), communications and other Website-related functions.
ATENA SRL may also rely on providers of hosting, security, maintenance, tag management, analytics, video conferencing, appointment booking, newsletter delivery and other technical services. Depending on the circumstances, these providers process personal data as processors under Article 28 GDPR or as independent controllers for their own processing activities.
An up-to-date list of processors may be requested from the Controller.
HubSpot is currently used for CRM, forms, Meeting Scheduler, newsletter/e-mail marketing and workflows. The Website also uses Google Analytics for measurement and Microsoft Teams integrated with the HubSpot meeting-booking calendar.
7. Cookies and similar tracking technologies
The Website uses cookies and/or similar technologies. Detailed information on individual technologies, purposes, providers, storage periods and methods to give, refuse or withdraw consent is set out in the Website Cookie Policy and the related preference-management panel operated through Iubenda.
Non-essential tracking technologies are activated only on the basis of the user’s consent where required by applicable law. Users may change their choices at any time using the dedicated control made available on the Website.
Cookie Policy: https://www.iubenda.com/privacy-policy/14902278/cookie-policy
8. Recipients of personal data
Within the limits of the purposes described above, personal data may be accessed by or disclosed to:
- ATENA SRL staff, collaborators and authorised persons;
- IT, hosting, CRM, communications, marketing and maintenance providers;
- professional, legal, tax or technical advisers where necessary;
- public, judicial or administrative authorities where required by law;
- other parties where disclosure is necessary to comply with obligations or protect legal rights.
Personal data is not made publicly available on an indiscriminate basis.
9. International transfers
The use of international technology providers may involve the processing or transfer of personal data outside the European Economic Area (EEA). Where this occurs, ATENA SRL adopts or verifies the existence of a mechanism provided for under Chapter V GDPR, such as an adequacy decision of the European Commission, the Data Privacy Framework where applicable, Standard Contractual Clauses or other appropriate safeguards.
Information on safeguards applicable to individual providers may be requested from the Controller. The Cookie Policy also contains information on transfers related to tracking technologies.
The use of HubSpot, Google and Microsoft may involve processing by companies within their respective groups and infrastructure located outside the European Economic Area. International transfers are carried out in accordance with Chapter V GDPR and the safeguards applicable to each provider.
10. Retention periods
ATENA SRL retains personal data for no longer than is necessary for the purposes for which it is processed, taking into account legal obligations, the need to protect legal rights, data minimisation and storage-limitation principles.
| Processing activity | Period / criterion |
|---|---|
| Contact / information requests | For as long as necessary to handle the request and any related pre-contractual discussions; thereafter, data is erased or minimised when no longer needed, without prejudice to legal obligations or the protection of legal rights. |
| Meeting bookings | For as long as necessary to arrange and manage the meeting and any related pre-contractual discussions; thereafter, according to the same criteria applied to commercial contacts. |
| Newsletter / marketing | Until consent is withdrawn or the data subject objects and, in any event, only for as long as the data remains necessary and relevant to the purpose, subject to periodic review. Evidence of consent may be retained for as long as necessary to demonstrate lawfulness. |
| Technical/security logs | For the period strictly necessary for system operation and security, according to the technical retention periods of the services used and any need to investigate abuse or security incidents. |
| Cookies and tracking technologies | As specified in the Iubenda Cookie Policy and preference panel. |
| Data connected with legal obligations or disputes | For the period required by law or necessary to protect legal rights. |
11. Data security
ATENA SRL implements technical and organisational measures appropriate to the risk in order to protect personal data against loss, destruction, alteration, unauthorised disclosure or access. Such measures are reviewed and updated in light of technological developments, the nature of the data and the risks of the processing.
12. Data subject rights
Subject to the conditions and limitations laid down in the GDPR, data subjects may exercise the rights provided for in Articles 15–22 GDPR, including the right to:
- obtain confirmation as to whether personal data is being processed and access that data;
- request rectification of inaccurate data or completion of incomplete data;
- request erasure where the legal requirements are met;
- obtain restriction of processing;
- object to processing based on legitimate interests and, at any time, to direct marketing;
- receive personal data in a structured, commonly used and machine-readable format and request portability where applicable;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- not be subject, where Article 22 GDPR applies, to a decision based solely on automated processing that produces legal or similarly significant effects.
Requests may be sent to financeatena@atenait.it. The Controller will respond within the time limits provided by applicable law.
13. Complaint to a supervisory authority
Data subjects have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or, where applicable, with the competent supervisory authority in the EU or EEA country where they reside, work or where the alleged infringement occurred. The right to seek a judicial remedy remains unaffected.
14. Automated decision-making and profiling
Website browsing, submission of requests, meeting bookings and newsletter subscriptions do not involve decisions based solely on automated processing that produce legal effects concerning the user or similarly significantly affect them.
ATENA SRL does not carry out lead scoring or behavioural profiling of contacts through the Website or the connected CRM.
15. Third-party data and external links
If a user provides personal data relating to third parties, the user is responsible for ensuring that they are entitled to do so under applicable law. The Website may also contain links to third-party websites or services; ATENA SRL does not determine how those third parties process personal data and users should review the relevant privacy notices.
16. International users and English-language version
The Website is also available in English and may be addressed to users and organisations outside Italy. ATENA SRL is established in the European Union and processes personal data in accordance with the GDPR and applicable Italian law.
Where Finance Atena specifically targets markets in which additional local privacy laws apply, ATENA SRL will assess and implement any supplementary notices, rights or measures required by the applicable law.
The English version of this Privacy Policy is provided to make the information accessible to international users and must reflect the same processing activities described in the Italian version.
The Website is accessible internationally but, at present, Finance Atena does not state that its online offering specifically targets any particular non-EU market.
17. Updates to this Privacy Policy
This Privacy Policy may be updated to reflect changes in the law, ATENA SRL’s organisation, technology or the processing carried out through the Website. The current version will be published on the Website together with the date of the latest update. Where changes are material, the Controller will use appropriate means to inform users.
18. Contact details
For questions about this Privacy Policy or to exercise data-protection rights, please contact:
ATENA SRL – Data Controller
Via G. Amendola, 1 – 20063 Cernusco sul Naviglio (MI), Italy
VAT No. 08577730156
E-mail: financeatena@atenait.it
Finance Atena® is a product of ATENA SRL.