Privacy Notice for Customers, Suppliers, Job Applicants and Other Business Contacts. This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) to individuals whose personal data are processed by ComPart Multimedia S.r.l. in connection with professional, commercial, contractual and administrative relationships, as well as recruitment and personnel selection activities.
This notice also applies when contacts take place outside the website, for example by email, telephone, meetings, quotations, contracts, job applications or interviews. For website browsing and the contact form, please refer to the Website Privacy Policy.
1. Data Controller
ComPart Multimedia S.r.l.
Via delle Cave, 105 – 00181 Rome, Italy
Italian Tax Code and VAT No. 05327951009
For enquiries concerning personal data protection or to exercise rights under the GDPR, you may use the contact form, specifying that your request concerns privacy, or write to the registered address indicated above.
2. Data Subjects and Categories of Personal Data
Processing concerns individual customers and suppliers, professionals and sole traders, as well as legal representatives, commercial, administrative or technical contacts, employees and collaborators of companies and organisations with which ComPart maintains or considers establishing professional relationships. It also concerns applicants for positions at ComPart Multimedia.
Depending on the relationship, the following data may be processed: first name, surname, company or organisation, professional role or position, business contact details, correspondence, appointments, enquiries, quotations, offers, orders, contracts and project-related documentation. Where relevant, tax, invoicing, payment and banking information relating to individuals may also be processed.
For recruitment purposes, the data processed include applicants' identification and contact details, CVs, educational qualifications, professional experience, skills and any relevant assessment notes concerning applications and interviews.
The routine collection of special categories of personal data under Article 9 GDPR or data relating to criminal convictions and offences under Article 10 GDPR is not envisaged for these purposes.
3. Purposes and Legal Bases
- Management of professional contacts and relationships: receiving and responding to enquiries, preparing quotations and offers, negotiating agreements, coordinating activities and maintaining relevant records of relationships with representatives of companies and organisations. Legal basis: the Controller's legitimate interest (Article 6(1)(f) GDPR) in managing and documenting professional relationships, while respecting data subjects' rights.
- Contracts with individuals: taking pre-contractual steps requested by the data subject and entering into or performing contracts with professionals, sole traders or other individual contracting parties. Legal basis: Article 6(1)(b) GDPR.
- Management of suppliers, consultants and assignments: evaluating proposals, placing orders and managing contractual performance, communications and professional contacts. Legal bases: Article 6(1)(b) GDPR where the contracting party is an individual; Article 6(1)(f) GDPR for representatives of organisations.
- Administrative, accounting and tax obligations: issuing and receiving invoices, recording transactions, managing receipts and payments, documenting statutory obligations and protecting rights connected with business relationships. Legal bases: compliance with a legal obligation (Article 6(1)(c) GDPR); where relevant, contractual performance (point (b)) and legitimate interest in protecting claims and legal rights (point (f)).
- Recruitment and personnel selection: receiving and assessing job applications and CVs, reviewing qualifications and professional experience, arranging interviews and deciding on possible recruitment. Legal basis: taking pre-contractual steps at the data subject's request (Article 6(1)(b) GDPR). Consent is not required for these activities, also in accordance with Article 111-bis of the Italian Privacy Code.
These data are not currently used for unsolicited promotional campaigns, newsletters, profiling or decisions based solely on automated processing. Recruitment decisions are also made through human assessment, without automated decision-making systems.
4. Sources of Personal Data
Personal data are normally provided directly by the data subject during communications, meetings, enquiries or contractual relationships. They may also be provided by the company or organisation to which the individual belongs, by another contact involved in the relationship, or obtained from professional and contractual documents exchanged.
For recruitment purposes, personal data are mainly obtained from applications submitted through Indeed, unsolicited CVs or personal referrals made with the applicant's knowledge.
Where personal data are not obtained directly from the data subject, the notice is provided in accordance with the conditions and time limits set out in Article 14 GDPR. Article 111-bis of the Italian Privacy Code also applies to unsolicited CVs and provides for information to be supplied at the first appropriate contact following receipt of the CV. Data subjects may request information about the source of their personal data.
5. Provision of Personal Data
Providing contact details is generally voluntary, but certain information is necessary to respond to enquiries or establish and manage contractual relationships. Tax and accounting information required by law is necessary to comply with the relevant obligations. Failure to provide essential information may prevent the management of an enquiry or relationship.
For job applications, providing personal data is voluntary, but the information necessary for a professional assessment must be available in order to participate in the selection process.
6. Recipients and Services Used
Personal data are accessible to authorised internal personnel within the limits of their responsibilities. Where necessary, data may be disclosed to accounting and tax consultants, appointed professionals, banks, public bodies and competent authorities, as well as providers of technological services actually used to manage communications, documentation and business relationships.
Technical services used include email and hosting services provided by A2 Hosting LLC / hosting.com and, where relevant, document storage and contact synchronisation tools and certified email services. These providers process personal data according to their respective privacy roles and applicable agreements. Personal data are neither sold nor disclosed for advertising purposes.
For recruitment, ComPart Multimedia uses the Indeed platform to manage applications, CVs and any relevant assessment notes. Applicants' data are accessible only to authorised company personnel and relevant technical service providers. They are not disclosed to ComPart Multimedia's clients during the selection process.
7. Transfers Outside the EEA
Some technological services may involve the processing or transfer of personal data outside the European Economic Area. In such cases, the safeguards provided for in Chapter V of the GDPR apply, depending on the provider and service concerned: European Commission adequacy decisions, including the EU–U.S. Data Privacy Framework where applicable to the recipient, Standard Contractual Clauses or other safeguards provided for by law.
Indeed also states that applicants' personal data may be transferred internationally, including to the United States, subject to Standard Contractual Clauses (SCCs) and the EU–U.S. Data Privacy Framework, where applicable.
Data subjects may request information from the Controller about the safeguards applicable to their relationship.
8. Data Retention
- General enquiries or contacts not resulting in a significant commercial relationship: up to five years from the last interaction, where there is a reasonable need to retain the relevant history.
- Commercial relationships with customers and prospective customers: commercial documentation, quotations, offers, contracts, correspondence and contact details are retained for up to ten years from the last significant commercial relationship, identified by the most recent enquiry, offer, project or other substantial interaction.
- Relationships with suppliers, consultants and professionals: contact details and correspondence are retained for the duration of the relationship and subsequently for as long as reasonably necessary to maintain professional relationships or protect legal rights; data that are no longer necessary are deleted or updated.
- Accounting and tax documentation: normally ten years from the last accounting entry or according to any different retention periods required by applicable law, without prejudice to audits, disputes or further obligations.
- Job applications and recruitment: applications, CVs and assessment notes managed through Indeed are no longer accessible through the company's account after approximately 24 months, according to the platform's functionality. This does not necessarily mean that the data have been permanently deleted from the provider's systems. Closed job advertisements may remain visible in the account history without applicants' personal data. CVs received by email from unsuccessful applicants are deleted at the end of the selection process. CVs of successful applicants become part of their employment records and are retained according to the applicable personnel data retention criteria.
After the applicable retention period, data managed directly by ComPart are deleted or anonymised, unless further documented needs or legal obligations apply. Backup copies follow the respective technical retention and overwriting cycles.
9. Data Subjects' Rights
In the cases and within the limits provided for by the GDPR, data subjects, including job applicants, may request access to their personal data, rectification, erasure, restriction of processing and, where applicable, data portability. They may object to processing based on legitimate interest on grounds relating to their particular situation. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
To exercise these rights, the contact details provided in Section 1 may be used. No consent or signed acknowledgement is required for the processing activities described in this notice.
10. Security and Updates
ComPart Multimedia adopts technical and organisational measures proportionate to the risks, including restricted access for authorised personnel, protection of accounts and archives, and backups of relevant systems. This notice is reviewed whenever processing activities, relationships or applicable requirements change.
Last updated: 13 November 2026.