Privacy Policy (pursuant to Art. 13 of the General Data Protection Regulation)

1. Introduction

If you’d like to take just a few minutes, we’ll explain in a simple way what we do with your personal data that we collect when you access and use our service platform, or any of our related mobile Apps (collectively, the ‘Platform’), accessible from www.glickon.com (the ‘Site’ and, together with the Platform, the ‘Services’).

The applicable legislation, namely mainly the EU Regulation No. 2016/679 (General Data Protection Regulation, ‘GDPR’), the Legislative Decree. 196/2003, as subsequently amended and supplemented (the ‘Privacy Code’) and the relevant provisions, decisions and guidelines issued by the Italian Data Protection Authority (collectively, the ‘Privacy Law’), identify various figures who must – or sometimes simply can – enter the scene, taking part in data processing operations, with different roles and responsibilities based on the degree of involvement and the discretionary power they may exercise with respect to how and why your data may be processed.

‍

Data Controller

The main actor is called ‘controller’ and freely and autonomously determines the purposes, methods and tools of the processing, therefore having to ensure the security of your data and the protection of all your rights in accordance with the Privacy Law.

As developer and administrator of the Platform, the controller of the processing described in this information notice is Glickon S.p.A., a company under Italian law with registered office in Milan (20129), Via Nino Bixio 7, VAT number, tax code and registration number with the Register of Companies of Milan 08573820969 (‘Glickon’, the ‘Controller’ or ‘we/us’).

Other actors may also come into play, but they will not have a leading role, but a supporting – albeit fundamental – role towards the data controller. More precisely, the Privacy Law establishes that one or more specific processing activities can be delegated to external service providers, as long as they are reliable, called ‘data processors’, who will be able to act exclusively on behalf of and under written instruction – and therefore as an operational longa manus – of the data controller.

Please note that whenever we speak of ‘processing’ of data, we will be referring to any operation or set of operations carried out, by automated means or otherwise, on or through personal data, such as the collection, recording, organization, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison, erasure or destruction of data.

Having said that, it is worth pointing out that ‘personal data’ are not at all only those immediately referable to you (e.g. name and last name), but also those which, in combination with other information available to us or to any other party, would allow you to be identified in any case (e.g. your tax code or the IP address of the device with which you access the Platform).

The processing operations carried out in connection with the Services will take place exclusively in Italy, in full compliance with the current Privacy Law.

‍

2. Your privacy in the context of our services

Both the Platform and the Website have been designed and created in such a way as to reduce the collection and use of personal data as much as possible, excluding the processing in all cases where it is possible to achieve the purposes of such Services, both by Glickon and by our client active on the Platform (‘Partner Companies’), in ways that are less invasive of your privacy.

The Platform allows the execution of numerous services, but its main objective is to allow Partner Companies to use it to submit their users to gaming activities:

• directly or by giving specific instructions to Glickon, consisting in ‘challenges’ – i.e. challenges based on skill and knowledge tests – aimed at assessing the User’s skills and competencies in certain subjects. The User may also participate just for fun, to train and develop his knowledge in specific areas, without the involvement of any Partner Company; and/or
• in the HR field, for a variety of purposes at the discretion of the Partner Company involved from time to time (e.g. onboarding, training, internal communication, skill mapping, surveys).

This policy refers only to the processing operations carried out through the Platform and does not apply in any case to websites, applications and platforms of third parties, including any social networks, which may be accessible from or through it. We therefore invite you to carefully read their Privacy policies, before accessing or using their services, in order to understand exactly how their managers will treat your data.

‍

3. What personal data we process

The data about you that we will collect and process as data controller, for the purposes described in Par. 4, are as follows:

A. Navigation Data

The computer systems used for the correct functioning of our Services collect, in the course of their normal operation, some data necessary for the use of Internet network protocols (e.g. the IP address of the device you use to access and navigate on it). In the absence of additional information, this type of data does not allow us to identify you, but only to enable your access, your navigation and your correct use of our Services.

B. Data collected through cookies

We use technical and functional cookies to make your navigation on the Website and the Platform easier and more pleasant. For further information on these cookies and, in particular, on the analytical and profiling cookies which, eventually, if you allow us to do so, we will install for your better use of our Services, please refer to our Cookie policy.

C. Contact Information Related to Your Requests

If you write to us to receive information or assistance about our Services, we will inevitably need to collect and process data that you choose to provide to us in connection with and in the context of your requests. In particular:

• general information: if you write to support@glickon.com (including from ‘Contact Us’), we will receive your email address, as well as any other personal data you choose to share with us in the subject line, content and any attachments to your communication. You do not need to be registered to send requests to our email address;
• request a demo: we have created a form through which you can get a demo of the Platform. We will ask you for your name, last name, company, job position, business email and telephone, in order to be able to respond in the most efficient and specific way to your request;
• request for assistance: only if you have registered with the Platform (see point E below), you will be able to request our support at any time by simply clicking on the appropriate icon at the bottom right. We will ask for your name and e-mail address, so that we can contact you again to provide you with all the necessary assistance.

We do not need any other data than those just mentioned. Therefore, we invite you not to send us, through any attached documents or in the free fields available in the appropriate forms (which we have included only to allow you to describe more precisely your needs), personal data other than those strictly necessary to allow us to follow up your request. In most cases, we will immediately delete this additional data, unless there is a legal basis under Article 6 of the GDPR that justifies its processing by us.

D. Registration data

Navigation on the Site is completely free. Access to the Platform, however, requires your registration. This can be done in two ways:

• New Registration
  
  To create your personal account on the Platform, we will only ask you for your first name, last name and email address. Of course, you will have to create your own password, which you will have to keep secret and safe.
• Social log-in
  
• By Social Login we mean the technology that allows you to share in an automated way with the administrators of websites or web platforms – in this case us – some personal data linked to your account on any social network. In short, if you decide to log in with your Google, Facebook or Linkedin credentials (at the moment we have activated the link with these third party sites), their operators can send us the data necessary for your registration on the Platform, without you having to enter them manually. In this case, therefore, some fields of the registration or log-in form will be preloaded, drawing on the information made available by the third parties involved based on the preferences you set on their platforms. For more detailed information regarding the personal data that may be shared, we invite you to carefully read the Privacy Policy of the third party operators involved (Facebook, Linkedin, Google).
• It is understood that Glickon will never be able to take possession of your private credentials, as these will remain under your exclusive control and that of the third party responsible for them.
• Obviously, you can disconnect your social login from the Platform at any time, it being understood that this will prevent your access to the Platform until you re-register in one of the two ways described above.

E. Data related to your personal profile in the Platform

The only data required to access the Platform, by creating your personal account, are those indicated at letter D above (first name, last name and e-mail or, in case of social login, your access credentials to the third party platform connected to ours).

Once you have registered to the Platform, however, you can decide at any time, spontaneously (we will never ask you to do so, but eventually only directly by the Partner Companies), to enrich your profile with more detailed information both at the personal level and regarding your education, experience and skills, providing us with one or more of the following additional data: date of birth; gender; nationality; short biography (free field); telephone number; home address; level of studies (eg. (e.g. diploma, bachelor’s degree, master’s degree, doctorate); university (if any); degree and, if obtained, year and grade; company (if any) and role; curriculum vitae (to be attached).

Never send sensitive data, such as those concerning your health status or your political opinions or religious beliefs, not even in attached documents, unless this kind of information is strictly necessary to allow Partner Companies that use the Platform for recruitment purposes, under their sole responsibility as data controllers, to evaluate your application for specific job positions, pursuant to Art. 9.2, letter b) of the GDPR.

F. Newsletter

If you want to subscribe to our Newsletter and keep up to date with news about Glickon and our services and events, we will only ask you for your first name, last name and e-mail.

G. Data resulting from your participation in Glickon Challenges

All the content (e.g. text, images, graphics, video, audio and any other information) present in the private pages of the Partner Companies within the Platform, as well as any processing of personal data following your access to these pages and their content, including the Challenges, are the exclusive responsibility of the Partner Company that has uploaded them and manages them independently.

Pursuant to the Privacy Law in force, therefore, each of the Partner Companies is configured as the sole and only controller, while Glickon is the processor on behalf of each of them, in accordance with the provisions of Art. 28 of the GDPR, with reference to any processing operation subsequent to your registration to a Challenge of a Partner Company.

Glickon is the controller only of the processing related to the Challenges organized on its behalf, accessible in the public pages of the Platform (for which your registration is still required).

In the latter case, we will collect and process only those personal data that may be contained in the answers you provide to the tests carried out, processing them, as explained below, to assess your level of competence with respect to the specific subject matter of the test.

‍

4. Purpose and legal basis of the processing

The control over what is done with your data is and must remain solely in your hands. For this reason, it is our duty to provide you with every detail necessary to understand the processings that we may carry out through the Platform and, for each of them, to indicate the legal basis that allows us – or would allow us, if the processing is based on your consent – to carry out such activities.

Navigating the Services

Based on our legitimate interest (Art. 6.1, f), of the GDPR), we will collect and process only those few technical data that are necessary to allow you to easily access and navigate seamlessly on the Platform and the Website, thus using our Services without slowdowns or impediments resulting from the operation of Internet protocols. We emphasize that this information does not allow us to identify you, except after associating and comparing it with specific and separate personal data.

Improve your experience of using the Services through the use of cookie

For more detailed information regarding the use of technical, functional, analytical and profiling cookies on the Website and Platform, please read our Cookie policy.

Response to your contact and support request

If you decide to contact us by email, or in any of the other available ways, for any reason such as, for example, to ask us for information or assistance regarding the Services, we will only process your data in order to answer and follow up on your request (Art. 6.1, b), of the GDPR). Without your data, we will not be able to provide you with any feedback.

Manage your Platform registration and personal account

In order to execute your request for access to the Platform (Art. 6.1, b) of the GDPR), we will ask you in advance to register, providing us with only those data (identified above) that are strictly necessary for the creation of your personal account. If you prefer not to register and not to provide us with any data for this purpose, you may continue to freely browse the Website, but not enter the Platform.

We may also use your registration data, with particular reference to your email, to send you service communications, i.e. strictly related to the management of your personal profile and the operation of the Platform and its services, without any promotional or commercial purpose.

If, after creating your account, you decide to enrich it by spontaneously sharing more detailed information (as specified above) both of a personal nature and regarding your educational and professional experiences, we will use this additional data of yours, based on our legitimate interest (Art. 6.1, f) of the GDPR), exclusively to make it available to the Partner Companies that request it and only in the case that you decide to participate in one of their Challenges, to avoid being asked again during the registration phase. You may object at any time to the processing of this specific category of data by us.

Sending newsletter

Only if you provide us with your specific consent to receive marketing communications (art. 6.1, a) of the GDPR), including by subscribing to our Newsletter, we may send you messages and emails of a commercial and promotional nature regarding our Services. It is understood that you may revoke your consent at any time, without affecting the lawfulness of the processing carried out by us up to that moment.

Managing the outcomes of our Challenges – ‘Skills’ section of the Platform

It is fundamental to clarify that we are referring here only and exclusively to the Challenges included in the ‘Competences’ section of the Platform, i.e. those that Glickon organises and manages autonomously, as holder of the data, without any mandate from the Partner Companies. For the Challenges organised by the latter, in fact, you will receive a separate privacy notice, before confirmation of your enrolment in each of them, directly from the Partner Company involved from time to time and under its exclusive responsibility, as autonomous data controller, as already mentioned.

The data connected to the results of the Challenges in which you have taken part will be processed by us solely for the purpose of examining your level of competence and knowledge of the subject matter of the test performed, including by means of the elaboration of a score on the basis of three factors consisting of (i) the time taken to answer; (ii) the number of correct answers provided by you with respect to the total; (iii) the pre-assigned value of the specific answer you have chosen, based on its importance and difficulty.

The legal basis applicable to this processing is our legitimate interest (art. 6.1, a) of the GDPR) to carry out as efficiently as possible those evaluation activities that are the basis of this specific service – among other things, the only one that Glickon provides autonomously through its Platform – of analysis of your level of preparation and experience in specific areas. You may oppose at any time, for your own personal reasons, the carrying out by us of this type of processing, without this affecting in any way what has already been done up to that moment.

Among other things, you will be free to decide, through appropriate settings of your personal account, whether to make visible and possibly to whom some information about your profile and your skills.

‍

5. Who may process your personal data

Should we entrust to third parties specific processing activities of your data related to the operation of the Platform and/or the provision of the Services, each supplier involved, subject to our assessment of their level of competence and reliability, will be required to apply at least the same levels of protection of your data as we do, by signing an agreement with Glickon pursuant to Art. 28 of the GDPR and thus acting as our data processor.

Your data will not be disclosed in any way, nor communicated to third parties, with the exception of the Partner Companies that activate the services of the Platform and that, consequently, instruct us in writing to process your data on their behalf, or when we have to comply with orders or provisions issued by the competent authorities.

In any case, we have adopted a series of technical and organizational measures to ensure adequate levels of security in order to prevent all reasonably foreseeable risks that may affect your personal data, with particular but not limited reference to their destruction, loss, modification or unauthorized disclosure or access, accidental or illegal, to the same.

‍

6. Transfer of data to Third Countries

The data processing operations on our part will always take place within the European Economic Area (‘EEA’).

If for any reason we need to transfer your data to countries outside the EEA which do not provide levels of protection and security that are at least equivalent to those required by the Privacy Policy, we will firstly notify you immediately of such a need and secondly, we will impose the same obligations on the entity to which the data is to be transferred to protect and secure your data as we do, as described in this notice (e.g. by entering into Standard Contractual Clauses with the recipient of the data and carrying out, where required, a risk assessment of the transfer).

‍

7. How long we keep your data

We will retain your personal data only for as long as is necessary to achieve the purposes described above.

This means that the data collected:

• in order to allow you to browse the Platform, will only be stored for as long as you remain on the Platform, or until you decide to delete them (by deleting technical and functional cookies – see next point);
• cookies installed on the Platform will only be processed for the duration – i.e. until the expiry date – of each specific cookie (technical, functional, analytics and advertising/profiling) to which they are associated, as specified in our Cookie policy;
• in relation to requests for contact or support that you decide to send us, they will be processed only for the time necessary to provide you with the information and/or assistance you need, thus properly following up on your request. One year after the last answer we will have sent you, the data will be deleted;
• in order to enable and manage your registration to the Platform, as well as to send you communications related to the services connected to it (contractual communications), will be processed and stored until you decide to close your personal account on the Platform. The same applies to any additional data that you decide to share in order to enrich your personal profile, but in this case you can opt out of their processing at any time, with the consequent cessation of any further activity on our part;
• as part of your subscription to our newsletter they will be processed and stored until you decide to revoke your consent or request their cancellation;
• as a consequence of and within the scope of the Challenges organized by Glickon in which you have registered, your personal data will be processed and kept for 24 months from the moment of its collection, unless you decide to object to its processing before the end of this period.

After the expiry of the terms indicated above, we may further retain your data only for purposes expressly permitted, or even imposed, by the rules of law in force from time to time (eg to ascertain, exercise or defend our rights before the Judicial Authority).

‍

8. Your rights

You may at any time exercise the rights granted to you by the Privacy Policy, namely:

• Access: to know whether or not your data is being processed and, if so, to receive evidence – among other things – of the purposes of processing by us, the categories of data involved, the recipients to whom the data may be disclosed, the applicable storage period, the existence of an automated decision-making process;
• Rectification: obtaining without any unjustified reason the modification and updating of any inaccurate data concerning you;
• Deletion: obtaining the deletion of your data, except in express cases of derogation, when the same (i) are no longer necessary in relation to the purposes for which they were collected or otherwise processed; or (ii) have been processed unlawfully; or (iii) are subject to processing to which you objected for your own personal reasons, as provided for in paragraph f. below, and there is no overriding legitimate reason that allows us to continue processing; or (iv) must be deleted in compliance with a legal obligation to which we are subject;
• Limitation of processing: obtaining from us the suspension of the processing of your data when: (a) you dispute their accuracy, for the period necessary to allow us to carry out the necessary verifications; (b) the processing is unlawful and you decide to object to the deletion of your data, requesting instead that their use be limited; c) the same are no longer necessary for us in relation to the purposes identified above, but you need them for the purposes of ascertaining, exercising and/or defending one of your rights in court; d) you have exercised your right to object, pending verification by us of the existence of prevailing legitimate reasons that allow us to continue to process your data;
• Portability: requesting to receive in a structured, commonly used and machine-readable format the personal data you have provided to us and/or to transmit them directly to another data controller;
• Opposition: objecting, on grounds related to your personal situation, to the processing operations (for the sending of our newsletter, in addition to those of your personal profile enrichment data and those related to the results of our Challenges) carried out on the basis of our legitimate interest, obtaining their termination, except when (i) there are one or more compelling legitimate reasons, on our part, that prevail over your interests, rights and freedoms and that allow us to continue the processing; (ii) your data is necessary to enable us to ascertain, exercise or defend a right of ours in a court of law;
• Withdrawal of consent: by withdrawing the consent you previously gave to receive our newsletter, it being understood that the processing we will have carried out up to that moment will remain fully lawful;
• Complaint: by submitting a complaint to the competent supervisory authorities – in Italy the Italian Data Protection Authority – if you believe that one or more treatments of your data are carried out by us in violation of the current Privacy Law. This does not affect your right to lodge an administrative or jurisdictional appeal.

In order to exercise your rights and to ask for any information or clarification regarding the processing of your data as described in this privacy policy, you may send us a written request at any time, by mail to Glikon S.p.A., Via Nino Bixio 7, Milan (20129), or by e-mail to privacy@glickon.com.

‍

Milan, 7th April 2021