Informativa Privacy

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Last updated: 28 February 2026

This privacy policy describes the ways in which WMIE S.R.L. collects, uses, stores, and protects the personal data of its users. This policy will be updated periodically to reflect any changes in processing practices or applicable legislation. We encourage you to review it regularly.

1. Data Controller

The Data Controller for personal data processing is:

WMIE S.R.L.

Registered office: Via Dante Alighieri 93, 09128, Cagliari (CA), Italy

Website: https://wmie.it

Email for privacy matters: privacy@wmie.it

WMIE S.R.L. has not appointed a Data Protection Officer (DPO) as the conditions set forth in Art. 37 of the GDPR do not apply. For any requests relating to the processing of personal data, you may contact the Data Controller at the email address privacy@wmie.it.

2. Categories of Data Subjects

This privacy policy applies to the processing of personal data of the following categories of individuals:

Visitors to the website https://wmie.it

Users who fill in the contact forms on the website

Newsletter subscribers

Clients and prospective clients

Candidates who submit their applications through the “Work with us” section

3. Categories of Personal Data Collected

3.1 Data voluntarily provided by the user

We collect the following personal data provided directly by the user through the forms on the website:

First name and surname

Email address

Company name

Any additional information provided by the user in free text fields (for example, the subject and content of a contact request)

For the “Work with us” section, the following data may also be collected:

Curriculum Vitae and the information contained therein (work experience, education, skills)

Cover letter or motivation letter

Any other documents attached by the user

3.2 Data collected automatically during browsing

During browsing on the website, certain technical data is collected automatically, including:

IP address

Browser type and operating system

Pages visited, duration of the visit, and navigation paths

Date and time of access

Data collected through cookies and similar tracking technologies (see section 7)

We do not collect data belonging to special categories (sensitive data) within the meaning of Art. 9 of the GDPR, such as data relating to health, racial or ethnic origin, political opinions, religious beliefs, or sexual orientation.

Personal data is processed for the following purposes, each with its own legal basis:

Purpose

Legal basis

Legitimate interest (if applicable)

Responding to contact requests submitted through the website forms

Performance of pre-contractual measures (Art. 6.1.b)

Management of the contractual relationship with clients

Performance of a contract (Art. 6.1.b)

Tax, accounting, and regulatory compliance

Legal obligation (Art. 6.1.c)

Sending newsletters and marketing communications

Consent of the data subject (Art. 6.1.a)

Profiling for marketing purposes (analysis of preferences and behaviour)

Consent of the data subject (Art. 6.1.a)

Tracking interactions with marketing communications (email opens, link clicks)

Consent of the data subject (Art. 6.1.a)

Traffic analysis and website improvement

Legitimate interest (Art. 6.1.f)

Improving the browsing experience and ensuring the proper functioning of the website

Website security and abuse prevention

Legitimate interest (Art. 6.1.f)

Protecting the website and systems from unauthorised access and harmful activities

Evaluation of applications received through “Work with us”

Performance of pre-contractual measures (Art. 6.1.b) and legitimate interest (Art. 6.1.f)

Assessing the suitability of candidates

Use of artificial intelligence systems to support business activities

Legitimate interest (Art. 6.1.f) and/or consent (Art. 6.1.a) where required

Improving the efficiency of business processes and the quality of services offered

Where processing is based on the legitimate interest of the Data Controller, this interest has been balanced against the rights and freedoms of the data subjects, taking into account the nature of the data processed, the reasonable expectations of the data subjects, and the security measures adopted.

5. Marketing, Newsletter, and Profiling

5.1 Newsletter and marketing communications

With the explicit and specific consent of the user, WMIE S.R.L. may send commercial and promotional communications relating to its services via email (newsletter).

Consent to marketing is optional, separate, and independent from the use of our services. The user may withdraw consent at any time:

By clicking the unsubscribe link included in every marketing communication

By writing to privacy@wmie.it

The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

For existing clients, WMIE S.R.L. may send commercial communications relating to services similar to those already provided (so-called “soft spam”), pursuant to Art. 130, paragraph 4, of Italian Legislative Decree 196/2003 (the Italian Data Protection Code), unless the data subject objects. This provision allows the sending of promotional emails about similar products or services to existing customers without prior consent, provided that the customer is given the opportunity to opt out at the time of data collection and in each subsequent communication.

5.2 Tracking of marketing communications

Marketing communications sent by WMIE S.R.L. may include tracking technologies (web beacons, tracking pixels) that detect whether the user has opened the message and which links were clicked. Such data is used to assess the effectiveness of communications and improve their relevance. Tracking is carried out on the basis of the consent provided by the user at the time of subscription.

5.3 Profiling

With the explicit and separate consent of the user, WMIE S.R.L. may carry out profiling activities, i.e. the analysis of collected data (including website browsing data and interaction data with marketing communications) in order to:

Understand the preferences and interests of the user

Personalise the content of commercial communications

Offer more relevant services and promotions

Profiling does not produce legal effects on the data subject nor does it significantly affect them. No decisions based solely on automated processing that produce legal effects or that significantly affect the data subject are made, within the meaning of Art. 22 of the GDPR.

Consent to profiling is optional, separate from consent to marketing, and independent from the use of our services. The user may withdraw it at any time by writing to privacy@wmie.it.

6. Use of Artificial Intelligence Systems

WMIE S.R.L. uses systems and tools based on artificial intelligence to support its business activities. Such tools may be used, by way of example, for:

Support in creating and reviewing content

Analysis and optimisation of internal processes

Support in communications with clients and users

Any personal data processed through such tools is subject to the same protection guarantees provided for in this privacy policy. WMIE S.R.L. selects artificial intelligence service providers that offer adequate guarantees of compliance with data protection regulations.

Where the user interacts with an automated system (for example, a chatbot), they will be clearly and transparently informed from the beginning of the interaction.

Users' personal data is not used to train, develop, or improve artificial intelligence models, unless the data subject has given prior specific consent.

7. Cookies and Tracking Technologies

The website https://wmie.it uses cookies and similar tracking technologies. Technical cookies, which are necessary for the functioning of the website, do not require user consent. Profiling cookies and third-party analytics cookies are only installed with the user's consent, expressed through the cookie banner displayed on the website.

For detailed information on the cookies used, their purposes, and how to manage your preferences, please refer to the Cookie Policy available on the website.

8. Data Recipients

Personal data may be disclosed to the following categories of recipients, acting as Data Processors (pursuant to Art. 28 of the GDPR) or as independent data controllers, as applicable:

Hosting and web infrastructure service providers

Email and communication service providers

Email marketing and newsletter management platform providers

Web traffic analytics tool providers

Artificial intelligence tools and service providers

Consultants and professionals (accountants, labour consultants, lawyers) for tax, accounting, and legal compliance

Public authorities and supervisory bodies, where required by law

Personal data will not be disseminated, i.e. made available to unspecified parties, unless required by legal obligations.

An updated list of Data Processors is available upon request by writing to privacy@wmie.it.

9. Transfer of Data Outside the European Union

Some of the service providers used by WMIE S.R.L. are established in countries outside the European Union and the European Economic Area (EEA), particularly in the United States.

In such cases, the transfer of personal data takes place in compliance with Chapter V of the GDPR, on the basis of one or more of the following mechanisms:

Adequacy decisions by the European Commission (Art. 45 GDPR), where the destination country has been recognised as providing an adequate level of protection (for example, the EU-US Data Privacy Framework for certified US companies)

Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to Art. 46, paragraph 2, point (c) of the GDPR

A copy of the Standard Contractual Clauses adopted or information on the safeguards applied may be obtained by writing to privacy@wmie.it.

10. Data Retention

Personal data is retained for the time strictly necessary to achieve the purposes for which it was collected, in accordance with the following criteria:

Data relating to contractual relationships with clients: for the entire duration of the contractual relationship and subsequently for the period required by civil and tax legislation (10 years pursuant to Art. 2220 of the Italian Civil Code)

Data collected through contact forms: for the time necessary to manage and follow up on the request, and in any case no longer than 24 months from the last contact, unless a contractual relationship is established

Newsletter subscribers' data and data for marketing purposes: until the user withdraws consent. In the event of prolonged inactivity (no interaction for 24 months), the email address may be removed from distribution lists

Profiling data: until the user withdraws consent

Candidates' data (“Work with us”): for a maximum period of 24 months from receipt of the application, in order to evaluate potential future employment opportunities, unless otherwise indicated or a deletion request is made by the candidate

Browsing data and cookies: according to the timeframes set out in the Cookie Policy

At the end of the retention period, personal data will be deleted or irreversibly anonymised.

11. Rights of the Data Subject

Pursuant to Articles 15–22 of the GDPR, the user has the right to:

a) Access (Art. 15): obtain confirmation of the existence of the processing of their personal data and access the relevant information.

b) Rectification (Art. 16): obtain the correction of inaccurate personal data or the completion of incomplete data.

c) Erasure (Art. 17): obtain the deletion of their personal data in the cases provided for by law (for example, when the data is no longer necessary for the purposes for which it was collected, or in the event of withdrawal of consent).

d) Restriction of processing (Art. 18): obtain the restriction of the processing of their personal data in certain circumstances (for example, when the accuracy of the data is contested).

e) Data portability (Art. 20): receive their personal data in a structured, commonly used, and machine-readable format, and transmit it to another data controller.

f) Objection (Art. 21): object to the processing of their personal data based on the legitimate interest of the Data Controller, on grounds relating to their particular situation. The user has the right to object at any time to the processing of their personal data for direct marketing purposes, including profiling insofar as it is related to such marketing.

g) Not to be subject to automated decision-making (Art. 22): not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects them.

To exercise their rights, the user may contact the Data Controller by writing to:

Email: privacy@wmie.it

Postal address: WMIE S.R.L. – Via Dante Alighieri 93, 09128, Cagliari (CA), Italy

The Data Controller will respond to the request within 30 days of receipt, unless an extension of up to 60 additional days is required due to the complexity of the request, of which the user will be informed.

12. Right to Lodge a Complaint with the Supervisory Authority

If the user believes that the processing of their personal data violates the GDPR, they have the right to lodge a complaint with the competent supervisory authority.

In Italy, the supervisory authority is the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority):

Garante per la Protezione dei Dati Personali

Piazza Venezia 11, 00187 Roma

Website: https://www.garanteprivacy.it

Email: garante@gpdp.it

PEC (Certified email): protocollo@pec.gpdp.it

13. Consequences of Failure to Provide Data

The provision of personal data marked as mandatory in the forms on the website is necessary to enable WMIE S.R.L. to process the user's requests. Failure to provide such data will make it impossible to process the contact request, provide the requested services, or evaluate the application.

The provision of data for marketing, profiling, and newsletter subscription purposes is optional. Failure to provide such data does not in any way affect the ability to use the services offered by WMIE S.R.L.

14. “Work with Us” Section

Through the “Work with us” section of the website, WMIE S.R.L. collects applications from individuals interested in collaborating with the company.

The personal data collected in this context includes:

First name and surname

Email address

Curriculum Vitae and the information contained therein

Any cover letters and attached documents

Such data is processed solely for the purpose of evaluating the application for open positions or future employment opportunities. The legal basis is the performance of pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR) and the legitimate interest of the Data Controller in selecting the most suitable candidates (Art. 6.1.f GDPR).

Candidates' data will be retained for a maximum period of 24 months from receipt, unless otherwise indicated or a deletion request is made by the data subject.

Candidates are advised not to include special category data in their application (for example, data relating to health, ethnic origin, political opinions, or sexual orientation), unless this is strictly relevant to the position being applied for.

15. Changes to This Privacy Policy

WMIE S.R.L. reserves the right to modify or update this privacy policy at any time. The date of the last update is indicated at the top of the document. In the event of substantial changes, WMIE S.R.L. will inform users via the website or, where possible, through direct communication.

Users are advised to review this privacy policy periodically to stay informed about how their personal data is protected.

For any questions or requests relating to this privacy policy or the processing of personal data, you may contact WMIE S.R.L. at the email address privacy@wmie.it.

Politica Cookie

Pursuant to Art. 122 of Italian Legislative Decree 196/2003, Art. 5(3) of Directive 2002/58/EC (ePrivacy Directive)
and the Guidelines of the Italian Data Protection Authority (Garante) of 10 June 2021

Last updated: 28 February 2026

1. Data Controller

The Data Controller for the personal data collected through cookies and similar technologies is:

WMIE S.R.L.

Registered office: Via Dante Alighieri 93, 09128, Cagliari (CA), Italy

Website: https://wmie.it

Email for privacy matters: privacy@wmie.it

WMIE S.R.L. has not appointed a Data Protection Officer (DPO) as the conditions set out in Art. 37 of the GDPR do not apply. For any request, please contact the Data Controller at the email address privacy@wmie.it.

2. What are cookies

Cookies are small text files that are stored on the user's device (computer, tablet, smartphone) when visiting a website. Cookies allow the website to recognise the user's device and remember certain information about their previous visits.

Cookies can be:

First-party cookies: set directly by the visited website (wmie.it)

Third-party cookies: set by domains other than the visited website

Session cookies: temporary, automatically deleted when the browser is closed

Persistent cookies: remain on the device for a defined period or until manually deleted

In accordance with the Guidelines of the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) of 10 June 2021:

Technical and strictly necessary cookies may be installed without the user's prior consent, as they are essential for the functioning of the website.

Analytics, profiling and marketing cookies require the user's prior and explicit consent, expressed through the cookie banner on the website.

The legitimate interest of the Data Controller does not constitute a valid legal basis for the installation of non-technical cookies.

4. Categories of cookies used

4.1 Technical and strictly necessary cookies

These cookies are essential for the proper functioning of the website and cannot be disabled. They do not require user consent.

Cookie name

Provider

Purpose

Duration

Type

cookie_consent

wmie.it

Stores the user's cookie preferences

6 months

First party

PHPSESSID / session

wmie.it

Browsing session management

Session

First party

csrf_token

wmie.it

Protection against CSRF attacks

Session

First party

__Host-next-*

wmie.it

Framework session management (Next.js)

Session

First party

__cfruid

Cloudflare

CDN rate limiting

Session

First party

__cfuvid

Cloudflare

CDN rate limiting

Session

First party

__cf_bm

Cloudflare

Bot protection

30 minutes

First party

__hs_opt_out

HubSpot

Stores the visitor's opt-out choice

6 months

First party

__hs_do_not_track

HubSpot

Prevents tracking when enabled

6 months

First party

__hs_initial_opt_in

HubSpot

Controls the display of the cookie banner

7 days

First party

__hs_cookie_cat_pref

HubSpot

Records the accepted cookie categories

6 months

First party

hs-messages-is-open

HubSpot

Open/closed state of the chat widget

30 minutes

First party

hs_ab_test

HubSpot

Consistent variant in A/B tests

Session

First party

hs-membership-csrf

HubSpot

CSRF token for membership login

Session

First party

_calendly_session

Calendly

Calendly application session management

Session

Third party

_hjCookieTest

Hotjar

Checks whether the browser supports cookies

Immediate

First party

_hjTLDTest

Hotjar

Determines the main domain for cookies

Session

First party

4.2 Analytics cookies

These cookies collect information about how users interact with the website in order to improve its performance and user experience. They require the user's prior consent.

GOOGLE ANALYTICS (GA4)

For more information: policies.google.com/privacy

Cookie name

Provider

Purpose

Duration

Type

_ga

Google (GA4)

Distinguishes unique users for statistics

2 years

First party

_ga_<container-id>

Google (GA4)

Maintains the analytics session state

2 years

First party

_gid

Google (GA4)

Distinguishes unique users (short term)

24 hours

First party

_gat

Google (GA4)

Request rate limiting

1 minute

First party

HOTJAR

For more information: hotjar.com/legal/policies/privacy

Cookie name

Provider

Purpose

Duration

Type

_hjSessionUser_{site_id}

Hotjar

Identifies the unique user across sessions

1 year

First party

_hjSession_{site_id}

Hotjar

Links multiple pages in a recording session

30 minutes

First party

_hjFirstSeen

Hotjar

Identifies the visitor's first visit

Session

First party

_hjAbsoluteSessionInProgress

Hotjar

Detects the first pageview in a session

30 minutes

First party

_hjIncludedInSessionSample_{site_id}

Hotjar

Indicates whether the visitor is included in the sample

30 minutes

First party

_hjIncludedInPageviewSample

Hotjar

Indicates whether the visitor is included in the sample

30 minutes

First party

_hjViewportId

Hotjar

Stores the user's viewport ID

Session

First party

MICROSOFT CLARITY

For more information: privacy.microsoft.com

Cookie name

Provider

Purpose

Duration

Type

_clck

Microsoft Clarity

Identifies the unique user and stores preferences

1 year

First party

_clsk

Microsoft Clarity

Links multiple pages in a recording session

1 day

First party

CLID

Microsoft Clarity

Identifies the first interaction with Clarity

1 year

First party

ANONCHK

Microsoft Clarity

Verifies MUID to ANID transfer

10 minutes

Third party

MR

Microsoft (Bing)

Indicates whether to refresh MUID

7 days

Third party

MUID

Microsoft (Bing)

Microsoft user identifier for analytics

1 year

Third party

SM

Microsoft (Bing)

MUID synchronisation across Microsoft domains

Session

Third party

HUBSPOT (analytics cookies)

For more information: legal.hubspot.com/privacy-policy

Cookie name

Provider

Purpose

Duration

Type

__hstc

HubSpot

Main visitor tracking

6 months

First party

hubspotutk

HubSpot

Visitor identification for deduplication

6 months

First party

__hssc

HubSpot

Session tracking

30 minutes

First party

__hssrc

HubSpot

Browser restart detection

Session

First party

messagesUtk

HubSpot

Recognises returning visitors in the chat

6 months

First party

PLAUSIBLE ANALYTICS

No cookies used. Plausible Analytics is a web traffic analysis platform that does not use cookies and does not collect personally identifiable data. Plausible generates a temporary daily identifier based on the visitor's IP address and User-Agent, which is deleted at the end of each day. For this reason, Plausible does not require user consent under cookie regulations.

For more information: plausible.io/data-policy

GOOGLE TAG MANAGER

No cookies of its own. Google Tag Manager is a tag management system that does not set its own cookies during normal website operation. Tags loaded through Google Tag Manager (such as Google Analytics, Google Ads, Hotjar, etc.) may set their own cookies, as described in the respective sections. Google Tag Manager is configured to activate non-technical tags only after the user has given consent through the cookie banner.

For more information: policies.google.com/privacy

4.3 Profiling and marketing cookies

These cookies are used to track the user's browsing activity and create profiles based on their interests in order to deliver personalised advertising. The installation of these cookies always requires the user's prior and explicit consent.

GOOGLE ADS

For more information: policies.google.com/privacy

Cookie name

Provider

Purpose

Duration

Type

_gcl_aw

Google Ads

Stores Google Ads click information (GCLID)

90 days

First party

_gcl_dc

Google Ads

Display & Video 360 click information

90 days

First party

_gcl_au

Google Ads

Conversion linker experiment ID

90 days

First party

_gac_gb_<container-id>

Google Ads

Campaign-related information

90 days

First party

IDE

Google (DoubleClick)

Ad personalisation, measurement and frequency capping

13 months (EU)

Third party

NID

Google

Ad preferences and personalisation

6 months

Third party

1P_JAR

Google

Advertising measurement and targeting

30 days

Third party

HUBSPOT (marketing cookies)

Cookie name

Provider

Purpose

Duration

Type

__hmpl

HubSpot

Marketing tracking event metadata

Session

First party

CALENDLY (analytics/marketing cookies)

For more information: calendly.com/legal/privacy-notice

Cookie name

Provider

Purpose

Duration

Type

_ga (in widget)

Google/Calendly

Booking widget usage analytics

2 years

Third party

_gid (in widget)

Google/Calendly

Widget usage analytics (short term)

24 hours

Third party

Note: when Calendly is embedded via iframe, cookies are set on the calendly.com domain, making them third-party cookies in the context of the wmie.it website.

CAL.COM

For more information: cal.com/privacy

Cookie name

Provider

Purpose

Duration

Type

__clnds

Cal.com

Stores user/session preferences on the platform

1 year

Third party

session cookies

Cal.com

Booking application session management

Session

Third party

Note: when Cal.com is embedded via iframe, cookies are set on the cal.com domain, making them third-party cookies in the context of the wmie.it website.

5. Tracking technologies similar to cookies

In addition to cookies, the wmie.it website may use the following tracking technologies:

Web beacons (tracking pixels): small transparent images embedded in web pages or emails that allow verification of whether content has been viewed or an email has been opened. Web beacons in marketing communications are only activated with the user's consent.

Local storage: a browser storage mechanism similar to cookies but with greater capacity, used to store preferences and technical data.

Technologies that are not strictly necessary require the user's prior consent.

6. Third-party cookies

The wmie.it website incorporates content and services provided by third parties that may install their own cookies on the user's device. WMIE S.R.L. does not have direct control over cookies set by third parties.

Third-party content and widgets are not loaded until the user has given their consent through the cookie banner.

For the privacy policies of third-party providers:

Google (Analytics, Ads, Tag Manager): policies.google.com/privacy

HubSpot: legal.hubspot.com/privacy-policy

Hotjar: hotjar.com/legal/policies/privacy

Microsoft Clarity: privacy.microsoft.com

Plausible Analytics: plausible.io/data-policy

Calendly: calendly.com/legal/privacy-notice

Cal.com: cal.com/privacy

Meta (Facebook, Instagram): facebook.com/privacy/policy

LinkedIn: linkedin.com/legal/privacy-policy

7. How to manage cookies

On the first visit to the wmie.it website, the user is presented with a cookie banner that allows them to:

Accept all cookies ("Accept all" button)

Reject all non-essential cookies ("Reject all" button)

Customise their choices by cookie category (through the settings panel)

Closing the banner via the "X" button is equivalent to rejecting all non-essential cookies: only strictly necessary technical cookies will be installed.

The user may change their preferences at any time through the cookie preferences icon/link available on every page of the website.

The banner will not be displayed again for a minimum period of 6 months from the choice made, unless there are substantial changes to the cookies used by the website.

7.2 Via browser settings

The user may also manage cookies through their browser settings:

Google Chrome

Mozilla Firefox

Apple Safari

Microsoft Edge

Opera

Disabling all cookies may impair the proper functioning of certain parts of the website.

7.3 "Do Not Track" signal

The wmie.it website respects the Global Privacy Control (GPC) signal as an expression of the user's wish not to be tracked.

Cookies have different durations depending on their type and purpose, as indicated in the tables in section 4.

The preferences expressed by the user through the cookie banner are retained for a period of between 6 and 12 months, after which consent will be requested again.

Records of user consent are retained for a period of 2 years in order to fulfil the accountability obligations under the GDPR (Art. 5(2) and Art. 24).

9. Transfer of data outside the European Union

Some third-party cookies may involve the transfer of personal data to countries outside the European Union and the European Economic Area, in particular to the United States.

In such cases, the transfer is carried out on the basis of:

Adequacy decisions of the European Commission (Art. 45 GDPR), such as the EU-US Data Privacy Framework

Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c) GDPR)

For more information, please refer to the Privacy Policy of WMIE S.R.L.

10. Rights of the data subject

In relation to the personal data collected through cookies, the user may exercise the rights provided for under Articles 15-22 of the GDPR (access, rectification, erasure, restriction, portability, objection).

For a full list of rights, please refer to the Privacy Policy of WMIE S.R.L.

To exercise your rights: privacy@wmie.it

11. Right to lodge a complaint

If the user considers that the processing of their data infringes the applicable legislation, they have the right to lodge a complaint with the:

Garante per la Protezione dei Dati Personali (Italian Data Protection Authority)

Piazza Venezia 11, 00187 Roma

Website: https://www.garanteprivacy.it

Email: garante@gpdp.it

PEC: protocollo@pec.gpdp.it

WMIE S.R.L. reserves the right to amend this Cookie Policy at any time. The date of the last update is indicated at the top of the document. In the event of substantial changes, the cookie banner will be displayed again to the user to collect new consent.

For any questions regarding this Cookie Policy or the use of cookies on the wmie.it website, please contact WMIE S.R.L. at the email address privacy@wmie.it.