Personal Data Processing

The Data Controller is Algojob S.r.l., VAT no. 11656370969, operating under the brand Skillvue, with registered office in Via Molino delle Armi n. 11 — 20123 Milan (MI) (hereinafter also "Skillvue" or "the Company"), in the person of its legal representative pro tempore.

Data Controller Contact Details:

• Certified Email (PEC): think-up@legalmail.it
• E-mail for privacy matters: privacy@skillvue.ai

The Data Controller has designated a Data Protection Officer (DPO), who can be contacted for all issues related to the processing of personal data and the exercise of rights under the GDPR at the following email address: dpo@skillvue.ai

This privacy policy is addressed to Users of the website.

Skillvue processes the following categories of personal data:

• identification data (first name, last name);
• professional contact details (email address, telephone number);
• browsing data (IP address).

Personal data are processed for the following purposes, each based on its own legal basis:

4.1 Management of information requests received through Demo forms. Purpose: collect and manage requests for information, contact, or demo bookings sent by the User through forms on the Site, in order to respond to the request, illustrate the services offered by Skillvue and, where applicable, initiate pre-contractual negotiations. Legal basis: performance of a contract to which the data subject is party or taking steps at the request of the data subject prior to entering into a contract (Art. 6, para. 1, point b, GDPR).

4.2 Management of the Site and its operational features. Purpose: ensure the correct technical functioning of the Site, prevent and detect any malfunctions, errors, or cyberattacks, analyze how the Site is used by Users to improve the browsing experience, optimize performance, and enhance the usability of content and services offered. For this purpose, browsing data automatically generated by computer systems and communication protocols used to access the Site (such as IP address, browser type, operating system, pages visited, and access times) are processed in particular. Legal basis: the legitimate interest of the Data Controller (Art. 6, para. 1, point f, GDPR).

4.3 Establishment, exercise, or defense of the Data Controller's rights in out-of-court and/or judicial proceedings. Purpose: retain and process the customer's personal data collected in the context of the relationship to the extent necessary to establish, exercise, or defend a right of the Data Controller in out-of-court and/or judicial proceedings. Legal basis: legitimate interest of the Data Controller (Art. 6, para. 1, point f, GDPR), consisting of the protection of its rights and legitimate interests in out-of-court and judicial contexts. This legal basis is expressly recognized by Recital 49 GDPR and EDPB Guidelines, which identify defense in legal proceedings as an overriding, proportionate legitimate interest that cannot be balanced unfavorably against the Data Controller in the presence of an actual or reasonably foreseeable dispute. Processing for this purpose is limited to data strictly relevant to the dispute and ceases as soon as the dispute is concluded or the risk of litigation ceases.

4.4 Direct Marketing: sending commercial communications. Purpose: sending newsletters, product updates, commercial communications, event and webinar invitations, and announcements of offers or news relating to Skillvue's services. Legal basis: free, specific, informed, and unambiguous consent of the data subject (Art. 6, para. 1, point a, GDPR; Art. 130 Legislative Decree 196/2003). Consent can be revoked at any time, with effect for the future, through the methods indicated in paragraph 11 below and/or by clicking on the unsubscribe link present in every communication.

The processing of your Data is carried out both in paper and automated form in order to minimize the risk of destruction, loss (including accidental loss), unauthorized access/use, or processing inconsistent with the initial purpose of collection. This is achieved through technical and organizational security measures implemented by the Data Controller.

In customer relations, Skillvue does not employ solely automated decision-making processes pursuant to Art. 22 GDPR that produce legal effects concerning data subjects or similarly significantly affect them.

Providing data for the purposes set out in paragraphs 4.1, 4.2, and 4.3 is necessary for entering into and executing the relationship and for fulfilling legal obligations: refusal makes it impossible to establish or continue the relationship.

Providing data for marketing purposes (paragraph 4.4) is optional: refusal or revocation of consent does not carry any consequence regarding the ongoing contractual relationship.

Personal data may be communicated, strictly within necessary limits, to the following categories of recipients:

• employees and/or collaborators, duly instructed and authorized for processing pursuant to Arts. 29 GDPR and 2-quaterdecies Legislative Decree 196/2003;
• entities appointed as data processors pursuant to Art. 28 GDPR;
• public authorities, judicial authorities, supervisory authorities, and other public entities, when communication is required by law or necessary for establishing rights.

The updated list of data processors can be requested from the Data Controller at the contact details provided in paragraph 1.

Personal data are mainly processed within the European Economic Area. Some of the technology suppliers used by Skillvue acting as data processors belong to multinational groups headquartered outside the European Union (in particular in the United States of America). Should extra-EU transfers occur within the scope of services provided by such processors, Skillvue guarantees that they take place in compliance with Chapter V GDPR, in particular based on:

• an adequacy decision of the European Commission pursuant to Art. 45 GDPR (EU-U.S. Data Privacy Framework) for certified suppliers registered in the public list maintained by the U.S. Department of Commerce;
• subsidiarily, Standard Contractual Clauses approved by the European Commission pursuant to Art. 46, para. 2, point c, GDPR, supplemented, where necessary based on a specific transfer impact assessment, by supplementary measures in accordance with EDPB Recommendations 01/2020.

The updated list of data processors, indicating their locations and applied safeguards, can be requested from the Data Controller at the contact details provided in paragraph 1.

Personal data are stored for the following periods:

4.1 Management of Demo form requests: data collected through contact and demo request forms are retained for the time strictly necessary to respond to the request and, if the data subject becomes a customer, for the entire duration of the contractual relationship. In the absence of a subsequent contractual relationship, data are deleted or anonymized within 24 (twenty-four) months from the date of receipt of the request, unless the data subject has consented to processing for marketing purposes under point 4.4.

4.2 Management of the Site and operational functions: browsing data (including IP address) collected for technical management and Site security purposes are stored for a period not exceeding 6 (six) months from collection, unless further retention is necessary in case of established security breaches or cybercrimes, in which case data may be kept for the time required to conclude the relevant procedures.

4.3 Legal defense: notwithstanding standard retention terms under the preceding points, data strictly relevant to a pending or reasonably foreseeable dispute are retained for the time necessary for its resolution and, in any case, no longer than 10 (ten) years from the termination of the relationship, in application of the standard statutory limitation period under Art. 2946 of the Italian Civil Code. After this term, data are deleted or anonymized. In the absence of a pending or concretely foreseeable dispute, this purpose cannot be invoked to retain data beyond standard terms.

4.4 Direct marketing: until consent is revoked by the data subject and in any case no longer than 24 months from the last active contact, without prejudice to the possibility of renewing consent.

At the end of the above periods, data are deleted or anonymized, subject to any additional legal retention obligations.

The data subject may exercise at any time, pursuant to Arts. 15-22 GDPR, the following rights:

• Right of access (Art. 15): obtain confirmation of the existence of processing and receive a copy of the processed personal data;
• Right to rectification (Art. 16): obtain the correction of inaccurate data or the integration of incomplete data;
• Right to erasure (Art. 17): obtain the deletion of personal data in cases provided for by law;
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20), where applicable;
• Right to object (Art. 21), in particular to processing for direct marketing purposes;
• Right to withdraw consent at any time (Art. 7, para. 3), without affecting the lawfulness of processing based on consent before its withdrawal;

To exercise rights and to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it), you can write to privacy@skillvue.ai or to the DPO at dpo@skillvue.ai. Skillvue responds to requests from data subjects within one month of receipt, extendable by two further months in cases of particular complexity, pursuant to Art. 12, para. 3, GDPR.