Last updated: 18 September 2026
This notice describes how Made in Evolve S.r.l. processes the personal data of the people who visit the website https://madeinevolve.com (hereinafter, the Website) and who use the forms and services made available through the Website. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter, GDPR) and of Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (hereinafter, the Italian Privacy Code).
This notice covers only the processing carried out through the Website. It does not apply to third-party websites reachable through links on the Website, nor to the processing that Made in Evolve S.r.l. carries out in the context of contractual relationships with customers, prospects and suppliers, for which reference is made to the Notice for customers, prospects and suppliers. For the use of cookies and similar technologies, please refer to the Cookie Policy.
The Data Controller is Made in Evolve S.r.l., with registered office at Via Rosalba Carriera 26, 41126 San Damaso, Modena (MO), Italy, Tax Code and VAT no. 03497200364, REA MO-392876, share capital € 12,000 fully paid up.
| Channel | Reference |
|---|---|
| Dedicated data protection email | privacy@madeinevolve.com |
| General email | hello@madeinevolve.com |
| Certified email (PEC) | madeinevolve@pec.it |
| Telephone | +39 059 788 0854 |
| Form for privacy requests | /policy/data-removal |
The Controller has not appointed a Data Protection Officer (DPO), as the conditions set out in Article 37 GDPR are not met. Data protection requests are handled through the dedicated mailbox privacy@madeinevolve.com.
The IT systems and software procedures that operate the Website acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols. This category includes IP addresses, browser and operating system identifiers, the addresses of the pages requested, the time of the request, the outcome of the request and other technical parameters relating to the connection. Such data are processed for the operation and security of the Website, for error diagnosis and for the detection of any abuse. Technical logs are retained for a maximum of 12 months.
The Website is hosted on DigitalOcean infrastructure in the Frankfurt data centre (Germany). In order to render the pages, the user’s browser also connects to third-party technical services (Adobe Fonts for typefaces, Bunny.net for videos, Google Tag Manager for script management, Google reCAPTCHA v3 for form protection), which receive the technical data required to deliver the requested resource, including the IP address.
Through the page /contacts the user may send a request to the Controller by providing first name, last name, email address, company, telephone number and the text of the message. The form includes a checkbox by which the user confirms having read this notice. Upon submission the IP address is also recorded, and the form is protected by Google reCAPTCHA v3, which analyses browsing behaviour to distinguish human submissions from automated ones.
The data are recorded in Nucleo Brain, the proprietary CRM of Made in Evolve S.r.l., hosted on DigitalOcean in Frankfurt, and an email notification is sent to the team via SendGrid.
Through the form in the footer the user may subscribe to the newsletter by providing an email address and preferred language; the IP address is also recorded at the time of subscription. The data are recorded in Nucleo Brain, which synchronises the subscriber list with Klaviyo, the email marketing platform used for sending. The welcome email is sent via SendGrid.
Through the page /policy/data-removal the data subject may exercise their rights by providing name, email address, type of request and details. The request is delivered to Nucleo Brain and to the mailbox privacy@madeinevolve.com. The Controller may request additional information where it is necessary to verify the identity of the requester (Article 12(6) GDPR).
The Controller receives unsolicited applications by email or through LinkedIn. The data contained in CVs (personal details, contact details, education, professional experience and any other information the candidate chooses to include) are processed to assess the profile against available positions. Candidates are invited not to include in their CV data belonging to special categories (Article 9 GDPR), unless strictly necessary. Pursuant to Article 111-bis of the Italian Privacy Code, consent is not required for applications submitted spontaneously, and this notice is provided at the first useful contact.
The Website contains links to the social media profiles of Made in Evolve S.r.l. and to third-party websites. Once the external platform is reached, processing is governed by the notice of the respective operator. For user interactions with the Controller’s social media profiles (for example comments or messages), Made in Evolve S.r.l. processes the data made available by the platform solely for the purpose of managing the relationship with the user.
The Website uses a first-party technical cookie to store the user’s consent choice and, only with the user’s consent, analytics tools (Google Analytics 4, Microsoft Clarity) and marketing tools (Meta Pixel). Full information, including durations and how to manage preferences, is available in the Cookie Policy.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Operation, security and maintenance of the Website | Browsing data and technical logs | Legitimate interest of the Controller in ensuring the security and continuity of the service (Article 6(1)(f) GDPR) | Maximum 12 months |
| Protection of forms against automated submissions (reCAPTCHA) | Technical browsing data, IP address | Legitimate interest of the Controller in preventing abuse (Article 6(1)(f) GDPR) | For the time required for verification; logs as above |
| Responding to requests sent through the contact form | First name, last name, email, company, telephone, message, IP | Performance of pre-contractual measures taken at the data subject’s request (Article 6(1)(b) GDPR) and legitimate interest in responding to those who contact the Controller (Article 6(1)(f) GDPR) | For as long as the commercial interest remains active, subject to periodic review, and in any case until the data subject requests erasure |
| Sending the newsletter and informational and promotional communications | Email, language, IP, email interaction data (opens, clicks) | Consent (Article 6(1)(a) GDPR; Article 130(1) and (2) of the Italian Privacy Code) | Until consent is withdrawn or the user unsubscribes |
| Handling data subject requests and documenting compliance | Name, email, type of request, details, correspondence | Legal obligation (Article 6(1)(c) GDPR, in relation to Articles 12-22 GDPR) and accountability principle (Article 5(2) GDPR) | For the time required to demonstrate that the request was fulfilled |
| Assessment of unsolicited job applications | Data contained in the CV and correspondence | Performance of pre-contractual measures (Article 6(1)(b) GDPR); Article 111-bis of the Italian Privacy Code | 12 months from receipt |
| Defence of the Controller’s rights in or out of court | All relevant data | Legitimate interest of the Controller (Article 6(1)(f) GDPR) | For the duration of the dispute and the related limitation periods |
| Compliance with tax and accounting obligations, where a contractual relationship arises from the contact | Identification, tax and contractual data | Legal obligation (Article 6(1)(c) GDPR) | 10 years (Article 2220 of the Italian Civil Code); see the Notice for customers, prospects and suppliers |
Where processing is based on legitimate interest, the Controller has verified that such interest is not overridden by the fundamental rights and freedoms of the data subject, taking into account the nature of the data (ordinary contact data and technical data) and the reasonable expectations of those who use the Website. The data subject may object to such processing as described in section 8.
The provision of browsing data is inherent in the use of the Website and cannot be avoided other than by not visiting the Website.
The provision of the data requested in the contact, newsletter and privacy request forms is optional; however, failure to provide the data necessary for the requested function (for example the email address) makes it impossible to follow up on the request. Consent to receive the newsletter is freely given and may be withdrawn at any time; refusing it does not affect the ability to use the Website or to contact the Controller.
The data are processed by staff of Made in Evolve S.r.l. authorised pursuant to Article 29 GDPR and Article 2-quaterdecies of the Italian Privacy Code, acting under documented instructions. The data are not disseminated.
The data may be communicated to parties that process data on behalf of the Controller as data processors pursuant to Article 28 GDPR, bound by a contract governing their obligations and guarantees. In relation to the processing described in this notice, suppliers belong to the following categories.
| Category | Supplier | Role on the Website |
|---|---|---|
| Hosting and infrastructure | DigitalOcean LLC (Frankfurt data centre, Germany) | Hosting of the Website and of Nucleo Brain, CDN |
| Script management and form security | Google (Google Ireland Ltd.) | Google Tag Manager, reCAPTCHA v3 |
| Traffic analytics (only with consent) | Google (Google Ireland Ltd.); Microsoft (Microsoft Ireland Operations Ltd.) | Google Analytics 4; Microsoft Clarity |
| Marketing (only with consent) | Meta Platforms Ireland Ltd. | Meta Pixel |
| Transactional email | Twilio Inc. (SendGrid) | Team notifications, welcome email |
| Email marketing | Klaviyo Inc. | Sending the newsletter to subscribers |
| Typefaces | Adobe Inc. | Adobe Fonts (Typekit) |
| Video delivery | BunnyWay d.o.o. (Bunny.net) | Streaming of video content |
| Internal productivity and collaboration tools | Google (Workspace), Microsoft (365), Slack Technologies (Salesforce), Asana, Notion Labs, Figma | Management of correspondence and internal activities that follow a contact |
Nucleo Brain is the CRM module of Nucleo Platform, developed and operated directly by Made in Evolve S.r.l. and hosted on DigitalOcean in Frankfurt. It is not a third-party supplier: data recorded in Nucleo Brain remain under the direct control of the Controller, with access limited to authorised staff.
The data may also be communicated to consultants and professionals assisting the Controller (for example in legal or accounting matters) and to public and judicial authorities where communication is required by law or is necessary to investigate unlawful conduct.
Some of the suppliers listed are established, or use infrastructure, outside the European Economic Area, in particular in the United States. The Controller favours storing data within the European Union: the Website and Nucleo Brain are hosted in Frankfurt, and EU data residency is enabled for SendGrid.
Where a transfer to third countries is nonetheless necessary, it takes place on the basis of an adequacy decision of the European Commission or of the appropriate safeguards provided for in Article 46 GDPR. In particular:
The data subject may request information on the safeguards adopted by writing to privacy@madeinevolve.com.
Retention periods are set out in the table in section 3. The Controller applies the following general criteria.
| Category of data | Retention criterion |
|---|---|
| Website technical logs | Maximum 12 months, unless needed to investigate unlawful conduct |
| Commercial contacts (leads) | For as long as the interest or relationship remains active, with periodic review of whether the data are still current, and in any case until the data subject requests erasure; no predefined automatic expiry |
| Newsletter subscribers | Until unsubscription or withdrawal of consent |
| Job applications | 12 months from receipt |
| Data subject requests | For the time required to document compliance |
| Contractual, tax and accounting documents | 10 years (Article 2220 of the Italian Civil Code); cannot be erased on request |
| Cookies | Durations indicated in the Cookie Policy |
At the end of the retention period the data are erased or anonymised. Erasure requests are fulfilled for all data relating to leads, newsletter and marketing; they cannot be granted for data whose retention is required by law (contracts, tax and accounting documents), which are kept for 10 years and processed exclusively for that purpose.
The data subject may exercise against the Controller the rights provided for in Articles 15-22 GDPR.
| Right | Content | Reference |
|---|---|---|
| Access | Obtain confirmation as to whether processing is taking place and a copy of the data, together with information on the processing | Article 15 GDPR |
| Rectification | Obtain the correction of inaccurate data and the completion of incomplete data | Article 16 GDPR |
| Erasure | Obtain the erasure of the data in the cases provided for, without prejudice to legal retention obligations | Article 17 GDPR |
| Restriction | Obtain that the data are only stored, without further processing, in the cases provided for | Article 18 GDPR |
| Portability | Receive the data provided to the Controller in a structured, commonly used and machine-readable format, for processing based on consent or contract | Article 20 GDPR |
| Objection | Object at any time to processing based on legitimate interest and, without having to give reasons, to processing for marketing purposes | Article 21 GDPR |
| Withdrawal of consent | Withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand | Article 7(3) GDPR |
| Complaint | Lodge a complaint with the supervisory authority (section 9) | Article 77 GDPR |
Rights may be exercised:
The Controller responds without undue delay and in any case within one month of receipt of the request; that period may be extended by two further months where necessary, taking into account the complexity and number of the requests, in which case the data subject is informed (Article 12(3) GDPR). Exercising these rights is free of charge, except in the case of manifestly unfounded or excessive requests (Article 12(5) GDPR).
A data subject who considers that the processing of their data infringes the GDPR has the right to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or with the supervisory authority of the Member State in which they habitually reside, work or where the alleged infringement occurred (Article 77 GDPR), without prejudice to the right to a judicial remedy (Articles 78 and 79 GDPR).
The Controller does not take decisions based solely on automated processing, including profiling, which produce legal effects concerning the data subject or similarly significantly affect them (Article 22 GDPR). The analytics and marketing tools described in the Cookie Policy operate only with the user’s consent and are not used to take individual decisions.
The Website and the services offered by Made in Evolve S.r.l. are aimed at businesses and professionals and are not intended for children under 14 years of age, below which, pursuant to Article 2-quinquies of the Italian Privacy Code, consent in relation to information society services must be given by the holders of parental responsibility. The Controller does not knowingly collect data of children under 14 and, should it become aware of having done so, erases them. Any reports may be sent to privacy@madeinevolve.com.
The Controller may update this notice to reflect regulatory, technical or organisational changes. The current version is always published on this page together with the date of the last update. In the event of material changes affecting processing based on consent, the Controller informs data subjects by appropriate means, where it has the relevant contact details.
For information on the cookies and other tracking tools used by the Website, including how to give, refuse and change consent, please refer to the Cookie Policy, which forms an integral part of this notice.
This English version is provided for convenience; in case of discrepancy the Italian version prevails.