Privacy notice

1. Who is the controller

The data controller (the «Controller») is [TO FILL IN: company name], VAT number [TO FILL IN: VAT number], with its registered office at [TO FILL IN: registered office].

For any question about your data and to use your rights, write to [TO FILL IN: privacy e-mail address].

Data protection officer (DPO): [TO FILL IN: data protection officer: appointed (contact) or not appointed].

2. What data we handle

We handle only the data you give us and the data the site collects by itself when you send a form.

• Contacts, in every form: first and last name, e-mail address and phone number (required).
• Application: your sales experience, your goal and the budget you can invest (three answers chosen among the ones offered) and, if you like, how you heard of us.
• «Leave your contact»: the path you are interested in (Academy or Sales Manager).
• Request for companies: company name, VAT number (optional), name and role of the contact person, service of interest.
• A free message, if you write one (optional). Please do not write special categories of data such as health, political or religious opinions: we do not need them.
• The code of the person who invited you, typed by you or contained in the link you opened (optional).
• Automatically, when you send the form: date and time; the campaign parameters of the address you came from (for example utm_source or gclid), if any; the version of this notice you saw; whether you chose to receive communications; a keyed hash of your IP address, not the address itself.
• In the technical logs of the server: IP address, date and time, requested page and browser type. They serve the security and the working of the site and rotate by themselves.

The public pages use no cookies and no analytics or advertising tools: see the Cookies page.

3. Why we handle them and on what legal basis

• To answer you, to assess your application or your company’s request and to contact you by phone or e-mail: this is necessary to follow up a request you made before a possible contract (art. 6.1.b GDPR). Without the required fields we cannot follow it up.
• To assign your request to a seller and follow it in our customer management system: same basis, art. 6.1.b.
• To attribute the invitation correctly, if you gave the code of the person who invited you (and to work out the reward due to that person): the legitimate interest of the Controller and of the person who invites in a correct attribution (art. 6.1.f). A code typed in a form is a statement: we check it. If different codes arrive for the same person, a HybridSales manager decides, in writing. No decision about you is taken by an automated system.
• To protect the site from abuse and automated submissions (limit of requests per address, trap field, minimum filling time, server logs): legitimate interest in security (art. 6.1.f).
• To prove which notice you saw and which consents you gave (consent log): legitimate interest in being able to prove that the processing is correct (art. 6.1.f, art. 7.1).
• To send you news and offers from HybridSales by e-mail: only if you tick the dedicated box, which is separate and optional. Basis: your consent (art. 6.1.a). You can withdraw it whenever you want (see your rights); withdrawing changes nothing else.
• To comply with legal duties and to defend a right of ours in court (art. 6.1.c and 6.1.f).

If you ask to receive communications, we first send you an e-mail with a link to confirm that the address is yours (double confirmation). The link is valid for 7 days and works once; without the confirmation we do not write to you for promotional purposes. The same confirmation also lets us check an invitation code, if any.

4. Who receives the data

• The Controller, with authorised staff bound to confidentiality: the sales management who receives the request and assigns it, and the seller it is assigned to. Everyone sees only the contacts that are theirs; people in a role of responsibility see all of them.
• The person who invited you does not receive your contact details: their code only serves to attribute the invitation. They see them only if your request is assigned to them as the seller.
• Suppliers that handle data on behalf of the Controller and are appointed as processors (art. 28 GDPR): the server hosting service (Hetzner, data centre in Germany, European Union); the e-mail service, [TO FILL IN: e-mail service provider]; the supplier that builds and maintains the software, ASPIDA S.r.l..
• Public authorities, only where the law requires it.

We do not sell the data and do not hand them to third parties for their own purposes. The site uses no analytics, advertising, social pixels, embedded maps or videos.

5. Transfers outside the European Union

The data of the forms are stored on servers in Germany. The Controller does not transfer them outside the European Economic Area. The links to Instagram, YouTube and Telegram lead to third-party sites, which have their own notices: once you open them, this site no longer handles your data.

6. How long we keep them

• Requests and applications that do not become a relationship: [TO FILL IN: retention period of requests].
• If you become a customer, collaborator or seller: for the whole relationship and then for [TO FILL IN: retention period after the relationship ends], for limitation periods and accounting and tax duties.
• Promotional communications: until you withdraw your consent.
• Consent log (notice version, date, IP hash, pseudonymous identifier, no e-mail in clear): [TO FILL IN: retention period of the consent log]. By design this log cannot be edited, because its purpose is to prove.
• Technical server logs: for the time strictly necessary; they rotate and the oldest files are overwritten.

When the time ends the data are deleted or made anonymous, unless the law requires keeping them longer.

7. Your rights

You can ask us at any time, by writing to [TO FILL IN: privacy e-mail address]:

• to know whether we handle your data and to receive a copy (access, art. 15);
• to correct or complete them (rectification, art. 16);
• to delete them (art. 17) or to restrict their processing (art. 18);
• to receive them in a machine-readable format or to have them moved to another controller (portability, art. 20), for the data you gave us;
• to object to processing based on our legitimate interest (art. 21);
• to withdraw consent to promotional communications, whenever you want and without giving a reason, as easily as you gave it. Withdrawal does not affect what was done before.

We answer within one month. If you think the processing breaks the law you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country.

8. Which data are required

First name, last name, e-mail and phone are needed to be able to answer you; for the application the three answers are needed too, for the company request the company name, the contact person and the service. If you do not give them we cannot process the request. Everything else (message, how you heard of us, VAT number, the code of the person who invited you) is optional, and consent to promotional communications is never a condition for sending a form.

9. No automated decisions

We do not take decisions that affect you based solely on automated processing and we do not profile. The answers of the application are read by people.

10. Minors

The site is meant for adults. If you are under 18, please do not fill in the forms.

11. Changes to this notice

When we change this notice we publish the new version here, with its label. When you send a form we record the label of the version you saw: this one is 2026-10-v1.