Privacy Policy

Notice on the processing of personal data collected through the website www.jinni.srl

Your privacy matters to us. This page explains how we collect and process your personal data when you browse our website or contact us through the forms available on it, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679.

The website www.jinni.srl, available in Italian, English, Spanish, German, French, Chinese and Portuguese, is a static website: it uses no CMS and no database, offers no user accounts and no comments, uses no profiling cookies, no third-party analytics tools and no tracking pixels, and currently sets no cookies at all on the user’s device. For visit statistics it uses Umami, installed on the Controller’s server, which uses no cookies and stores nothing on the user’s device (see the Cookie Policy for details).

1. Introduction and legal framework

This notice describes the processing of personal data collected through this website, in particular technical browsing data and data provided through the contact forms.

It is addressed to anyone who accesses or uses this website, and describes how the user’s personal data is collected, used and protected, as well as the rights granted by law.

This notice does not cover other websites, pages or online services reachable through external links on the site (for example Jinni’s social media profiles on LinkedIn, Facebook and Instagram, or the kamzan.com website); please refer to their own privacy notices.

This notice is provided in compliance with the legislation on personal data protection, including:

• Regulation (EU) 2016/679 (the “GDPR”);
• Italian Legislative Decree No. 196 of 30 June 2003 (the “Italian Data Protection Code”), as amended by Legislative Decree No. 101 of 10 August 2018;
• Directive 2002/58/EC (the “ePrivacy Directive”) and Article 122 of the Italian Data Protection Code, as well as the “Guidelines on cookies and other tracking tools” issued by the Italian Data Protection Authority (Garante per la protezione dei dati personali) on 10 June 2021;
• any other applicable legislation.

2. Who handles your data and how can you contact us?

The Data Controller is:

Jinni Srl
Via Mosè Bianchi, 71, 20149 Milano MI, Italy
Email: privacy@jinni.srl
VAT number: 09316480962
Certified email (PEC): jinni@pec.net

For any information on the processing of personal data, or to exercise the rights provided for by law, data subjects may contact the Data Protection Officer (DPO) appointed by the Controller.

The DPO can be reached at:

• Name: Arianna Crepaldi
• Email: dpo@jinni.srl
• Phone: +39 3513495943

The DPO acts as the point of reference for matters relating to personal data protection, monitoring compliance with the applicable legal provisions, informing and advising the Controller and the persons authorized to process data, and acting as the point of contact for data subjects and supervisory authorities.

3. What data do we collect?

a) Browsing and technical data. The IT systems that run the website acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols: for example IP address, browser type and operating system, URLs of the requested resources, date and time of the request, server response code. This data is recorded in the server’s technical logs for security purposes and to ensure the website functions correctly. The web server’s technical logs record IP address, date and time, requested resource, response code and browser type, and are kept for a maximum of 14 days. The form service reads the IP address only to limit repeated submissions (maximum 5 per minute): the data stays in memory for no longer than one minute and is not logged.

The website uses no cookies, pixel tags, web beacons or other tracking technologies and stores no information on the user’s device (for anonymous visit statistics, see letter c below); typefaces are hosted directly on the website’s servers, with no requests to external services (for example Google Fonts). The website does not embed third-party content (videos, maps, social plugins): links to social networks and other websites are plain links, and any data processed by those websites once you visit them is subject to their own privacy notices.

b) Data provided voluntarily through the contact forms. The website contains the forms “Your project” (“Il tuo progetto”), “Write to the team” (“Scrivi al team”) and “Work with us” (“Lavora con noi”). When you fill them in, we collect:

• name;
• company;
• phone number;
• email address;
• service of interest (“Your project” form);
• role of interest and CV (“Work with us” form);
• the text of your message;
• confirmation, through the dedicated checkbox, that you have read this notice. In the “Your project” form, name, email address, service of interest and the data processing checkbox are mandatory; company, phone and message are optional. In the “Write to the team” form, name, company, phone, email address, message and the data processing checkbox are mandatory. In the “Work with us” form, name, phone, email, role of interest, message and an attached CV are mandatory; the CV is forwarded by email together with the application and is not stored on the website.

We also process the data contained in emails you send directly to the addresses published on the website (for example hello@jinni.srl).

Please do not include in your message data belonging to special categories (Art. 9 GDPR) or third-party data not needed for your request. Should a CV submitted as part of an application contain special categories of data, these will be processed within the limits set by the applicable legislation.

c) Anonymous visit statistics. To understand, in aggregated form, how the website is used, we use Umami, installed on our own server (the same one that hosts the website), with no involvement of third parties. Umami collects only aggregated metrics: pages viewed, referring website (referrer), device type, browser language and language of the page viewed. Umami uses no cookies, no local storage and no session storage, does not track people across websites and does not store your IP address: it only uses it, on the spot, to compute a temporary identifier that changes every day and to derive the approximate country and city of the visit. The Umami script is served from the website’s own domain, so no request is sent to third-party domains. The statistics can be viewed only by Jinni staff.

d) Heatmaps. On a few pages only – the home page, the “AI software development” page, the “Kamzan Ecosystem” page and the “Write to team Jinni” contact page, in every language of the website – Umami also records where people click and how far they scroll the page, as anonymous coordinates, to build aggregated maps of how those pages are used. It does not record what you type into forms, does not capture your screen (session recording is disabled) and stores nothing on your device.

4. For what purposes and on what legal bases do we process your data?

You may object at any time, on grounds relating to your particular situation, to processing based on the Controller’s legitimate interest, pursuant to Art. 21 GDPR.

Data collected through the forms is not used for marketing, newsletters or profiling and is not subject to automated decision-making within the meaning of Art. 22 GDPR.

Whether providing data is mandatory. Technical browsing data is acquired automatically and is necessary for the website to function; anonymous statistical data is likewise collected automatically during browsing. Providing data through the forms is optional; however, if the data marked as mandatory is not provided, the request cannot be sent and we will not be able to reply.

5. How do we process and protect your data?

Personal data is processed mainly by electronic means, in accordance with the principles of lawfulness, fairness, transparency, data minimization, integrity and confidentiality, by staff authorized and instructed by the Controller.

Requests sent through the forms are not stored in a website database: they are handled by a form-processing service operated by Jinni on its own server and forwarded by email to the company address hello@jinni.srl, through the transactional email service Brevo (Sendinblue SAS, France), used as SMTP provider. The service keeps no copy of the requests or their content: once the email has been sent, no data remains on the server. The CV attached to the “Work with us” form is checked (PDF or Word format, maximum 5 MB) and forwarded as an attachment to the same email, without being saved on the server. After submission, an automatic acknowledgement email with a summary of what was sent is delivered to the email address entered in the form.

The Controller adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encrypted transmission of communications via the HTTPS protocol. The forms use a hidden anti-bot field and a per-IP submission limit; statistics can be consulted only from Jinni’s company network (VPN) after authentication; the statistics database is backed up regularly.

6. How long do we keep your data?

• Browsing and technical data: kept for the time strictly necessary for security purposes and, for no longer than 14 days, after which it is deleted or anonymized, unless longer periods are required by legal obligations or to establish, exercise or defend legal claims.
• Visit statistics and heatmaps: the IP address is not stored; the temporary visit identifier changes every day; statistics are kept only in aggregated form. Statistical data are anonymous and aggregated and do not allow visitors to be identified.
• Data entered through the forms or sent by email: kept for the time needed to reply to the request and fulfil the related purpose and, thereafter, for any period required by legal obligations. In any case no longer than 24 months from the last contact, unless required by law or to defend a right.
• Application data: kept for the period stated in the dedicated privacy notice for candidates.
• Data relating to any contractual relationship with the Controller: where applicable, kept for the duration of the relationship and, thereafter, for the time required by the applicable legal obligations (for example accounting and tax obligations).

7. Who may receive your data?

The personal data collected through this website may be accessed, within the limits of their respective roles and purposes, by:

• internal staff authorized by the Controller, duly trained in privacy and security matters;
• providers appointed as Data Processors pursuant to Art. 28 GDPR, in particular:
  • Brevo (Sendinblue SAS, France) – transactional email service (SMTP provider) used to deliver the requests sent through the forms; the servers are located in the European Union;
  • Hetzner Online GmbH (Germany) – provider of the server (VPS) hosting the website and the form-handling service; the servers are located in the Nuremberg data center (Germany);
  • DonDominio (Soluciones Corporativas IP, S.L.U., Spain) – email service provider hosting the hello@jinni.srl mailbox; the servers are located in the European Union;
  • any consultants and IT maintenance and support providers, where applicable;
• competent public authorities and supervisory bodies, within the limits set by law or to comply with requests from judicial authorities.

The data is not disclosed to the public or transferred to third parties for their own purposes. The up-to-date list of Data Processors may be requested by writing to the Controller.

8. Where may your data be transferred?

Personal data collected through this website is, as a rule, processed within the European Union / European Economic Area, at the Controller’s premises and at the service providers it uses. The server hosting the website, the form-handling service and the Umami statistics tool is located in the European Union (Germany).

Should data be transferred or made accessible outside the European Economic Area, the transfer will take place only in compliance with Articles 44 et seq. GDPR, through one of the permitted mechanisms, including adequacy decisions of the European Commission (among them, for certified organizations, the EU-U.S. Data Privacy Framework) and the Standard Contractual Clauses adopted by the European Commission. Information on the applicable mechanism and, where provided for, a copy of the relevant safeguards, possibly redacted in their confidential parts, may be requested from the Controller.

9. What are your rights?

As a data subject, under Articles 15-22 GDPR you have the right to:

• obtain confirmation as to whether or not personal data concerning you is being processed and, if so, access that data and the related information (right of access);
• request the rectification or updating of inaccurate or incomplete data (right to rectification);
• request the erasure of data that is no longer necessary or is unlawfully processed, in the cases provided for by Art. 17 GDPR (right to erasure);
• request the restriction of processing in the cases provided for by Art. 18 GDPR (right to restriction);
• object, on grounds relating to your particular situation, to processing based on the Controller’s legitimate interest, pursuant to Art. 21 GDPR (right to object);
• receive, in the cases provided for by Art. 20 GDPR, the data you have provided to us in a structured, commonly used and machine-readable format, and have it transmitted directly to another controller where technically feasible (right to data portability);
• withdraw any consent given at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• lodge a complaint with a supervisory authority (see section 11).

To exercise these rights, simply send a request to privacy@jinni.srl or to the DPO at dpo@jinni.srl. The Controller will reply without undue delay and in any event within one month of receipt of the request; this period may be extended by two further months where necessary, taking into account the complexity and number of requests, and the data subject will be informed of the extension and the reasons for it within one month of receipt of the request.

10. How is data relating to minors handled?

This website is not aimed at minors and does not knowingly collect their data through its forms. Should a user, as part of a request, provide personal data relating to third parties – including any minors – the user must ensure they are entitled to do so; such data will be processed within the limits and for the purposes of the request, in compliance with the applicable legislation. Requests for rectification, restriction or erasure may be sent to the Controller.

11. How can you lodge a complaint with a supervisory authority?

If you believe that the processing of your personal data through this website does not comply with the legislation in force, you may lodge a complaint, pursuant to Art. 77 GDPR, with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement. In Italy, the competent authority is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

12. Cookies

For information on the use of cookies and other tracking tools, please see this website’s Cookie Policy.

13. How do we inform you of changes to this notice?

This notice is subject to periodic review to reflect changes in legislation or in the services offered through the website. Any significant change will be communicated on this page, and the “Last updated” date shown at the top will be updated accordingly.