Ali Group Privacy Notice (“Privacy Notice”)

Last Updated: [November 6, 2023]

Introduction to this Privacy Policy

At Ali Group S.r.l. (a Socio Unico) (“Ali Group”, “we”, “us”, “our”), we recognize the importance of privacy to you and are firmly committed to protecting your privacy when you visit our websites. We have instituted this Privacy Notice to inform you how Ali Group processes your Personal Data when you visit our global Ali Group website (https://www.aligroup.com), for which Ali Group is the “controller,” “business,” or “covered entity” within the meaning of applicable data protection laws. The information is provided only for the global Ali Group website and not also for other websites that may be accessed through links on the site; if you visit a website of an Ali Group company, the Ali Group company responsible for the website is the controller and will provide a separate privacy notice. If we process your Personal Data as our customer , the Ali Group entity is the controller that has entered into a contract with you as a customer.

The meaning of Personal Data

“Personal Data,” also referred to as “Personal Information,” includes any information relating to an identified or identifiable natural person. This means any individual who can be identified directly or indirectly by reference to an identifier such as name, identification number, location data, online identifiers (for example, IP addresses – if they can be used to identify you) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Put simply, “Personal Data” includes data which either by itself or with other data held by us or available to us, can be used to identify you or can reasonably be associated or linked with you.

Important notice about international transfers

Due to the global nature of our business, your Personal Data will be stored and transferred to parties located in other countries, including outside the European Economic Area. These other countries may have different data protection laws than your country of residence or they may not have any data protection laws.

If we process your personal data in countries outside the European Union or the European Economic Area (e.g. by integrating tools from companies based in the USA on our website), we will ensure appropriate safeguards are in place to ensure an adequate level of protection exists for this purpose. Typically, we take the following protective measures:

Further information about transfers outside of the European Economic Area or copies of these measures can be obtained at the contact addresses listed above.

The categories of Personal Data we may collect, the purpose and the lawful basis

We collect Personal Data directly from you through your interactions with our website. In all cases, we collect Personal Data about you in accordance with the principles outlined in this Policy and applicable law. Residents of the US should also review the US-specific disclosures in our “For Residents of California and Certain other US States” section below.

The following table provides more detailed information on the primary Personal Data we collect, why, and the lawful basis for collecting that information:

Categories of Personal Data Purpose Lawful basis
Application data for Ali Group (e.g. name, CV) Processing of this personal data is required to enable Ali Group to administer the recruiting process, including the set-up of an electronic job applicant HR file, managing your application, and organizing interviews. This personal data may also be used to administer our internal employee scholarship program. Processing is necessary for us to enter into a contract with you.
Application data for other Ali brand companies (e.g. name, CV) In case you provided us with Application data for one of our brand companies, your application will be forwarded to the respective brand company in our Ali Group network. Processing is necessary for one of Ali Group’s brand companies.
Contact information (e.g. full name, postal address, e-mail address, employer/business and professional information, job titles, telephone and fax numbers) Managing and responding to your queries submitted via e-mail or contact form. This may include forwarding your message to one of Ali Group’s brand companies if necessary to follow-up your query. Performance of contract and legitimate interests – it’s important that we can respond to your enquiries in an efficient manner.
Contact information (as above) We process your data for the purpose of lead generation and management (e.g. holding events, documenting the event by means of video and audio recordings and the use of the recordings made for press and public relations purposes.) Performance of contract and legitimate interests (marketing). 

Where legally required we obtain consent (e.g., to process video and audio recordings.)
Browsing information (IP address, browser information) See our Cookie Policy for details. See our Cookie Policy for details.
All information Establishing and enforcing our legal rights and obligations and monitoring to identify and record fraudulent activity.
Complying with instructions from law enforcement agencies, any court or otherwise as required by law.Resolving any complaints from or disputes with you.		 Legitimate interest (see column on left). We may also have legal obligations.
E-Mail address, name, company We use this data to send you newsletters and marketing information and to analyse your use of our newsletter and interaction with the website. Your consent.

In summary, we need certain categories of Personal Data because that is necessary in order to administer any contract one of our Ali Group brand companies entered into with you (where relevant). Certain other Personal Data is processed for our legitimate interests in cases where this does not result in prejudice to you. Please note that if the Personal Data we collect from you is necessary for one of our Ali Group brand companies to enter into a contract with you, or to manage the business relationship with you or to fulfill a mandatory requirement, opting out of providing such data may inhibit our ability to contract with you, properly operate our website, or provide the services or answers you request.

Personal Data is collected directly from you, our service providers or through the use of cookies and similar technologies (see also our Cookie Policy for details).

For Residents of California and Certain other US States

This section is meant to provide supplemental or specific information for residents of California and certain other US states. We encourage you to read the full policy. The Personal Data we collect about you includes information within the below categories of data. Note that the “category of data” column listed below refers to the category of personal data as defined under California law and represents the categories of Personal Data that we have collected, and how it has been shared, over the past 12 months. Inclusion of a category in the list below indicates only that we may collect some information within that category. We do not necessarily collect all information listed in a particular category, nor do we collect all categories of information for all individuals.

Note also that only California privacy law, at this time, applies in the applicant and business-to-business contexts.

We have disclosed Personal Data in each of the below categories with our affiliates, service providers, and professional advisors (such as auditors and legal advisors), as well as with government entities as necessary, for our business purposes within the last 12 months. We have not necessarily shared all information listed in a category nor do we necessarily share information about every individual.

We also may use all of the below categories of information to establish and enforce our legal rights and obligations; identify and record fraudulent activity; comply with instructions from law enforcement agencies, any court or otherwise as required by law; and resolve any complaints from or disputes with you.

Category of Data Source Purpose of Collecting and Processing Data
Personal Identifiers. Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers. We collect information in this category:

  • directly from you;
  • from our services providers; or
  • through cookies or similar technologies.
 A subset of this data is processed in connection with our operational functions, including managing and responding to your queries submitted via e-mail or contact form, generating and managing leads (e.g. holding events), sending you newsletters and marketing information, and analyzing your use of our newsletter and interaction with the website.If you are a job applicant we also use this information to administer the recruiting process (e.g., setting-up of an electronic job applicant HR file, managing your application, and organizing interviews).
Information About You. Information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, your name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. We collect information in this category:

  • directly from you;
  • from our services providers; or
  • through cookies or similar technologies.
 A subset of this data is processed in connection with our operational functions, including managing and responding to your queries submitted via e-mail or contact form, generating and managing leads (e.g. holding events), sending you newsletters and marketing information, and analyzing your use of our newsletter and interaction with the website.If you are a job applicant we also use this information to administer the recruiting process (e.g., setting-up of an electronic job applicant HR file, managing your application, and organizing interviews).
Characteristics of protected classifications under California or federal law, including: familial status, disability, sex, national origin, religion, color, race, sexual orientation, gender identity and gender expression, marital status, veteran status, medical condition, ancestry, source of income, age, or genetic information. We collect information in this category:

  • directly from you; or
  • from our services providers (e.g., recruiters).
 We do not collect this type of Personal Data about consumers.However, if you are a job applicant we use this information to administer the recruiting process (e.g., setting-up of an electronic job applicant HR file).
Commercial information: records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. We collect information in this category:

  • directly from you;
  • from our services providers; or
  • through cookies or similar technologies.
 A subset of this data is processed in connection with our operational functions, including managing and responding to your queries submitted via e-mail or contact form, generating and managing leads (e.g. holding events), sending you newsletters and marketing information, and analyzing your use of our newsletter and interaction with the website.We do not collect this type of information from job applicants.
Internet or other electronic network activity information: browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.
We collect information in this category:

  • from our services providers; or
  • through cookies or similar technologies.
 A subset of this data is processed in connection with our operational functions, including analyzing your use of our newsletter and interaction with the website.
Geolocation data We collect information in this category:

  • directly from you;
  • from our services providers; or
  • through cookies or similar technologies.
 A subset of this data is processed in connection with our operational functions, including managing and responding to your queries submitted via e-mail or contact form, generating and managing leads (e.g. holding events, documenting the event by means of video and audio recordings and the use of the recordings made for press and public relations purposes), sending you newsletters and marketing information, and analyzing your use of our newsletter and interaction with the website.

If you are a job applicant we also use this information to administer the recruiting process (e.g., setting-up of an electronic job applicant HR file, managing your application, and organizing interviews).
Audio, electronic, visual, thermal, olfactory or similar information: such as recordings and taken at events we host.  We collect information in this category:

  • directly from you; or
  • from our services providers.
 A subset of this data is processed in connection with our operational functions, including holding events, documenting the event by means of video and audio recordings and the use of the recordings made for press and public relations purposes.

We do not collect this type of information from job applicants.
Professional or employment-related information: such as your job title and entity affiliation. We collect information in this category:

  • directly from you; or
  • from our services providers.
 A subset of this data is processed in connection with our operational functions, including holding events, documenting the event by means of video and audio recordings and the use of the recordings made for press and public relations purposes.

We do not collect this type of information from job applicants.
Professional or employment-related information: such as your job title and entity affiliation. We collect information in this category:

  • directly from you; or
  • from our services providers.
 A subset of this data is processed in connection with our operational functions, including managing and responding to your queries submitted via e-mail or contact form, generating and managing leads (e.g. holding events, documenting the event by means of video and audio recordings and the use of the recordings made for press and public relations purposes), sending you newsletters and marketing information.

If you are a job applicant we also use this information to administer the recruiting process (e.g., setting-up of an electronic job applicant HR file, managing your application, and organizing interviews).
Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes N/A A subset of this data is processed in connection with our operational functions, including generating and managing leads (e.g. holding events, documenting the event by means of video and audio recordings and the use of the recordings made for press and public relations purposes), sending you newsletters and marketing information, and analyzing your use of our newsletter and interaction with the website.

 

If you are a job applicant we also use this information to administer the recruiting process (e.g., managing your application and organizing and conducting interviews).

 

In addition to the categories of information above, we also collect the following categories of sensitive Personal Data as defined under California law:

Category of Sensitive Personal Data Source Purpose of Collecting and Processing Data
A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership. We collect information in this category directly from you or from recruiters. If you are a job applicant, we process a subset of this data for employment purposes such as managing your application, organizing an interview, making you aware of your employee benefits, and ensuring compliance with laws and regulations.

We do not use or disclose sensitive Personal Data we collect for purposes other than those considered necessary under California law, including as needed to perform our services, verify and maintain the quality and safety of our services, and resist fraud or illegal actions.

We do not sell your Personal Data, and we have contracts with our service providers to prohibit any sale of your Personal Data and to provide written assurances regarding the security and privacy protections they have in place to protect your Personal Data. We also do not sell your Personal Data to or share your Personal Data with third parties for cross contextual behavioral advertising, as those terms are defined under California law, or for targeted advertising, as those terms are defined under applicable state privacy laws. We also do not share (as that term is defined under California law) identifiers, commercial information, Internet or other electronic network activity information, or geolocation data with third parties for analytics, advertising or direct marketing purposes. Nor do we intend to. We also have not done so for the last 12 months. We may share Personal Data about you with service providers or transfer it to another country for processing as permitted and in compliance with applicable law.

Data anonymisation and use of aggregated information

We may convert your Personal Data into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from that data. We may use this aggregated data to conduct market research and analysis, including to produce statistical research and reports. For example, we may produce reports on which of our product offerings attract the fewest or the highest number of enquiries from brokers and intermediaries and other persons visiting our website or using our products and services. In particular, we use technology to collect anonymous information about your use. For example:

  1. we use technology to track which pages of our website visitors view. We also use technology to determine which web browsers our visitors use. This technology does not identify you personally, it simply enables us to compile statistics about our visitors and their use of our website.
  2. certain pages of our website may contain hyperlinks to other pages of our website. We may use technology to track how often these links are used and which pages on our website our visitors choose to view. Again this technology does not identify you personally — it simply enables us to compile statistics about the use of these hyperlinks.

We use this anonymous data to improve the content and functionality and consider areas and subjects which are attracting interest so that we can focus our e-mail updates (for those that wish to receive such communications). This allows us to better understand our visitors’ interest areas generally and therefore to improve our website and products and services we offer.

Cookies and analytic tools

Also, we may from time -to- time use cookies on our website and when providing digital services. For additional information please visit our Cookie Policy: Our Cookie Policy contains information about how we use cookies and how you manage your cookie settings. Cookies are files that are stored on your mobile phone, tablet or computer when you visit a website.

Do Not Track

Some web browsers permit you to broadcast a signal to websites and online services indicating a preference that they “do not track” your online activities. While we do not sell or share Personal Data derived from cookies for cross context behavioral advertising, we nonetheless have tools in place to detect and honor requests made using these Global Privacy Control (“GPC”) signals as requests to opt-out of the sharing of Personal Data to the extent required by applicable privacy law. If you wish to manage your cookie preferences directly with us, please go to our consent manager or make a request using one of the methods outlined above. The foregoing shall not affect our obligation to collect consent for cookies, where applicable.

Disclosure of your Personal Data to third parties

We may disclose your Personal Data to third parties, including but not limited to as follows:

  1. within our group of companies for the purposes of use described in this Privacy Notice;
  2. to third parties who supply services to us and who help us and our group of companies to operate our business. For example, sometimes a third party may have access to your Personal Data in order to support our information technology or to handle mailings on our behalf;
  3. to our legal and other professional advisers;
  4. as necessary in order to comply with a legal requirement (including, where appropriate, any imposed on our group companies in the United States), for the administration of justice, to protect vital interests, to protect the security or integrity of our databases or websites, to take precautions against legal liability;
  5. to regulatory authorities, courts and governmental agencies to comply with legal orders, legal or regulatory requirements and government requests; and
  6. to a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your Personal Data only for the purposes disclosed in this Privacy Notice (on the legal basis of our prevailing legitimate interest in ensuring the business operation).

Please also see the “For California Residents” section above for more details on the type of information provided to third parties.

Security of Personal Data

We endeavour to maintain technical and physical security measures designed to protect Personal Data which is transmitted, stored or otherwise processed by us, from an unlawful destruction, loss, alteration, unauthorised disclosure of, or access, in connection with our website, products and services. These measures include computer safeguards and secured files and facilities. Our service providers are also selected carefully and required to use appropriate protective measures. In certain areas, Ali Group uses industry-standard SSL-encryption to protect data transmissions. Most current browsers support the level of security needed to use these areas.

In particular, we endeavour to maintain technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate: (a) pseudonymisation (such as where data is separated from direct identifiers so that linkage to an identity is not possible without additional information that is held separately) and encryption, (b) ensuring the ongoing confidentiality, integrity, availability and resilience of systems and services used to process your Personal Data, (c) ensuring the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and (d) ensuring a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational security measures. Please note, however, that no method of data transmission is over 100% secure or error free.

Retention period or criteria used to determine the retention period

In general, we aim to keep your Personal Data only for as long as it is necessary to do so to fulfill the purposes for which it was collected as described above. To support us in managing how long we hold Personal Data and our record management, we maintain a data retention policy which includes clear guidelines on retention and deletion.

The criteria we use to determine data retention periods for Personal Data includes the following:

  1. Retention in case of queries. We will retain it for a reasonable period after the relationship between us has ceased in case of queries from you;
  2. Retention in case of claims. We will retain it for the period in which you might legally bring claims against us, if and to the extent we have entered into any contract with you;
  3. Retention in accordance with legal and regulatory requirements. We will consider whether we need to retain it after the period described in (ii) because of a legal or regulatory requirement;
  4. Retention for the purposes of lead generation and lead management. In case we process your Personal Data based on legitimate interest, we will process such data until you object to such processing.

If your application for employment is successful and you commence employment with Ali Group, your Personal Data will be transferred to your personnel file and will be processed for employment purposes. If your application for employment is not successful, we will keep your Personal Data for a limited period (usually 6 months) upon notification that your application was not successful.

For details regarding the storing of cookies, visit our Cookie Policy.

If you would like further information about our data retention practices please contact us (see “Contact Us” below).

Your rights under data privacy laws

Depending on where you live, you may have various with regard to the processing of your Personal Data. These may include (as relevant):

  • the right to request access to the Personal Data we hold about you;
  • the right to rectification including to require us to correct inaccurate Personal Data;
  • the right to request restriction of processing concerning you or to object to processing of your Personal Data;
  • the right to request the erasure of your Personal Data where it is no longer necessary for us to retain it;
  • the right to data portability including to obtain Personal Data in a commonly used machine readable format in certain circumstances such as where our processing of it is based on a consent;
  • the right object to automated decision making including profiling (if any) that has a legal or significant effect on you as an individual; the right to withdraw your consent to any processing for which you have previously given that consent.

You can tell us at any time not to send you marketing communications by e-mail by clicking on the unsubscribe link within the marketing e-mails you receive from us, or by sending an “opt out” request to the address indicated on such email. You may request not to be contacted by us in connection with any new services, updates, news, or events by contacting us as described below.

If you believe that we have not complied with data protection regulations when processing your personal data, you also have the right to lodge a complaint with the applicable supervisory authority in your country or state of residence.

Under certain United States laws, residents also have the right to opt-out of the sale of Personal Data, sharing of Personal Data for cross-context behavioral advertising, and/or use of Personal Data for target advertising. We currently do not sell Personal Data to third parties or use or share your Personal Data for cross-contextual behavioral advertising or targeted advertising, as those terms are defined under applicable data protection laws, therefore do not offer this option. We may share Personal Data about you with service providers as permitted by law. Please see the “Disclosure of your Personal Data to third parties” portion of this Policy for more information. California residents also have the right to limit use and disclosure of sensitive Personal Data. We only use sensitive Personal Data for the necessary purposes detailed above, and therefore do not offer this option.

For more information for European Union Residents, please visit https://commission.europa.eu/law/law-topic/data-protection/reform/rights-citizens/my-rights_en.

Additional Information for residents of Colorado and California: We will maintain all of your data rights requests for at least 2 years. This information will not be used for any other purpose except to review compliance processes; it will not be shared except as necessary to comply with a legal obligation. For residents of Colorado, sensitive data which we no longer have consent to process will be deleted or rendered permanently anonymized or inaccessible within a reasonable period of time after withdrawal of consent.

For United States residents, please note that:

  • Data solely retained for data backup purposes is principally excluded from these rights until it is restored to an active system or next accessed or used for a sale, disclosure, or commercial purpose.
  • We are only obligated to respond to Personal Data requests from the same consumer up to two times in a 12-month period. California law also permits you to request in writing a list of the types of Personal Data that we have disclosed to a third party for their direct marketing purposes during the preceding year and to whom that information was disclosed.

Additional Information for residents of Colorado and California: We will maintain all of your data rights requests for at least 2 years. This information will not be used for any other purpose except to review compliance processes; it will not be shared except as necessary to comply with a legal obligation. For residents of Colorado, sensitive data which we no longer have consent to process will be deleted or rendered permanently anonymized or inaccessible within a reasonable period of time after withdrawal of consent.

You may also be entitled to request in writing a list of the types of Personal Data that we have disclosed to a third party for their direct marketing purposes during the preceding year and to whom that information was disclosed.

Exercising Your Rights

You can exercise your privacy rights by submitting requests to us to exercise those rights and by taking other steps that will limit how information about you is collected, used, and shared. You may submit your request to exercise your rights by visiting www.aligroup.com/contact/. You may also reach out to us via the information provided in the “Contact Us” section below.

Before providing information you request in accordance with these rights, we must be able to verify your identity. In order to verify your identity, you may need to submit information about yourself, including, to the extent applicable, providing answers to security questions, your name, government identification number, date of birth, contact information, or other personal identifying information. We will match this information against information we have previously collected about you to verify your identity and your request. If we are unable to verify your identity as part of your request, we will not be able to satisfy your request. We are not obligated to collect additional information in order to enable you to verify your identity. For deletion requests, you will be required to submit a verifiable request for deletion and then to confirm separately that you want Personal Data about you deleted.

If you would like to appoint an authorized agent to make a request on your behalf, you must provide the agent with written, signed permission to submit privacy right requests on your behalf, or provide a letter from your attorney. The agent or attorney must provide this authorization at the time of request. Information collected for purposes of verifying your request will only be used for verification.

If you choose to exercise any of these rights, to the extent that they apply, U.S. state law prohibits us from discriminating against you on the basis of choosing to exercise your privacy rights. We may, however, charge a different rate or provide a different level of service to the extent permitted by law. We will notify you if we are unable to honor your request. Based on your residency, you may have the right to appeal our decision with regard to your request by using the “Contact Us” details provided at the end of this Policy.

Under EU law and the law of some US states, if an individual makes unfounded, repetitive, or excessive requests (as determined in our reasonable discretion) to access Personal Data, a controller may charge a fee subject to a maximum set by law. In addition, under applicable privacy law, and for the protection of your Personal Data, we may be limited in what Personal Data we can disclose.

Children

Our websites and services are not intended for children under 17 years of age. No one under age 17 may provide any information to the Website. We do not knowingly collect Personal Data from children under 17. If you are under 17, do not use or provide any information on our Website or on or through any of its features/register on the Website, make any purchases through the Website, use any of the interactive or public comment features of our Website or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received Personal Data from a child under 17 without verification of parental consent, we will delete that information. If you believe we might have any information from a child under 17, please contact us in any manner set forth below in the “Contact Us” Section of this Privacy Notice.

Links to Other Websites

Our website may contain hyperlinks to websites that are not operated by us. These hyperlinks are provided for your reference and convenience only and do not imply any endorsement of the activities of these third-party websites or any association with their operators. We do not control these websites and are not responsible for their data or privacy practices. We urge you to review any privacy policy posted on any site you visit before using the site or providing any Personal Data.

Updated and changes to this Privacy Notice

We may decide to change this Privacy Notice. If the change is fundamental or may significantly affect you, we will provide you with the updated Privacy Notice in advance of the change actually taking effect. We encourage you to review the content of this Privacy Notice regularly.

Contact Details

If you wish to exercise your data protection rights against us please e-mail privacy@aligroup.com. You may also submit a request via our website, or you may contact us via:

Ali Group S.r.l. a Socio Único
Via Gobetti, 2a
20063 Cernusco sul Naviglio (Milan) – Italy