Last updated: September 13, 2026
Privacy Policy
Data Controller
M.C.M. S.r.l. Via Prov.le C.da Castagnara - 89022 Cittanova (RC) - Italy Italian tax code / VAT no. IT01475270805 Email: info@groupmcm.com M.C.M. S.r.l. is the controller of the personal data collected through this website. No Data Protection Officer (DPO) has been appointed, as the conditions of Article 37 GDPR do not apply: for any question about your data, please write to the email address above.
What data we process, and why
This website requires no registration and builds no user profiles. We process personal data only in the three cases described below. 1. Contact form Data processed: name, email address and the content of your message. Purpose: to answer your enquiry and handle the correspondence that follows from it. Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and, for subsequent correspondence, Article 6(1)(f) GDPR (our legitimate interest in following up on your enquiry). Retention: 24 months from the last meaningful contact. If a contractual relationship arises from the enquiry, statutory retention periods for accounting and tax records apply. 2. Job applications - Work with us Data processed: name, email address, message and the attached curriculum vitae, including the data it contains. Purpose: to assess your application and, where relevant, to contact you for an interview. Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Under Article 111-bis of the Italian Privacy Code (Legislative Decree 196/2003), processing unsolicited CVs does not require your consent. Retention: 24 months from receipt, after which the application is deleted. Please note: we ask you not to include in your CV any special categories of data under Article 9 GDPR (racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, data concerning health, sex life or sexual orientation). Should such data be present anyway, it will not be used in the selection process. 3. Browsing data Data processed: IP address, browser and device type, pages visited, date and time of the request, and further data contained in server logs. Purpose: to operate the website, keep it secure and produce aggregate statistics on visits. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in delivering and protecting the service). Retention: technical logs are kept by our hosting provider for as long as necessary for security purposes; statistics are aggregated and cannot be traced back to you. Providing your data is optional. Without the fields marked as mandatory in the forms, however, we cannot act on your enquiry or application.
Cookies and usage statistics
This website uses no profiling cookies and no third-party tracking tools, and shares no data with advertising networks. That is why you will not find a consent banner: there is no consent to collect. The only cookie the site may store is NEXT_LOCALE (30 days), written only if you actively choose a different language, and solely to remember that choice. It is a technical cookie, exempt from consent under Article 122 of the Italian Privacy Code and the Italian Data Protection Authority's cookie guidelines of 10 June 2021. To measure performance and traffic we use Vercel Web Analytics and Vercel Speed Insights: tools that install no cookies, use no persistent identifiers on your device and cannot identify individual visitors, since data is collected in aggregate form. Further details are set out in the Cookie Policy, reachable from the Company Policies page.
Who we share your data with
Your data is not disclosed publicly and is not sold or transferred to third parties for commercial purposes. It may be processed on our behalf, as data processors under Article 28 GDPR, by the suppliers that enable us to run the service: • Vercel Inc. (United States) - website hosting, content delivery network, technical logs and aggregate statistics. Privacy notice • Aruba S.p.A. (Italy - registered office in Ponte San Pietro (BG), Via San Clemente 53) - email service: sending and storing the messages generated by the site's forms, including CVs and attached documentation, on the @groupmcm.com mailboxes. Privacy notice Data may also be shared with consultants and professionals who assist us, and with the competent authorities where required by law. An up-to-date list of data processors can be requested by writing to info@groupmcm.com.
Transfers outside the European Union
Vercel Inc., which hosts the website, is established in the United States. Data is transferred to this supplier on the basis of the safeguards set out in Chapter V GDPR: certification under the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission (Article 46(2)(c) GDPR). Messages sent through the site's forms - enquiries, job applications and whistleblowing reports - are handled by Aruba S.p.A., a company established in Italy: their content does not pass through a non-EU mail provider. Aruba may in turn rely on third parties located outside the European Union, subject to the safeguards set out in Chapter V GDPR (adequacy decisions or Standard Contractual Clauses), as stated in its own privacy notice. You may request a copy of the safeguards in place by writing to info@groupmcm.com.
Your rights
As a data subject you may exercise at any time the rights set out in Articles 15-22 GDPR, and in particular: • access to your data and to information about the processing; • rectification of inaccurate or incomplete data; • erasure of your data, in the cases provided for by law; • restriction of processing; • portability of the data you provided, in a structured, machine-readable format; • objection to processing based on legitimate interest, on grounds relating to your particular situation. To exercise these rights simply write to info@groupmcm.com. The request is free of charge and you will receive a reply without undue delay and in any case within one month of receipt. If you believe your data is being processed unlawfully, you have the right to lodge a complaint with the Italian supervisory authority: Garante per la protezione dei dati personali - Piazza Venezia 11, 00187 Rome, Italy - www.garanteprivacy.it
Security, automated decisions and minors
We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure: the site is served exclusively over HTTPS, mailbox access is restricted to authorised staff, and suppliers are selected among providers offering adequate safeguards. We carry out no automated decision-making and no profiling within the meaning of Article 22 GDPR: every assessment, including during recruitment, is made by people. This website is not intended for children under 16 and does not knowingly collect their data.
Changes to this notice
This privacy notice may be updated to reflect legal or organisational changes. The version in force is always published on this page, with the date of the last update shown at the top.