in accordance with European Regulation 2016/679


Owner and Manager

Owner of the processing of personal data is Exsulting S.r.l. (hereinafter Exsulting), REA Number, TS 203366, VAT Number IT 01314520329, with registered office in 34133 Trieste, Italy, via Cicerone 4 - Spazio Laby.

The person in charge of the processing is Federico Fioretto, Managing Partner domiciled by the office above, e-mail address:


Purpose of the treatment

The data are collected and kept for the fulfillment of tax obligations, for the management and organization of the activities carried out by Exsulting and for communications concerning professional activities designed and carried out by the same. In particular:

  • the fiscal, administrative and accounting management of commercial relationships
  • communication and correspondence
  • information on initiatives, activities, publications and projects carried out by or in collaboration with Exsulting
  • update on news and contents of interest in the professional fields in which Exsulting’s activities take place
  • invitations to dedicated events
  • providing free digital documents and publications


Exsulting collects personal data such as: name, surname, Company, telephone number, mobile phone number, address, e-mail address and other information provided voluntarily by the interested parties or deriving from business or correspondence reports (voluntary as well). To carry out tax obligations and administrative practices, Exsulting can also collect tax and bank details of the interested parties (tax code, VAT number, IBAN, SWIFT, BIC, place and date of birth of persons).

Exsulting guarantees that manual and electronic treatments are carried out by minimizing the use of personal data and identification data, limiting their use to cases where they are strictly necessary for the achievement of the purposes for which they were collected.


Method of treatment

All communication activities concerning treatments are performed through traditional and electronic communication tools such as: e-mail, newsletters, phone calls, social networks. They can be organized into groups, lists and managed through specific tools or platforms managed by third parties (e.g. MailUp or Mail Chimp for newsletters). In the case of use of external services, however, the data are not transferred to the third party and the protection of confidentiality is guaranteed by the service contract.

The processing of the given data takes place in compliance with the regulations in force, by means of paper and / or IT tools suitable to protect the security and confidentiality of the data, in compliance with the measures set forth in the 2016/679 European Regulation.

This treatment consists of the collection, registration, organization, storage, consultation, processing, extraction, selection, comparison, use, cancellation and destruction of the data.

The processing operations indicated above are carried out exclusively by Federico Fioretto, or by persons in charge of the various services connected with the aforementioned specifically instructed and under direct control, with logics related to the purposes for which the data were collected.

The consent to the processing of data is optional, but in the absence of this, the holder cannot handle the request of the person concerned to establish a professional relationship (e.g. taking the Embedded Sustainability Index survey, course registration, newsletter subscription, download of publications, receiving updates and information, completion of the services proposed by Exsulting etc.). Consent to communication and information activities is implicit on the part of those who correspond with Exsulting on the basis of professional or personal relationships either by direct means or through social platforms like Linkedin, Facebook or similar. In these cases it is possible to opt out with a simple communication as indicated below.

Exsulting does not provide the aforementioned personal data to third parties for advertising, profiling or statistical purposes, does not sell them or rent them to third parties.

The duration of the treatment is functional to the relationship with Exsulting, to the administrative, accounting and organizational obligations by Law. Personal data are however stored for a period of ten years for the purposes of traceability of the service provided and for tax provisions, unless the tax laws, civil law or otherwise mandatory require a longer period of demonstration of the relationship, transactions and services performed .

The communication of bank data by the interested party for periodic or one-off payments requires the retention of information limited to the period necessary to ensure the verification of the correct transaction and the verification of the related tax and compliance obligations.


Who treats the data

Personal data will be accessible to Federico Fioretto personally and, where necessary from time to time, to formally appointed and instructed collaborators, under direct control.

The forwarding to and use of personal data by external individuals and organizations that act on behalf of Exsulting or provide services, as in the example of the Newsletter service, are governed by contracts with primary operators that provide an adequate level of protection of personal data.

These third parties will act as autonomous data controllers, solely and exclusively to satisfy the request of the interested party (e.g. bank / credit card details communicated to the credit institutions for payments or personal data communicated to third party suppliers for sending the newsletter), or to whom the communication of data is necessary to comply with laws or regulations (administrative obligations), or to organize and coordinate particular initiatives promoted by Exsulting, for example the organization of events.

Exsulting controls the activities commissioned to these third parties, verifying the work and reliability in terms of privacy.

As for the provision of data through their pages on social networks (Facebook, Twitter, etc ...), Exsulting first of all uses them to a very small extent, simply to record contact data on those platforms; furthermore, Exsulting adopts all the measures in its power suitable to guarantee the treatment; these measures are however conditioned by the nature of the instrument itself, its usability by the user and the actions in terms of privacy undertaken directly by the owner of the social network.

Exsulting cannot be held responsible for untruthful information sent directly by an interested party (e.g. personal data, postal addresses, e-mail address), and which may possibly involve unaware third parties. Upon the occurrence of such incidents, Exsulting will intervene promptly to protect the privacy of the parties involved, reserving the right to denounce such fraudulent actions to the competent authorities.



On the Exsulting website (and related sites, for example related landing pages) there are technical cookies, the use of which does not require the user's consent, which guarantee the normal navigation and use of the website and that are necessary to allow a safe browsing and efficient of the site.

There are also additional cookies related to Google Analytics. Google Analytics is a web statistics service offered by Google, Inc. that uses cookies to analyze and create reports on the use of the site by users. It is widely used on the Web and uses anonymous data, i.e. cookies do not include personal information that allows users to be identified. These cookies help to understand the behavior of visitors and allow to make improvements that make their experience more enjoyable and useful.

Visitors can choose not to be detected by Google Analytics using a browser add-ons freely available on the web.


Rights of interested users

Exsulting grants each interested party the exercise of their rights as set out in Chapter III of the General Data Protection Regulation:

  • access to personal data also to know the logic and purposes on which the treatment is based with electronic tools
  • to obtain the updating, correction or cancellation of the same or the limitation of processing
  • to obtain anonymous data transformation or blocking of data
  • to oppose the treatment
  • to oppose data portability
  • to revoke the consent, where provided: the withdrawal of consent does not affect the lawfulness of the treatment based on the consent given before the revocation
  • to propose a complaint to the supervisory authority (Garante Privacy)


The subjects to whom the personal data refer will be able to exercise the relative rights by contacting the holder at the aforementioned domicile address or e-mail, preferably with the subject "Personal Data".

Thank you for the time dedicated.


Updated in Trieste, 31/08/2018