Privacy Notice
Version 1.1 · Last updated 5 October 2026
This notice explains how Conclave S.r.l. handles personal data for which it is the controller: data about visitors to our website, holders of accounts on our platform, job candidates and business contacts.
It does not cover personal data contained in documents that our customers upload to their data rooms. For that data the customer is the controller and decides how it is used; Conclave processes it only on their instructions. If you are asking about data inside a data room, please contact the organisation that invited you to it.
Who we are
Conclave S.r.l.Via Arnaldo Vassallo 3, 20125 Milano (MI), Italy
C.F. / P. IVA / Registro Imprese: 14659250964
REA: MI – 2798612
PEC: conclave@pec.it
For any question about this notice, or to exercise your rights, contact privacy@conclave.work.
We are not required to appoint a Data Protection Officer. Please use the address above for all data protection matters.
What we collect
| If you are | We hold |
|---|---|
| A visitor to our website | Server logs: IP address, browser and device type, pages requested, timestamps |
| An account holder | Name, business email, credentials, organisation, role and permissions, sign-in events, and records of actions taken in the platform |
| A job candidate | CV, contact details, interview notes and assessment outcomes |
| A business contact | Name, business email, company, our correspondence with you, and the details you give when booking a meeting with us |
We do not ask for special categories of personal data, and we ask that you do not send them to us.
Why we use it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Operating the website and keeping it secure | Our legitimate interests (Art. 6(1)(f)) |
| Creating and administering your account | Performance of a contract (Art. 6(1)(b)) |
| Authenticating you and enforcing access permissions | Performance of a contract (Art. 6(1)(b)) |
| Keeping audit records of activity in the platform | Our legitimate interests in security and accountability (Art. 6(1)(f)) |
| Responding to your enquiries and providing support | Performance of a contract, or our legitimate interests (Art. 6(1)(b), (f)) |
| Recruitment | Steps taken at your request before entering a contract (Art. 6(1)(b)) |
| Keeping candidate details for future roles | Your consent (Art. 6(1)(a)) |
| Meeting accounting, tax and corporate obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on our legitimate interests you may object, and we will stop unless we have compelling grounds to continue. Where we rely on consent you may withdraw it at any time; this does not affect anything done before you withdrew it.
Who we share it with
We do not sell personal data. We use the following service providers, each of which processes personal data on our instructions under a written agreement:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Authentication, file storage, audit logging, email delivery | Milan, Italy |
| Supabase | Database and storage | Frankfurt, Germany |
| Railway | Application hosting | Netherlands |
| Microsoft | Email, files and collaboration | Italy |
| Calendly | Booking demo meetings | United States |
We also disclose personal data to professional advisers, and to public authorities or courts where the law requires it.
International transfers
The personal data covered by this notice is stored and processed within the European Union, with one exception: when you book a demo, the booking is handled by Calendly in the United States. That transfer is made under the EU-U.S. Data Privacy Framework, under which Calendly LLC is certified (European Commission adequacy decision of 10 July 2023), with Standard Contractual Clauses in Calendly's data processing addendum as a fallback. Where any transfer outside the European Economic Area becomes necessary, we will make it under an adequacy decision of the European Commission, under Standard Contractual Clauses, or under another safeguard permitted by Chapter V of the GDPR. You may request a copy of the safeguard in place by writing to us.
How long we keep it
We keep personal data only for as long as we need it. In practice:
| Data | How long |
|---|---|
| Account data | While your account is active, and for a short period after it closes |
| Server logs and audit records | As long as needed for security, troubleshooting and accountability |
| Candidate data | Until the hiring decision is made, and longer only with your consent |
| Business contact data | While the business relationship is reasonably ongoing |
| Accounting and tax records | For the period required by Italian law |
How we protect it
- Data is encrypted in transit and at rest
- Access follows least privilege, with multi-factor authentication required
- Access rights are reviewed regularly and revoked when someone leaves
- Production systems are separated from development and test environments
- Activity is logged and monitored, and backups are taken and tested
- Our staff are trained on security and data protection and are bound by confidentiality obligations
- We follow a documented incident response procedure, including notification of personal data breaches where required
Cookies
Our website sets no non-essential cookies and does not load third-party content when you visit it. The only cookies we set are those strictly necessary to keep you signed in and to keep the service secure. If you choose to book a demo, a booking window provided by Calendly opens on our page. Calendly may set its own cookies inside that window and asks for your consent to any optional ones there. See Calendly's privacy notice for details.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and receive a copy
- have inaccurate or incomplete data corrected
- have your data erased, where the grounds in Article 17 apply
- restrict how we process your data, in the circumstances set out in Article 18
- receive data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller
- object to processing based on our legitimate interests
- withdraw your consent at any time, where we rely on consent
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects
Making a request
Write to privacy@conclave.work, or to our registered address above. This includes requests to delete your data.
We will respond within one month. If your request is complex, or if you have made several, we may extend this by up to two further months; we will tell you within the first month if we need to.
We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else. We will not ask for more than we need. There is no charge unless a request is manifestly unfounded or excessive.
If your request concerns personal data held inside a customer's data room, we will pass it to that customer, who is the controller for it, and let you know we have done so.
Complaints
If you are unhappy with how we have handled your personal data, you may lodge a complaint with the Italian supervisory authority:
Garante per la protezione dei dati personaliPiazza Venezia 11, 00187 Roma
Tel: (+39) 06.696771
Email: protocollo@gpdp.it · PEC: protocollo@pec.gpdp.it
garanteprivacy.it
You may also complain to the supervisory authority in your country of residence or work.
Changes to this notice
We review this notice at least once a year, and whenever our processing changes materially. The version number and date at the top show when it was last updated. If we make a material change we will notify account holders directly.