Cookie Policy

Softhiring — SaaS di Gestione Risorse Umane

Data controller: Ethovix S.r.l. — Via Ozanam 2, 24126 Bergamo — P.IVA 04918740160 — PEC ethovix@pec.it
Last updated: May 2026

1. Introduction

This website ("Site") uses cookies and similar technologies to provide our human resources SaaS services. This Cookie Policy explains what cookies are, how we use them, the legal basis for processing, your rights and the options available to you.

IMPORTANT: Non-technical cookies (analytics, marketing) are installed ONLY upon your explicit, free and specific consent, expressed through the cookie banner. Simply browsing the Site does not constitute consent to the use of non-essential cookies.

You can withdraw your consent at any time as easily as you gave it, by accessing the cookie preferences available at the bottom of every page of the Site.

2. What Are Cookies?

Cookies are small text files stored on your device (computer, tablet, smartphone) when you visit a website. Each cookie contains information that the site can read when you return.

  • Session cookies: deleted automatically when you close your browser.
  • Persistent cookies: remain on your device for a set period (see the table in section 3).

3. Cookies We Use: Details, Duration and Legal Basis

Below is a full list of cookies used, with name, category, purpose, duration and legal basis under Art. 6 GDPR.

Cookie Category Purpose Duration Provider Legal basis
session_id Technical Authenticated session management Session (browser close) Softhiring Art. 6(1)(b) GDPR – Contractual necessity
csrf_token Technical Protection against Cross-Site Request Forgery attacks Session Softhiring Art. 6(1)(f) GDPR – Legitimate interest (security)
auth_token Technical Maintaining authenticated user login state 30 days (if "Remember me"), otherwise session Softhiring Art. 6(1)(b) GDPR – Contractual necessity
sh_cookie_consent Technical Stores the cookie preferences expressed by the user via the banner 12 months (localStorage) Softhiring Art. 6(1)(c) GDPR – Legal obligation (consent accountability)
_ga Analytics Identifies users for Google Analytics (unique session ID) 2 years Google LLC Art. 6(1)(a) GDPR – Consent
_gid Analytics Identifies users within 24 hours for Google Analytics 24 hours Google LLC Art. 6(1)(a) GDPR – Consent
_ga_<ID> Analytics Google Analytics 4: maintains session state for the site's specific GA4 container 2 years Google LLC Art. 6(1)(a) GDPR – Consent
__stripe_mid Functional Anti-fraud and device identification for Stripe payment processing 1 year Stripe Inc. Art. 6(1)(b) GDPR – Contractual necessity
__stripe_sid Functional Secure session for Stripe payment process 30 minutes Stripe Inc. Art. 6(1)(b) GDPR – Contractual necessity

Technical cookies cannot be disabled without impairing the functioning of the Site. They do not require consent as they are strictly necessary. Analytics cookies are installed only after your explicit consent.

4. Consent Banner – GDPR Requirements

On first visit, a consent banner is shown in compliance with GDPR (EU Reg. 2016/679), the ePrivacy Directive 2002/58/EC and the Italian Data Protection Authority Guidelines (Provvedimento 10 June 2021):

  • Equal acceptance and rejection: "Reject all" is visible with the same graphic prominence as "Accept all". No dark patterns.
  • No consent by browsing: Scrolling or continuing navigation does not constitute valid consent under Art. 4(11) GDPR.
  • Granularity by category: Users can accept or reject analytics cookies independently of technical cookies.
  • No pre-selection: Non-technical cookie toggles are in the OFF position when the banner is shown.
  • Easy withdrawal: Consent can be withdrawn at any time via the "Manage cookie preferences" link in the footer of every page.
  • Consent accountability: Date, time and preferences are stored in localStorage for 12 months (Art. 5(2) GDPR).

5. Third-party Cookies and Data Processing Agreements (DPA)

Third-party cookie providers listed below act as data processors under Art. 28 GDPR. Softhiring has concluded or adopted a Data Processing Agreement (DPA) with each of them.

Provider Purpose Extra-EU transfer DPA Link
Stripe Inc. Secure payment processing Yes – USA (Standard Contractual Clauses) ✅ stripe.com/legal/dpa
Google LLC (Analytics) Anonymised site analytics Yes – USA (SCCs + IP anonymised) ✅ business.safety.google

6. Extra-EU Data Transfers

Some cookie providers (Google LLC, Stripe Inc.) are based in the United States. Data transfers to these parties are based on:

  • Standard Contractual Clauses (SCCs) adopted by the European Commission under Art. 46(2)(c) GDPR;
  • EU-US Data Privacy Framework (where applicable), in force since 10 July 2023.

For Google Analytics, the IP anonymisation function (anonymize_ip) is active, which truncates the IP address before any transmission to Google's servers.

7. How to Manage Your Cookies

7.1 Cookie Preferences Panel (Recommended)

You can change your preferences at any time by clicking the Manage cookie preferences link at the bottom of every page.

7.2 Browser Settings

  • Chrome: Settings › Privacy and security › Cookies and other site data
  • Firefox: Preferences › Privacy & Security › Cookies and Site Data
  • Safari: Preferences › Privacy › Manage Website Data
  • Edge: Settings › Privacy › Clear browsing data

Warning: disabling technical cookies via the browser may impair the correct functioning of the Site and prevent access to protected areas.

7.3 Provider-specific Opt-Out

8. Your Rights (GDPR – Arts. 15–22)

Under the GDPR you have the right to:

  • Access (Art. 15): obtain confirmation of processing and a copy of your data
  • Rectification (Art. 16): correct inaccurate or incomplete data
  • Erasure (Art. 17): request deletion of your data ("right to be forgotten")
  • Restriction (Art. 18): restrict processing in certain circumstances
  • Portability (Art. 20): receive your data in a structured, machine-readable format
  • Objection (Art. 21): object to processing based on legitimate interest
  • Withdrawal of consent (Art. 7(3)): withdraw consent at any time, without affecting the lawfulness of prior processing

To exercise your rights, contact us at the addresses in section 10. We will respond within 30 days (Art. 12(3) GDPR). You also have the right to lodge a complaint with the supervisory authority: in Italy, the Garante per la Protezione dei Dati Personali.

9. Security and Data Protection

We implement appropriate technical and organisational security measures under Art. 32 GDPR:

  • HTTPS encryption (TLS 1.2+) for all communications
  • Secure sessions with automatic timeout and Secure/HttpOnly flags on authentication cookies
  • CSRF tokens to prevent request forgery attacks
  • Data access limited to authorised personnel with least-privilege principle

To report security vulnerabilities: privacy@ethovix.com

10. Contact, Data Controller and DPO

For any request regarding personal data processing:

  • Company: Ethovix S.r.l. (operating as Softhiring)
  • Registered office: Via Ozanam 2, 24126 Bergamo
  • P.IVA: 04918740160
  • PEC: ethovix@pec.it
  • Privacy email: privacy@ethovix.com
  • Website: www.softhiring.com

11. Changes to This Cookie Policy

We may update this Cookie Policy in response to regulatory, technological or operational changes. Changes will be published on the Site with an updated date. For material changes that affect the processing of personal data, users will be informed via email and/or through the consent banner, and new consent will be requested where necessary.

12. Legal Compliance

This Cookie Policy is drawn up in compliance with:

  • Regulation (EU) 2016/679 (GDPR) — in particular Arts. 4, 5, 6, 7, 12–22, 28, 32
  • ePrivacy Directive 2002/58/EC (as amended by Directive 2009/136/EC)
  • Legislative Decree 196/2003 (Italian Privacy Code) as amended by Legislative Decree 101/2018
  • Italian Data Protection Authority Guidelines of 10 June 2021 on cookies and other tracking tools
  • EDPB Guidelines 05/2020 on consent
← Back to home