Cookie Policy
This Cookie Policy describes the types of cookies and similar technologies used by Valyo (hereinafter the “Platform” or “Service”), in compliance with the GDPR (EU Reg. 2016/679), with Directive 2002/58/EC (the so-called e-Privacy Directive), with art. 122 of Legislative Decree 196/2003 and with the Guidelines of the Italian Data Protection Authority of 10 June 2021 (measure no. 231/2021).
1. What cookies are
Cookies are small text files that the websites visited send to the user’s terminal (computer, tablet, smartphone), where they are stored to be retransmitted to the site on the next visit. Similar technologies (e.g. localStorage, sessionStorage, pixels, web beacons) have analogous purposes and regulation and are addressed jointly below.
Cookies can be distinguished by:
- Origin: first-party (set by the site visited) or third-party (set by third-party domains).
- Duration: session (deleted when the browser is closed) or persistent (stored for a defined period).
- Purpose: technical (necessary for operation), analytics (usage statistics), profiling/marketing (targeted advertising).
2. Data controller
For data collected through cookies, the data controller is:
Nextgen HR S.r.l. — Viale Thomas Alva Edison 110, 20099 Sesto San Giovanni (MI) — P.IVA IT14095140969 — PEC [email protected]
Privacy email: [email protected]
For details on the organisation, the purposes and the rights of the data subject, please refer to the Privacy Policy.
3. Technical cookies (do NOT require consent)
These are cookies strictly necessary for the operation of the Platform or for the provision of a service explicitly requested by the user. Their installation does not require consent pursuant to art. 122 of the Privacy Code.
| Name | Origin | Type | Purpose | Duration |
|---|---|---|---|---|
jwt | First-party (*.valyo.it) | HTTP httpOnly, Secure, SameSite | User authentication, maintenance of the login session | Session duration (max JWT expiry) |
tenant-slug | First-party | HTTP cookie | Identifies the tenant (customer) corresponding to the subdomain visited | Session duration |
x-imp-tenant | First-party | HTTP cookie | Marks sessions in which a super-administrator is operating in impersonation for support/audit purposes | Duration of the impersonation operation |
valyo:consent | First-party | localStorage | Stores the consent choice expressed through the cookie banner | 6 months (or until withdrawal) |
3.1 Technical storage (localStorage)
The Platform also uses the browser’s localStorage to store technical interface preferences functional to the use of the Service. Such data remain on the user’s device and are not transmitted to the server:
- Selected light/dark theme (
theme). - Width and arrangement of columns in tables (
*_table_settings). - Filters and hidden columns in the simulators (
benchmark_table_settings,simulator_*, etc.). - Open/closed states of groups and sections on the pages.
This information is also technical in nature and does not require consent. It can be deleted by the user at any time by clearing the site data from their browser.
4. Third-party analytics cookies (REQUIRE consent)
The Platform uses Google Analytics 4 (hereinafter “GA4”), provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), for purposes of aggregated statistical analysis on the use of the Platform.
According to the measures of the Italian Data Protection Authority of 9 June 2022 and 16 July 2024, GA4 cannot be qualified as a technical cookie and therefore requires the user’s prior consent, which must be given through the cookie banner.
| Name | Origin | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics (third-party) | Unique user identifier for aggregated statistical analysis | 13 months |
_ga_<container-id> | Google Analytics (third-party) | Persistence of the GA4 session state | 13 months |
_gid | Google Analytics (third-party) | Daily session identifier | 24 hours |
Data transfer: data collected through GA4 may be transferred to the United States. The transfer is safeguarded by:
- Google LLC’s adherence to the EU-U.S. Data Privacy Framework (EU Commission adequacy decision of 10 July 2023);
- Standard Contractual Clauses (SCC) pursuant to art. 46.2.c GDPR.
In the absence of consent, the GA4 tags are not loaded and no data is sent to Google.
Google privacy notice: policies.google.com/privacy — Google Analytics terms: marketingplatform.google.com/about/analytics/terms.
5. Profiling and marketing cookies
The Platform does not use profiling, retargeting or third-party advertising cookies (e.g. Meta Pixel, LinkedIn Insight, Google Ads).
6. Consent management
On the first access to the Platform and the site, a cookie banner is shown that allows the user to:
- Accept all cookies (technical + analytics).
- Reject analytics cookies (only technical cookies are installed).
- Close the banner without choosing: in this case only technical cookies are installed and not analytics cookies (conservative default configuration).
The user may withdraw consent at any time through the “Manage cookie preferences” button available in the footer of the site, or by deleting the cookies from their browser.
7. Disabling cookies via browser
In addition to the cookie banner, the user can configure their browser to block or delete cookies:
- Google Chrome — support.google.com/chrome/answer/95647
- Mozilla Firefox — support.mozilla.org/it/kb/Eliminare i cookie
- Apple Safari — support.apple.com/it-it/guide/safari/sfri11471/mac
- Microsoft Edge — support.microsoft.com/it-it/microsoft-edge
Please note that disabling technical cookies may impair the operation of the Platform, preventing authenticated access.
8. Rights of the data subject
For the exercise of the rights provided for by arts. 15-22 GDPR (access, rectification, erasure, restriction, objection, portability, withdrawal of consent), please refer to the “Rights of the data subject” section of the Privacy Policy.
Requests should be sent to: [email protected].
9. Changes to the Cookie Policy
The Controller reserves the right to amend this policy at any time to reflect technological or regulatory changes. Changes will be published on this page with the indication of the new date. For substantial changes, the user will be invited to renew consent through the cookie banner.