Privacy Notice
Pursuant to Article 13 of EU Regulation 2016/679 (GDPR)
Last updated: 23 June 2026
1. Data Controller
The Data Controller is the Organisation that invited you to participate in this survey (hereinafter «Organisation» or «Controller»). To identify the Controller and to exercise your rights, please refer to the privacy notice provided to you by the Organisation, or contact your HR representative directly.
2. Technical Service Provider (Data Processor)
The Wellbeing Insights platform is developed and operated by:
MIDA SB S.p.A.VAT no. IT 07258310155
Via Privata della Braida 5 - 20122 Milano Italia
E-mail: divisione@mida.biz
MIDA SB S.p.A. acts as Data Processor (Art. 28 GDPR), processing personal data exclusively on behalf of and under the instructions of the Organisation.
3. Data Protection Officer (DPO)
The Data Protection Officer appointed by MIDA SB S.p.A. can be reached at:
dpo@mida.biz
4. Purposes and Legal Basis of Processing
Data are processed exclusively to deliver the organisational wellbeing survey service commissioned by your Organisation, and in particular to:
- enable completion of the questionnaire and calculation of your wellbeing profile;
- produce aggregated, anonymous reports for the Organisation's use;
- ensure the technical security of the platform.
The legal basis for processing is the legitimate interest of the Controller in measuring and improving employee wellbeing (Art. 6(1)(f) GDPR).
5. Data Processed
The platform is designed to collect the minimum necessary data. No personal identifiers are collected at any point: no name, surname, e-mail address, tax identification number, phone number, date of birth or other identifying information.
The data actually processed are as follows:
| Data | Description | Nature |
|---|---|---|
| Questionnaire responses | Ratings on a 1–5 Likert scale relating to statements about workplace wellbeing | Anonymous |
| Priority dimension | The wellbeing area identified as most in need of development, automatically calculated upon completion; the platform provides self-development advice for this dimension | Anonymous |
| Device UUID | Randomly generated technical identifier created in the browser and stored locally (localStorage); does not allow identification of any individual |
Anonymous |
| Technical cookies | See Cookie section below | Technical |
PDF reports are generated dynamically and delivered directly to the browser; they are not stored on disk by the system.
6. Cookies and Tracking Technologies
The platform uses exclusively strictly necessary technical and functional cookies required for the delivery of the service. No profiling cookies, third-party advertising cookies or web analytics tools are used. For this reason no cookie consent banner is displayed.
For a complete list of cookies and similar technologies (localStorage) used, with their regulatory classification, please refer to the Cookie Policy.
7. Recipients of Data
Data are accessible exclusively to:
- authorised technical staff of MIDA SB S.p.A. for platform management and maintenance;
- the Organisation that commissioned the survey, which receives exclusively aggregated, anonymous reports — individual respondents are never identifiable from the results.
Data are not sold, assigned or communicated to third parties for commercial or profiling purposes.
8. International Data Transfers
Data are processed and stored on servers located within the European Union. No transfers of personal data to third countries outside the EU or to international organisations take place.
9. Retention Period
Questionnaire responses and the calculated profile are retained for a maximum period of 12 months from the closure of the relevant wave, after which they are permanently and irreversibly deleted. Your HR Manager may request early deletion of data at any time.
10. Rights of Data Subjects
Under Articles 15–22 of the GDPR, you have the right to:
- Access – obtain confirmation that processing of your data is taking place and receive a copy thereof (Art. 15);
- Rectification – request correction of inaccurate data (Art. 16);
- Erasure – request deletion of your data («right to be forgotten»), in cases provided for by law (Art. 17);
- Restriction – request that processing be limited in certain circumstances (Art. 18);
- Data portability – receive your data in a structured, machine-readable format (Art. 20);
- Objection – object to processing based on legitimate interest (Art. 21).
To exercise your rights, contact the Organisation that invited you to the survey. You may also write to MIDA SB S.p.A. at the address indicated in section 2.
11. Right to Lodge a Complaint
You have the right to lodge a complaint with the supervisory authority competent in your country of residence or the country where the alleged infringement occurred. In Italy:
Garante per la protezione dei dati personaliPiazza Venezia 11, 00187 Rome, Italy
Website: www.garanteprivacy.it
For a list of all EU supervisory authorities, visit the European Data Protection Board website.
12. Changes to This Notice
MIDA SB S.p.A. reserves the right to update this notice to reflect regulatory or technical changes. The «Last updated» date at the top of the document always indicates the version in force.