Privacy

1. Data controller

The data controller is Shipyard (Software & AI Studio), with operating locations in Milan · Zurich.

For any request about your personal data, write to us using the contact details in the Contact section (or via the “Let’s talk” CTAs on the site).

Once the billing company is incorporated, this section will list its legal name, registered office and VAT number (Italy) or Impressum (Switzerland).

2. Scope

This notice covers personal data collected through the “Lavora con noi” / “Careers” form on shipyard-studio.it (Italian and English pages), for the Sales Founder role and for future roles published on the same form.

3. Data we collect

We only collect the data you enter in the form:

• contact details: first name, last name, email, phone, city;
• background: current situation (student, recent graduate, employed), university and program, LinkedIn profile (where marked optional);
• application content: answers to the questions (motivation, sales/persuasion experience, weekly availability, commercial challenge), any link to a video or voice memo;
• technical metadata: submission date and time, page language, IP address used only to limit abuse (rate limiting), not for commercial profiling.

If the form later allows uploading a CV (PDF) or a browser-recorded audio file, those files are personal data (a CV is about you; a voice recording is identifying). They will only be requested with explicit consent and processed as described below.

While you fill in the form, a draft may be saved only in your browser (localStorage) so you don’t lose your work: it is not sent to us until you press “Submit application”, and it is deleted after submission. Your consent is never stored in the draft.

4. Purpose and legal basis

We use your data solely to:

• evaluate your application and run the selection process (screening, possible interview, field trial);
• contact you at the email or phone number you provided;
• send you a confirmation that we received your application;
• prevent abuse and spam (honeypot, rate limiting).

Legal bases under Regulation (EU) 2016/679 (GDPR):

• Art. 6(1)(b): steps at your request prior to entering into a contract (application);
• Art. 6(1)(a): the consent you give by checking the privacy box before submit, especially for retention beyond the current selection and for any audio files or CVs;
• Art. 6(1)(f): legitimate interest in keeping the service secure (limiting abusive submissions), balanced against your rights.

We do not use your data for marketing, automated decision-making that produces legal effects, or sale to third parties. Selection decisions are always made by a person.

5. Retention

We keep application data for 12 months from the submission date, unless:

• you ask us to delete it earlier;
• a legal obligation requires a different period;
• we enter into a working relationship with you, in which case the necessary data moves into that relationship’s records.

After 12 months the data (and any attached files) is deleted or irreversibly anonymised. IP-based rate-limit logs are kept only as long as needed to enforce the limits (hours/days).

6. Recipients and transfers

Your data is never sold or transferred for commercial purposes. It may be processed, as data processors and only for the purposes above, by:

• Supabase (database and server function that receives applications), preferably in European Economic Area regions;
• an optional transactional email provider (e.g. Resend) for the confirmation email;
• the static-site host (e.g. Netlify, Vercel or Cloudflare Pages), which does not receive application content.

If a provider processes data outside the EEA, we will only do so with appropriate safeguards (EU Standard Contractual Clauses or an adequacy decision).

Only people at the studio involved in hiring can access applications, under a duty of confidentiality.

7. Your rights

At any time you can exercise your GDPR rights: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (without affecting the lawfulness of processing before withdrawal).

You may also lodge a complaint with the Italian Data Protection Authority (Garante) or the supervisory authority in your EU/EEA country of residence.

To exercise your rights, use the contacts below; we will respond within the statutory deadlines.

8. Children

The form is not intended for anyone under 16. If we learn that an application was submitted by a minor without the legal requirements being met, we will delete it.

9. Changes

We may update this notice if the form, providers or legal duties change. The update date is at the top of the page. Material changes will be noted on the site.

10. Contact

For any request about your data, write to us.