Data protection notice for our webinars

Contents

1. Introduction
2. Data controller and contact details
3. Data categories
4. Purposes and legal bases
   1. You register for a webinar
   2. You attend the webinar
   3. We issue you a certificate of attendance
   4. We ask you for feedback
   5. We contact you by telephone re our products and services
   6. We inform you by e-mail re our products and services
   7. We evaluate our webinars
5. Data sources
6. Necessity of the data
7. Automated decisions
8. Data recipients
9. International transfers
10. Retention period
11. Data subject rights
12. Right to lodge a complaint
13. Changes

1. Introduction

This data protection notice informs you about how your personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) when you

1. register for one of our webinars,
2. attend a webinar, or
3. are contacted by us after the webinar.

2. Data controller and contact details

The data controller is:

onboard Srl
Via Dr. J. Köllensperger 10/b
39011 Lana (BZ)
South Tyrol / Italy
E-mail: [email protected]

Our Data Protection Officer (DPO) can be contacted at [email protected].

3. Data categories

We collect the following categories of personal data for the purposes set out below:

“identity data”: your first name and surname.

“contact data”: your e-mail address and, where we receive or obtain it (see point 4.5), your business telephone number.

“employment data”: any personal data relating to your professional role, such as your company or position, to the extent that this is apparent from your e-mail address, the information you provide or publicly accessible sources.

“communication data”: personal data from your communication with us, such as questions and comments that you submit when registering, in the chat, via the question-and-answer function (Q&A) or in polls during the webinar, the content of telephone conversations and the timing of the communication.

“participation data”: data about your registration and participation, such as the time of registration, the times you joined and left, the duration of your participation and your answers to polls during the webinar.

“log data”: technical data that Zoom collects when you participate, such as IP address, device type, operating system, browser, connection quality and time of access.

4. Purposes and legal bases

We process personal data in the following cases:

4.1 You register for a webinar

If you register for a webinar via Zoom’s registration form, we process your identity data, contact data, employment data and participation data in order to handle your registration, send you the access link and reminders, and prepare the webinar. The legal basis is our legitimate interest in holding our webinars as information and marketing events (Art. 6(1)(f) GDPR).

Where the registration form allows you to provide further data (e.g. “Questions and comments”), we process the communication data contained therein in order to take it into account accordingly. The legal basis is our legitimate interest in responding appropriately to your communication, e.g. to answer any questions (Art. 6(1)(f) GDPR). Please do not enter data relating to third parties or special categories of personal data (e.g. data concerning health) in any field.

The registration form is provided by Zoom and protected against automated registrations by Google reCAPTCHA. This processing is carried out by Zoom as an independent controller (see point 8).

4.2 You attend the webinar

During the webinar, we process your identity data, participation data, communication data and log data in order to hold the webinar, answer your questions, evaluate polls and ensure the technical stability and security of the transmission. The legal basis is our legitimate interest in holding our webinars and in ensuring secure and uninterrupted transmission (Art. 6(1)(f) GDPR).

4.3 We issue you a certificate of attendance

After the webinar, we may issue you a certificate of attendance on the basis of your identity data and participation data and send it to you by e-mail. The legal basis is our legitimate interest in providing participants with proof of their attendance (Art. 6(1)(f) GDPR).

4.4 We ask you for feedback

After the webinar, we may send you an invitation to a feedback survey. In doing so, we process your contact data and, if you take part, your answers in order to improve our webinars.

The legal basis is our legitimate interest in ensuring the quality of our events (Art. 6(1)(f) GDPR). Participation in the survey is voluntary.

4.5 We contact you by telephone re our products and services

After the webinar, we may call you to inform you about our products and services in the field of HR software and to answer any questions you may have about them. For this purpose, we process your identity data, contact data, employment data, participation data (in particular, which webinar you attended) and communication data. The legal basis is our legitimate interest in direct marketing to persons who have shown an interest in our topics by attending the webinar and – in the case of clients and persons working for them – in maintaining the business relationship (Art. 6(1)(f) GDPR; Art. 130(3) of the Italian Data Protection Code, Legislative Decree No. 196/2003).

As you do not provide a telephone number when registering, we use the business telephone number available to us from an existing business relationship with your company, or we obtain your business telephone number or that of your company from publicly accessible sources, in particular your company’s website or professional networks (e.g. LinkedIn). We do not collect private telephone numbers.

You may object to being contacted by telephone at any time, including directly during the call (see point 11). An objection does not affect your participation in the webinar.

4.6 We inform you by e-mail re our products and services

If you are a client of ours or work for one of our clients, we may send you information by e-mail about our products and services that are related to the products and services you have already purchased. For this purpose, we process your identity data, contact data, employment data and participation data. The legal basis is our legitimate interest in maintaining the business relationship and in direct marketing (Art. 6(1)(f) GDPR). You may object to this processing at any time, e.g. via the unsubscribe link included in every e-mail.

In all other cases, we will only send you product information by e-mail if you have expressly consented to this when registering or subsequently. The legal basis is then your consent (Art. 6(1)(a) GDPR; Art. 130(1) and (2) of the Italian Data Protection Code), which you may withdraw at any time with effect for the future, e.g. via the unsubscribe link in every e-mail.

4.7 We evaluate our webinars

We evaluate participation data in aggregated form (e.g. number of registrations and participants, average duration of participation, poll results) in order to plan and improve our webinars. The legal basis is our legitimate interest in developing our range of events (Art. 6(1)(f) GDPR).

5. Data sources

Your identity data, contact data and communication data are collected directly from you when you register for and attend the webinar. Participation data and log data are generated by the Zoom platform when you participate.

Unless you provide them to us yourself, your business telephone number and employment data originate from an existing business relationship with your company or from publicly accessible sources (e.g. your company’s website, professional networks such as LinkedIn); see point 4.5.

If your employer registers you for a webinar, we receive your identity data and contact data from your employer.

6. Necessity of the data

Providing your personal data is neither legally nor contractually required. However, your identity data and e-mail address are necessary for registration and for sending the access link. Without this information, you cannot attend the webinar. All other information (e.g. questions, comments, poll answers, feedback, consent to receive product information by e-mail) is voluntary.

7. Automated decisions

There is no automated decision-making pursuant to Art. 22 GDPR.

8. Data recipients

If and to the extent necessary for one of the above-mentioned purposes, the following categories of recipients may have access to your data:

1. webinar speakers;
2. Zoom Communications, Inc., 55 Almaden Blvd., Suite 600, San José, CA 95113, USA (“Zoom”), which provides the webinar platform, including the registration form, confirmation and reminder e-mails, chat, Q&A and polls, as a processor. We have concluded a data processing agreement with Zoom. For certain exhaustively defined purposes of its own (e.g. billing, security and abuse prevention, including Google reCAPTCHA, compliance with legal obligations), Zoom processes account, diagnostic and log data as an independent controller. Further information can be found in Zoom’s privacy statement at https://www.zoom.com/en/trust/privacy/;
3. other service providers who receive personal data as processors (e.g. IT service providers for e-mail delivery, CRM and telephony).

9. International transfers

When Zoom is used, personal data is transferred to and stored in the United States. The webinar stream itself (audio, video, screen sharing) is routed through Zoom data centres in the European Economic Area. Zoom stores registration, participation, account, diagnostic and log data in the United States.

Zoom is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision. In addition, we have concluded the standard contractual clauses adopted by the European Commission (Module 2) with Zoom. For further information, please contact us (see contact details under point 2).

10. Retention period

We store your personal data for as long as is necessary for the respective purpose. The maximum retention period depends on the following criteria:

1. duration of the preparation, holding and follow-up of the webinar;
2. duration of the sales contact resulting from the webinar, or until you object or withdraw your consent, which you may do at any time;
3. limitation periods for the establishment, exercise or defence of any legal claims (Art. 2946 and 2947 Italian Civil Code).

11. Data subject rights

As a data subject, you have the following rights:

• right of access (Art. 15 GDPR);
• right to rectification (Art. 16 GDPR);
• right to erasure/to be forgotten (Art. 17 GDPR);
• right to restriction of processing (Art. 18 GDPR);
• right to data portability (Art. 20 GDPR);
• right to object (Art. 21 GDPR);
• right to withdraw your consent (Art. 7(3) GDPR), see point 4.

Please note regarding the right to object (Art. 21 GDPR): If your data is processed on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to the processing at any time on grounds relating to your particular situation. In this case, we will no longer process your data unless (a) we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or (b) the processing serves the establishment, exercise or defence of legal claims. If your data is processed for the purpose of direct marketing – by telephone or e-mail – you have the right to object to the processing of your data for the purpose of direct marketing at any time and without giving reasons. In this case, your data will no longer be processed for these purposes.

To exercise these rights, please contact us (see contact details under point 2).

12. Right to lodge a complaint

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). In Italy, this is the Garante per la protezione dei dati personali (GPDP) based in Rome.

13. Changes

We may amend this data protection notice at any time.

Version: 14.10.2026