This policy explains what personal data Sirion collects through its website (sirion.work) and its platform, why, on what legal basis, how long we keep it and what your rights are under the EU General Data Protection Regulation (GDPR).
1. Who we are
The data controller is Sirion Technologies S.r.l., registered office Via Roncaglia 14, 20146 Milano (MI), Italy. VAT number and tax code IT14584740964, REA MI-2793778, share capital €10,000 fully paid.
For any question about this policy or your data, write to [email protected] or, by certified email (PEC), to [email protected].
2. Data we collect on this website
2.1 Demo requests
When you book a demo through the form on our contact page, we receive your full name, your work email address, your company and, if you choose to give them, your company's website and a message. The form also asks you to confirm that you have read this policy.
We use this data only to answer your request, arrange and run the demo and follow up with you about it. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in following up on business enquiries and keeping a record of them (Art. 6(1)(f) GDPR). We do not use it to send you newsletters or marketing without asking you first.
The website does not store your request in a database: it is delivered by email to the Sirion team member who handles demo requests. Your details are kept for as long as needed to follow up on your request and no longer than 24 months from our last contact, unless you become a client, in which case they become part of our client records.
2.2 Job applications
When you apply for a position through the form on one of our careers pages or by writing to [email protected], we receive your name, your email address, your LinkedIn profile (if you provide it), your CV and your answers to our questions, together with what the selection process adds: our notes and the notes of our calls with you, and the work you send us for a business case.
We use this data only to evaluate your application, contact you and run the selection process. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). We do not sell your data or share it with other companies for their own purposes.
How we use AI in hiring. An AI agent reads every application first. At each stage of the process it evaluates what that stage produced (your answers and CV, the notes of our calls, your case work) against the criteria of the role, writes down the evidence it relied on and recommends a next step. One of Sirion's founders reads the evaluation and takes every decision: the agent never decides, never moves an application forward or turns it down, and never writes to you on its own. No decision about your application is taken solely by automated means. Every evaluation is kept with its evidence, so that any decision can be explained.
Calls. We take notes of our calls with you using an AI note-taker (Granola), which transcribes the conversation. We tell you at the start of the call, and you can ask us not to use it.
To receive, store and evaluate applications we rely on the service providers listed in section 4, acting on our behalf; section 5 explains how transfers outside the European Union are covered.
If you are not hired, we delete your application within 12 months of the end of the selection process, unless you ask us to delete it sooner. If you are hired, it becomes part of your personnel file. You can exercise the rights described in section 6 at any time by writing to [email protected], and you have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali).
2.3 Technical data, cookies and analytics
Our website is hosted by Cloudflare. When you visit it, Cloudflare processes technical information needed to deliver the pages and protect the site from abuse, such as your IP address, the page requested, the time of the request and your browser and device type. This is based on our legitimate interest in running a secure website (Art. 6(1)(f) GDPR) and is kept only as long as needed for that purpose.
We do not use cookies for analytics, advertising or profiling, and the website carries no third-party tracking or advertising tags. Our typefaces are served from our own website, not from third-party font services. The website uses your browser's session storage only to remember, during a visit, that the loading animation has already been shown; it contains no personal data and is erased when you close the tab. Cloudflare may set strictly necessary cookies to protect the website from malicious traffic.
2.4 Our social media channels and YouTube API Services
We run Sirion's own accounts on LinkedIn, Instagram, X and YouTube, also through our own software, which publishes our posts and videos, reads the comments on them so that we can reply, and reads their statistics. When you comment on our posts or videos we see your public name, profile and comment, and we use them only to reply to you and to understand how our content performs (Art. 6(1)(f) GDPR).
On YouTube our software uses the YouTube API Services. It accesses only Sirion's own channel, never other channels. By using YouTube you agree to the YouTube Terms of Service, and Google processes data as described in the Google Privacy Policy. An account that has authorised our software can withdraw that access at any time from the Google security settings.
3. Data we process on our platform for clients
Sirion is the first AI-powered ecommerce agency: every client gets a suite of AI agents led by a senior Client Lead. This section describes how our platform — including our applications that connect to third-party services such as Meta (Facebook/Instagram) Marketing API, Google Ads API, Criteo API, Google Analytics, Klaviyo and Shopify — collects, uses and protects data.
3.1 What data we process
Our applications access, on behalf of our business clients and with their explicit authorization, advertising and commerce performance data: campaign and ad statistics (spend, impressions, clicks, conversions), ad creative assets, web analytics, email marketing metrics and order data. Our applications operate strictly within the scope of the permissions each client has granted on the respective platform, and any action on a client's accounts is performed only on behalf of, and as authorized by, that client.
We do not collect, request or process personal data of end users of Meta products (such as profile information of people who see or interact with ads). Performance data we access is aggregated at campaign, ad or day level.
Like most online services, our systems automatically record limited technical information when our applications are used: server logs (timestamps, IP addresses, request metadata), browser and device information, and usage information. We use this information solely for security, troubleshooting and service operation, and retain it only as long as needed for those purposes.
3.2 How we obtain access
Access is always granted by our clients: through Business Manager partnership grants, manager-account links, or explicit API consent flows on each platform. Clients can revoke this access at any time from the respective platform, which immediately terminates our ability to read their data.
3.3 How we use the data
Data is used exclusively to provide our services to the client that owns it: analytics, performance reporting, business intelligence and marketing recommendations. We do not sell data, we do not share one client's data with another client or any third party, and we do not use client data for advertising of our own.
3.4 Where the data is stored and how it is protected
Data is stored in the European Union on managed cloud infrastructure (PostgreSQL databases and cloud storage) with encryption in transit and at rest. Access is limited to authorized Sirion personnel through role-based, least-privilege credentials; API secrets are stored in a dedicated secret manager and are never embedded in code or documents. Each client's data is logically segregated.
3.5 Retention and deletion
We retain data for as long as needed to provide the service to the client. Upon termination of a client relationship, or upon written request from the client, we delete the client's data from our systems within 30 days. To request deletion, contact us at the addresses in section 1.
4. Who receives the data
We do not sell personal data. Inside Sirion, only the people who need it for the purposes above can access it. To run the website and handle your requests we rely on service providers that act on our behalf and only on our instructions:
- Cloudflare, Inc. — hosting of the website and of the forms that receive demo requests and applications;
- Resend — delivery of the emails that carry demo requests and applications to our team, and of our emails to candidates;
- Google (Google Workspace) — our company mailbox, where those emails are received and kept;
- Google (Google Cloud) — the cloud infrastructure, in the European Union, where we store and evaluate applications;
- Anthropic — the AI models our hiring agent uses to evaluate applications;
- Granola — AI note-taking during our calls with candidates.
We may also disclose data where required by law or by an order of a public authority.
5. Transfers outside the European Union
Some of the providers listed in section 4 are based in the United States or may process data outside the European Economic Area. Where this happens, the transfer is covered by appropriate safeguards under Chapter V of the GDPR, such as the European Commission's Standard Contractual Clauses. You can ask us for more information on these safeguards at the addresses in section 1.
6. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify data that is inaccurate or incomplete;
- erase your data, where there is no longer a reason to keep it;
- restrict processing in the cases provided by law;
- receive your data in a portable format (portability);
- object at any time to processing based on our legitimate interest.
To exercise these rights, write to [email protected] or to [email protected]. We answer within one month. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the EU country where you live or work.
Where our platform processes personal data on behalf of a client, requests concerning that data should be sent to the client; we will help the client answer them.
7. Changes to this policy
We may update this policy from time to time; the current version is always available at this address with the date of the last revision at the top.
