Docebo – Guest Privacy Notice – Sovico

current as of July 2025

Italian version of this policy is available via the following link: https://www.docebo.com/it/guest-privacy-notice-sovico-it

Docebo a Socio Unico S.p.A. (“Docebo“), is committed to protect and secure the personal data of its employees, their family members and other guests (“Guests” or “you“) and pays particular attention to the safe handling of confidential information. The processing of personal data of Guests takes place in compliance with applicable laws, including the rules of the European Regulation (EU) 2016/679 (“GDPR“) and its national implementation. This Privacy Notice is relevant for all Guests who visit Docebo facilities.

Please take the time to read this notice to ensure you fully understand how Docebo collects and uses your personal data and the rights available to you.

1. Who is responsible for my data (who is the data controller)?

Docebo a Socio Unico S.p.A., located at via Parco 47 – 20853 Biassono (MB) – Italy, will be the data controller of your personal data. For any clarification or request around this Privacy Notice you can contact us by using the details provided, or sending an email at privacy-desk@docebo.com.

2. General information on the processing of personal data

The processing of Guest’s personal data is aimed at managing and facilitating your staying at Docebo accommodations. If you fail to provide Docebo certain information when requested, Docebo may not be able to grant access to our premises.

3. Categories of personal data processed

The following personal data will be processed:

1. Identification data and contact information. Such as, name, surname, the date and time of your visit, work e-mail address.
2. CCTV information, as further detailed in Section 10 below.
3. Special categories of personal data (“sensitive data”). Such as those suitable for revealing health information (e.g. injury, disability, psychophysical fitness status to perform certain tasks certified by medical personnel).
4. Other data you may choose to share with Docebo during your staying.

4. Purpose for processing personal information

The processing of Guest’s personal data (including sensitive data) is carried out primarily for managing access to Docebo accommodations, alongside various purposes, including:

1. to respond to inquiries and requests made during your visit;
2. for physical and logical access control (including video surveillance) in order to ensure the safety and security of people and property;
3. to make adjustments or reasonable accommodations, where required by physical or mental health conditions.

The data processing concerns only pertinent information and is limited to what is necessary with respect to the purposes for which it is processed.

5. Legal basis for data processing

• The processing of common personal data (as described in Section 3.1., letters a)-b)) is necessary to pursue the legitimate business interest of Docebo or to comply with legal obligations (e.g. in response to requests by public authorities).

• As a general rule, the processing of sensitive data (as described in Section 3.1., letters d)):
  • is necessary to fulfil the obligations and exercise rights of Docebo or Guest in the field of employment law, social security and social protection law, to the extent permissible under applicable laws;
  • is carried out only if you have provided your consent to the data processing.

6. Data retention

Generally, the personal data processed for the purposes described by this Policy will be kept for 1 year after your last visit on our Docebo facilities.

Docebo might need to retain Guests’ information for a longer period to deal with any legal matters (e.g. collaborate with public authorities on an investigation).

Without prejudice to the foregoing, when Docebo does not have a legitimate business interest to process your data, Docebo will delete or anonymise the data or, where this is not possible, stored securely and isolated from any further processing until deletion is possible.

7. Recipients of personal data

Your personal data might be disclosed only to the following recipients (or categories of recipients) to perform their tasks and duties:

• companies belonging to the Docebo group, in relation to internal administrative purposes and business management;
• judicial authorities and law enforcement agencies, where required by law;
• IT service providers (e.g. Google).

8. Authorised subjects for processing

• The personal data that Docebo collects may be processed by employees of the corporate functions, responsible to pursue the purposes described above, who have been expressly authorised to process them and have received adequate operating instructions and training.

• The personal data of the Guests are also processed with the help of data processors (such as, for example, cloud systems, system administrators, as listed in Section 7) that are obliged to strictly protect the data processed on behalf of Docebo and to process Guests data on a “need to know basis” and in accordance with applicable data protection law.

9. Transfer of personal data to third countries

• Your personal data may be transferred abroad to European and non-European countries, and in particular to the United States, Canada, United Kingdom, for the purposes described above.

• Docebo ensures that the transfer of data to non-European countries will take place in accordance with the applicable legal provisions by: processing your information in a Country which the European Commission has determined provides an adequate level of protection for personal data, or implementing appropriate safeguards to protect your data (including stipulation of the Standard Contractual Clauses provided by the European Commission).

• When Docebo uses cloud services, Docebo ensures that the service providers will be selected from those who provide adequate guarantees and safeguards to protect your data, as required by applicable data protection law.

10. Video surveillance

1. Video surveillance systems have been installed outside the Docebo accomodations for the purposes indicated in Section 4, letter b). The cameras used to control the entrances capture images in real time 24 hours a day. Each recording ends 5 seconds after the last movement detected.
2. The video cameras are clearly visible and placed with the relevant signalling through special signs, so that all Guests are aware of the exact surveillance area.
3. The processing of images acquired by the video surveillance system takes place through a secure cloud storage system provided by a specialised provider which is able to guarantee the security and confidentiality of data collected.
4. The conservation of the images acquired through the cameras will normally be retained for 72 hours, except for images noticing criminal activities, which will be kept for the period strictly necessary to resolve the criminal disputes and settle any litigation. The data is accessible only by authorized personnel as specified in Section 8 of this Policy.
5. The images will in no way be communicated or disclosed to third parties, except from the cases described in this Section. In the case of an offense, or the real danger of its occurrence, the powers that the laws assign for these purposes to the public security and judicial authorities will be respected, which, by way of execution, will be able to view the images.

11. Data Protection Rights

By contacting Docebo via e-mail at: privacy-desk@docebo.com, Guests can:

• ask Docebo for access to data concerning them, their cancellation, the correction of incorrect data, the integration of incomplete data, as well as the limitation of processing;
• object the processing when Docebo has relied on legitimate business interest unless we can either demonstrate compelling legitimate reasons for this processing that override your interests, or where we need to process your information for the establishment, exercise or defense of legal claims.
• receive the data in a structured format, commonly used and readable by an automatic device, as well as, if technically feasible, to transmit it to another entity without impediments (“right to data portability”);withdraw at any time the consent given in relation to the data processing referred to in Section 4, letter c);
• fill a complaint to the competent Data Protection Authority.

Docebo will respond to your requests as soon as practically possible and always within the timeframes set by the applicable data protection law.