Privacy
Policy

Introduction

MVRK ("we", "us" or "our") is the trading name of Matteo Muscio, a sole trader based in Italy. We are committed to protecting your privacy and ensuring the security of your personal data.

We process personal data under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).

This policy covers our search work and this website, including the private briefings we prepare for invited candidates.

Who We Are

The data controller is Matteo Muscio, trading as MVRK, a sole trader (ditta individuale) in Italy. MVRK provides HR executive search for mid-to-senior HR roles across Europe, with selected searches in the Gulf.

P.IVA 05199930230

Business address: Piazza Renato Simoni 34, 37122 Verona (VR), Italy

For any privacy matter, email privacy@mvrk.xyz.

Data We Collect

• Contact details such as name, email, phone number, and LinkedIn profile.
• CVs, professional background, salary expectations, and recruitment process feedback.
• Client-side hiring needs, job descriptions, and engagement details.
• Contact form: your name, email address, LinkedIn URL if you add one, the reason for your enquiry and your message. The form also sends the page it was opened from and, if you opened it from a live-search listing, that role. A hidden field catches spam bots. Messages reach our Google Workspace inbox through Resend. To protect the form from abuse, we hold your IP address in server memory for up to one hour after a message is sent, then discard it. The form does not write it to any log or include it in the email.
• Hosting data: Vercel, which hosts this website, processes your IP address, your browser's user agent and the address of each page you request, to deliver the site and keep it secure.
• Analytics and performance data: aggregated page views, two events and page-speed measurements from Vercel Web Analytics and Vercel Speed Insights. See Cookies and Analytics.
• Private briefings: one strictly necessary cookie, and your IP address for 60 seconds after each sign-in attempt. See Cookies and Analytics.

Cookies and Analytics

Our public pages set no cookies and store nothing on your device. We use two measurement tools from Vercel, and private briefings use one cookie and your browser's session storage.

Vercel Web Analytics. We use it to see which pages are useful and which channels bring enquiries. It sets no cookies and uses no local storage or other storage on your device. Vercel counts visitors with a hash of the incoming request that changes every day, and discards the visitor session after 24 hours, so you are not recognised from one day to the next. We see aggregated figures only: the page path, the referring website's hostname, country, device type, browser and operating system. Query strings are removed from page addresses, except the campaign tags utm_source, utm_medium and utm_campaign. Anything after a # is removed too.

We also count four events. When the contact form is sent, we record the enquiry category and whether the form was opened from a live-search listing, never your message or contact details. When a visit arrives from a campaign link, we record its source and medium only. When you click a link to the contact page or our email address, we record whether it was for clients, candidates or general, and whether it sat in the header, the footer or the page. On articles, we record how far you scrolled, in steps of a quarter.

Vercel Speed Insights. It measures Core Web Vitals: how fast a page loads, how quickly it responds and how stable its layout is. Each measurement comes with the page path (without the query string), device type and country. It sets no cookies and stores nothing on your device.

Where they run. Neither tool runs on private briefing pages, and neither sends anything from a page you open by following a link from a briefing. If your browser sends a Global Privacy Control or Do Not Track signal, neither tool sends anything from your visit.

Why we do not ask for consent. Article 122 of the Italian Privacy Code requires consent before information is stored on your device or read from it, unless this is strictly necessary. The scripts ask your browser to send the page address and device details, which Article 122 can cover. The Garante's 2021 cookie guidelines (section 7.2) treat analytics tools like technical tools, which need no consent, when they give the site aggregated statistics only and cannot be used to single you out. We rely on that position: the tools set no cookies, store nothing on your device, do not read anything stored there to recognise you, count visits with a hash that changes every day, and give us aggregated statistics only. Our legal basis is our legitimate interest (Article 6(1)(f) GDPR), and you can object at any time (see Your Right to Object).

Private briefing cookie. If you have been given access to a password-protected briefing, we set one cookie for that briefing. Its name is mvrk_ followed by the briefing's name. It is strictly necessary to keep you signed in to the briefing you asked to see, so it does not need consent. It is HttpOnly, SameSite=Strict and Secure, and is sent only to that briefing's pages. It holds a signed token with an access role, a code that changes whenever the briefing's password changes and the time you signed in, and nothing that identifies you. It is a session cookie, so your browser deletes it when you close it, and we stop accepting the token 12 hours after you sign in. Where a briefing has a Lock button, using it deletes the cookie straight away.

Briefing sign-in. To limit password guessing, we hold your IP address in server memory for 60 seconds after each sign-in attempt. Nothing is stored on your device for this.

Session storage on briefings. Briefing pages use your browser's session storage for display state only, such as which section had focus or whether a carousel is paused. It holds no personal data and is cleared when you close the tab.

Images and video on briefings. Briefing images are served from our own domain, except on one briefing, where most images, including the one on its sign-in card, load from the company's own website. Your browser then sends that website your IP address and browser details, but not the address of the page. One briefing includes a company video. Nothing loads from YouTube until you press play. When you do, the video loads from youtube-nocookie.com, which Google runs, and Google may store information on your device and use your data under its own privacy policy.

How We Use Your Data

• Identifying and introducing candidates to hiring companies.
• Managing recruitment processes and keeping search records for future work.
• Answering enquiries sent through the contact form.
• Giving invited candidates access to private briefings.
• Delivering and securing this website, and protecting the contact form and briefing sign-in from abuse.
• Understanding which pages are useful, which channels bring enquiries and how fast the site is.
• Improving our services and fulfilling legal or regulatory obligations.

Legal Basis

• Recruitment and search services: legitimate interest (Article 6(1)(f) GDPR).
• Client engagements: contractual necessity (Article 6(1)(b) GDPR).
• Contact-form enquiries about our services: steps you ask us to take before a possible engagement (Article 6(1)(b) GDPR). Other enquiries: our legitimate interest in replying (Article 6(1)(f) GDPR).
• Hosting, security and the limits on the contact form and briefing sign-in: legitimate interest in keeping the site available and secure (Article 6(1)(f) GDPR).
• Vercel Web Analytics and Speed Insights: legitimate interest in knowing which pages are useful, which channels bring enquiries and how well the site performs (Article 6(1)(f) GDPR).
• Private briefing access: legitimate interest in showing each briefing only to the people we invited (Article 6(1)(f) GDPR).
• Briefing videos: your consent, given when you press play (Article 6(1)(a) GDPR).
• Consent where otherwise required (Article 6(1)(a) GDPR).
• Legal obligation where applicable (Article 6(1)(c) GDPR).

Data Sharing and Transfers

We share personal data only when necessary with clients, referees, and regulatory authorities where legally required. We do not sell personal data.

We use these service providers to run this website and our email. Where data goes to the United States, the safeguard for each provider is listed with it.

• Vercel Inc. (United States): website hosting, Vercel Web Analytics and Vercel Speed Insights. Vercel is certified under the EU–US Data Privacy Framework and its UK Extension, and its data processing addendum includes the European Commission's Standard Contractual Clauses.
• Resend (Plus Five Five, Inc., United States): delivery of contact-form messages to our inbox. Resend is certified under the EU–US Data Privacy Framework and its UK Extension, and its data processing addendum includes the Standard Contractual Clauses.
• Google Workspace (Google Cloud Italy S.r.l.): business email, including the inbox that receives contact-form messages. Where Google LLC processes the data in the United States, the transfer is covered by Google LLC's certification under the EU–US Data Privacy Framework, with the Standard Contractual Clauses in Google's data processing terms as a fallback.
• Google (YouTube): only if you press play on a briefing video. Google then acts as a separate controller under its own privacy policy.

Retention

• Candidates: up to 24 months after last engagement unless deletion is requested.
• Clients: duration of relationship plus six years for compliance.
• Contact-form enquiries: as long as we need them to deal with your enquiry. If it does not lead to an engagement, we delete it within 24 months. If it does, the candidate or client period applies.
• Copies of contact-form messages held by Resend: 30 days, under Resend's own retention rules.
• Your IP address in server memory: up to one hour after a contact-form message, and 60 seconds after a briefing sign-in attempt.
• Briefing cookie: until you close your browser, or until you lock the briefing where it has a Lock button. The token inside it expires after 12 hours at most.
• Analytics: Vercel discards the daily visitor hash after 24 hours. We keep the aggregated reports.
• Hosting logs: the logs we can access are kept for about one day. Vercel may keep security logs for longer under its privacy notice.

Your Rights

• Access, rectification, erasure, restriction, objection, and portability rights under the GDPR, and the right to withdraw consent at any time. Your right to object is set out in the next section.
• To exercise these rights, email privacy@mvrk.xyz.
• You can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it). If you live in the UK, you may also contact the Information Commissioner's Office (ico.org.uk).

Your Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data that we base on legitimate interest (Article 6(1)(f) GDPR). This covers our recruitment and search work, hosting and security, and Vercel Web Analytics and Speed Insights. If you object, we will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

To object, email privacy@mvrk.xyz. For analytics and performance measurement you can also turn on Global Privacy Control in your browser. This site honours it automatically: while the signal is on, no Web Analytics or Speed Insights data is sent from your visits.

Contact

Controller: Matteo Muscio, trading as MVRK
P.IVA 05199930230
Piazza Renato Simoni 34, 37122 Verona (VR), Italy
Email: privacy@mvrk.xyz
Website: www.mvrk.xyz