Privacy Policy

Within the scope of their activities, Zest Innovation S.r.l. and The Net Value S.r.l. have decided to launch an ecosystem project aimed at fostering collaboration among startups, corporates, PMIs, and institutions in order to develop innovative solutions in the fields of green chemistry, biomaterials, waste management, and agritech.

As part of this project, a selection process is launched for entrepreneurial projects that meet the requirements to apply for “BIOS” (the “Selection”).

Zest Innovation S.r.l. and The Net Value S.r.l., within their respective activities, will be responsible for managing and organizing the Selection. In compliance with the GDPR, Zest Innovation S.r.l. and The Net Value S.r.l. act as independent Data Controllers with regard to the data provided by Users through the application forms and the browsing data identified in this Privacy Policy.

Zest Innovation S.r.l. is wholly owned by Zest S.p.A. and, together with Zest Investments S.r.l., is part of the Zest Group (the “Zest Group”). By accepting this Privacy Policy, the User acknowledges that their personal data may also be disclosed to third parties, always for purposes related to participation in the Selection.

“Personal Data” means any information relating to an identified or identifiable natural person, with particular reference to identifiers such as name, identification number, location data, online identifier, email address, telephone contact, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

“Platform” refers to the platforms managed by F6S and Typeform, accessible at the following links:
https://www.f6s.com/bios2025/apply
https://zestgroup.typeform.com/bios-call25
through which Users may submit their application to participate in the Selection and provide the relevant Personal Data.

“Processor” means the natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Controller.

“Controller(s)” means the natural or legal person, public authority, service, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data and the security measures adopted.

“TNV” means The Net Value S.r.l., with registered office at Viale la Plaia no. 15, Cagliari, 09123, Italy, Tax Code and VAT number 03219010927.

“Zest” means Zest Innovation S.r.l., a limited liability company incorporated under Italian law, with registered office at Corso Giacomo Matteotti 29, 10121 Turin (TO), Italy, registered with the Companies Register of Turin, VAT and Tax Code no. 10766230014.

“User(s)” and/or “Data Subject(s)” means the natural person who visits the Platform and to whom the Personal Data refer, who—unless otherwise specified—coincides with one or more individuals interested in developing their entrepreneurial idea, also through the support of the Controllers and participation in the Selection.

The Controllers collect, through the Platform, the Personal Data of Users who have completed the registration process and intend to apply for the Selection (such as email address, first name, and last name).

The processing may concern the following Personal Data of Users:

a. Data collected through the Platform
The Controllers will have access to the data uploaded directly by the User on the Platform. In this regard, Users are invited to carefully read the privacy policies of the respective platforms before submitting their application to the Selection:
https://www.f6s.com/privacy-policy
https://admin.typeform.com/to/dwk6gt?typeform-source=www.google.com

Such data mainly relate to the professional background of the founders, as well as details concerning the individuals involved in the development of the business idea that Users intend to pursue during participation in the Selection.

b. Data voluntarily provided by the User
The voluntary and explicit sending of emails to the addresses of the Controllers indicated through various channels does not require consent, but entails the acquisition of the sender’s address and data necessary to respond to the request, as well as any other Personal Data included in the communication. Such data are deemed to be voluntarily provided by the User at the time of the request for the service.

By voluntarily providing data, the User expressly accepts this Privacy Policy and consents to the processing of the content transmitted for the purposes inherent to the request.

The processing of Users’ data is carried out for the following purposes and on the following legal bases:

1. Participation in the Selection
Controllers: Zest Innovation S.r.l. and The Net Value S.r.l.
Purpose: to identify and evaluate the data of natural persons who, through their entrepreneurial project, intend to apply for “BIOS”.
Legal basis: performance of a contract and enabling participation in the Selection.

2. Compliance with orders of judicial authorities
Controllers: Zest Innovation S.r.l. and The Net Value S.r.l.
Purpose: compliance with legal obligations.
Legal basis: legal obligation.

3. Data voluntarily provided by the User
Controllers: Zest Innovation S.r.l. and/or The Net Value S.r.l. (depending on the recipient).
Purpose: purposes inherent to the specific request for which the data were provided.
Legal basis: voluntary action of the User.

The provision of Personal Data for the purposes set out in point 1 of this section is necessary to allow the Controllers to assess the applications submitted by Users. Failure to provide such data during registration on the Platform will make it impossible to evaluate the application and, therefore, to allow participation in the Selection.

Within the limits relevant to the purposes of processing, Users’ data may be disclosed to companies of the Zest Group, BIOS partners (including, by way of example and not limitation, ENI, Fondazione di Sardegna, BF Educational, Innois), consulting firms, private companies, third-party technical service providers, hosting providers, IT companies, communication agencies, other external controllers involved in the Selection, and partners in the provision of services.

Where suppliers process Personal Data on behalf of the Controllers, they will be appointed as external Processors pursuant to Article 28 of the GDPR.

The Controllers may share some of the collected data with services located outside the European Union. In particular, this may occur through Google Analytics and other data analysis technologies whose servers are located outside the EU. Such transfers are authorized and regulated pursuant to Article 45(1) of Regulation (EU) 2016/679 and therefore do not require specific authorization.

In accordance with the principle of storage limitation (Article 5 GDPR), the relevance and obsolescence of stored data in relation to the purposes for which they were collected are periodically reviewed.

In particular:
a) data collected for the Selection are processed for the time strictly necessary to achieve the purposes for which they were collected;
b) data voluntarily provided by the User are retained for no longer than necessary to achieve the purposes for which they are processed or as required by applicable law.

In the absence of the formalization of a contractual relationship between the parties, data will be anonymized after 6 months and retained exclusively for purposes related to monitoring the proposed activities compared to those carried out.

The Data Subject has the right to request from each Controller at any time:

• access to their Personal Data;

• rectification;

• erasure;

• restriction of processing;

• objection to processing;

• data portability;

• withdrawal of consent, where applicable;

• the right to lodge a complaint with a supervisory authority (Italian Data Protection Authority – Garante per la Protezione dei Dati Personali).

Such requests may be submitted by sending an email to: privacy@zestgroup.vc

The Personal Data provided by Users will be processed in compliance with the applicable legislation and confidentiality obligations. Data will be processed using electronic tools, paper-based media, and any other suitable means, in accordance with appropriate security measures pursuant to Article 5(1)(f) of the GDPR. Paper copies that are no longer necessary will be destroyed using a shredder.

This Privacy Policy may be subject to changes due to the introduction of new regulations. In such cases, the Controllers will promptly inform Users. Users are therefore invited to periodically review this Privacy Policy to remain informed.