Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Last updated: 12 October 2026
1. Data Controller
The controller of personal data collected through the website www.rare-consulting.net is:
Rare Consulting LLC
Third Floor, Renaissance Building, Abbas Al Akkad Axis
First Settlement, New Cairo — Egypt
Commercial Registration No.: 264816
Tax Registration No.: 774-736-577
Email address for data protection matters: privacy@rare-consulting.net
2. Representative in the European Union
Rare Consulting LLC is established outside the European Union. As the website is also directed at users located within the Union, the processing falls within the scope of the Regulation pursuant to Article 3(2) GDPR.
In accordance with Article 27 GDPR, the Controller has designated the following representative in the European Union:
Aegeron S.r.l.
Via Alessandro Farnese, 26 — 00192 Rome (RM), Italy
Share capital € 30,000.00 fully paid-up
Tax code and VAT number 18361441001 — REA RM-1780159
Email: info@aegeron.com
Data subjects and supervisory authorities may contact the representative, as an alternative to the Controller, on any matter relating to the processing of personal data. Data subjects remain free to contact the Controller directly at privacy@rare-consulting.net.
3. Data Protection Officer
The Controller has not appointed a Data Protection Officer, as the conditions set out in Article 37 GDPR do not apply. Any request concerning data protection may be sent to privacy@rare-consulting.net.
4. Categories of data processed
4.1 Browsing data
The information systems and software procedures underlying the operation of this website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols. This information is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category includes IP addresses, browser and operating system types, the date and time of the request, the addresses of the resources requested, and other parameters relating to the user’s operating system and computing environment.
4.2 Data provided voluntarily by the user
Contact and information requests. Through the forms available on the website, users may transmit their name, surname, email address, telephone number, company name and the free content of their message.
Job applications and submission of curricula vitae. Through the careers section, users may transmit personal and contact details, information concerning their education and professional background, and any other data contained in the attached curriculum vitae. Applications are received and managed at career@rare-consulting.net, which applicants may also use to request early deletion of their application.
Applicants are asked not to include in their curriculum vitae any data belonging to the special categories referred to in Article 9 GDPR — such as information relating to health, religious or philosophical beliefs, political opinions, trade union membership or sexual orientation — unless strictly necessary for the assessment of the application. Where such data is nonetheless present, the Controller will process it solely within the limits of Article 9(2)(b) GDPR, for the purpose of fulfilling obligations in the field of employment law.
4.3 Cookies and similar technologies
For information on cookies and tracking tools, please refer to the Cookie Policy, which forms an integral part of this notice.
5. Purposes of processing and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to contact requests and requests for commercial information | Performance of pre-contractual measures taken at the data subject’s request, Art. 6(1)(b) GDPR |
| Assessment of job applications and management of selection processes | Performance of pre-contractual measures, Art. 6(1)(b) GDPR; for any special categories of data, Art. 9(2)(b) GDPR |
| Management of contractual relationships with clients and suppliers | Performance of a contract, Art. 6(1)(b) GDPR |
| Ensuring the security, integrity and correct functioning of the website, and preventing abuse and fraudulent activity | Legitimate interest of the Controller, Art. 6(1)(f) GDPR |
| Installation of cookies and tools that are not strictly necessary | Consent of the data subject, Art. 6(1)(a) GDPR |
| Compliance with legal obligations and defence of legal claims | Legal obligation, Art. 6(1)(c) GDPR; legitimate interest, Art. 6(1)(f) GDPR |
6. Nature of the provision of data
The provision of browsing data is necessary for the technical operation of the website.
The provision of data requested through the contact and application forms is optional, but failure to provide the data marked as mandatory makes it impossible to respond to the request or to assess the application.
Consent to the installation of cookies that are not strictly necessary is freely given and may be withdrawn at any time, with no consequence for the ability to access the content of the website.
7. Methods of processing
Data is processed using electronic tools and organisational and logical methods strictly related to the purposes indicated. The Controller adopts technical and organisational measures appropriate to ensure a level of security suited to the risk, pursuant to Article 32 GDPR, including encryption of communications via the HTTPS protocol, restriction of access to authorised personnel, and regular backups.
Data transmitted through the contact forms is forwarded to the Controller’s email addresses and is not stored in the website database.
No automated decision-making or profiling within the meaning of Article 22 GDPR is carried out.
8. Recipients of the data
Personal data may be disclosed to the following parties:
- authorised personnel of the Controller, instructed pursuant to Article 29 GDPR;
- Aruba S.p.A., established in Italy, as processor for hosting and email services; data is stored on servers located within the European Union;
- technology service providers used by the Controller for the operation of the website, appointed as processors where necessary;
- consultants and professionals engaged by the Controller for accounting, tax and legal purposes;
- public authorities, where disclosure is required by law or necessary to establish or defend a legal claim.
An up-to-date list of processors may be requested by writing to privacy@rare-consulting.net.
Data is under no circumstances disseminated or transferred to third parties for marketing purposes.
9. Transfers of data to third countries
The Controller is established in Egypt, a country for which the European Commission has not adopted an adequacy decision pursuant to Article 45 GDPR. Access to data by the Controller’s personnel therefore constitutes a transfer to a third country.
Such transfers take place on the basis of the appropriate safeguards provided for in Article 46 GDPR, and in particular the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, accompanied by the supplementary measures deemed necessary following a transfer impact assessment.
Data subjects may request a copy of the safeguards adopted by writing to privacy@rare-consulting.net.
10. Retention periods
| Category of data | Retention period |
|---|---|
| Browsing data and server logs | 12 months, unless a longer period is required by law or for the investigation of offences |
| Contact requests not followed by a contractual relationship | 24 months from the last contact |
| Data relating to contractual relationships | 10 years from the end of the relationship, in view of civil and tax obligations |
| Curricula vitae and application data | 24 months from receipt, unless withdrawn earlier by the data subject |
| Cookies and similar tools | according to the durations set out in the Cookie Policy |
At the end of the periods indicated, data is deleted or irreversibly anonymised.
11. Rights of the data subject
Data subjects have the right to obtain from the Controller, in the cases and within the limits provided for by the Regulation:
- access to their personal data and to the information referred to in Article 15 GDPR;
- rectification of inaccurate data and completion of incomplete data (Art. 16);
- erasure of data (Art. 17);
- restriction of processing (Art. 18);
- portability of the data provided, in a structured, machine-readable format (Art. 20);
- objection to processing based on the Controller’s legitimate interest (Art. 21);
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).
Requests should be addressed to privacy@rare-consulting.net. The Controller will respond without undue delay and in any event within one month of receipt, a period which may be extended by a further two months in particularly complex cases, with notice to the data subject.
12. Complaint to a supervisory authority
Data subjects who consider that the processing of their data infringes the Regulation have the right to lodge a complaint with the supervisory authority of the Member State of their habitual residence, place of work, or of the alleged infringement.
For Italy: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it
The right to seek a judicial remedy remains unaffected.
13. Changes to this notice
The Controller reserves the right to amend or update this notice, including as a result of changes to applicable law or to the services offered through the website. Changes are published on this page together with the date of the last update. Users are invited to consult it periodically.