Data protection notice for job applicants (O_IS_IT)

Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of personal data (GDPR) for job applicants

 

Dear Data Subject,

This notice is provided in relation to the processing of personal data as set out in Articles 13 and 14 of the GDPR.

1. Data Controller

For the purposes of this Notice, the data controller is Technoform Bautec Italia S.p.A., with registered office in Lainate (MI), Via Settembrini, 80, registered with the Companies Register of Milan under no. 184951/1998 - REA no. 1562624, Tax Code 02264970126 – VAT No. 12483790155 (the “Controller”). 

2. Data collected

Within the scope of the recruitment and selection process, the Controller may process the following categories of personal data (pursuant to Art. 4(1) GDPR):

a) Personal data

  • Personal and identification data: first and last name, date and place of birth, nationality, tax code, current occupation/professional qualification, if any;
  • Contact data: address of residence or domicile, e-mail address, telephone number and similar data;
  • Curriculum data: information relating to educational background, academic qualifications, professional qualifications, language and IT skills, previous work experience and activities carried out.

b) Special categories of personal data

  • any data concerning health or membership of protected categories, solely to the extent that their collection is strictly necessary and relevant for the purpose of assessing fitness for work or establishing an employment relationship.

Applicants are asked not to include in their curriculum vitae or in the documentation submitted any special categories of personal data (such as, by way of example, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation or irrelevant health data) that are not strictly necessary in relation to the position applied for. Any excessive or irrelevant data will not be used and will be immediately erased or destroyed.

3. Purposes and legal basis of processing in accordance with Regulation (EU) 679/2016

3.1 Performance of pre-contractual measures (Art. 6(1)(b) GDPR)

Personal data are processed in order to manage the applicant assessment and selection process — whether the application is submitted in response to a specific job advertisement or on an unsolicited basis — with a view to the possible establishment of an employment or collaboration relationship (including the assessment of the professional profile, the conduct of interviews and the collection of the information necessary to draw up a job offer and enter into the related contract).

3.2 Compliance with legal and employment law obligations (Art. 6(1)(c) and Art. 9(2)(b) GDPR)

Processing is also carried out in order to comply with obligations laid down by laws, regulations or EU legislation, as well as by provisions issued by authorities entitled to do so and by supervisory and control bodies, in connection with the selection process and the possible start of employment. Where the application involves the processing of special categories of personal data (e.g. membership of protected categories), the legal basis is Art. 9(2)(b) GDPR (carrying out the obligations and exercising specific rights of the Controller or of the Data Subject in the field of employment and social security and social protection law).

3.3 Legitimate interest of the Controller (Art. 6(1)(f) GDPR)

The Data may be disclosed to companies belonging to the Technoform group for internal administrative purposes connected with the coordinated management of recruitment and selection processes, on the basis of the Controller’s legitimate interest.

4. Processing methods

Personal data are processed using paper-based, IT, telematic or automated tools, according to logic strictly related to the purposes indicated above, by entering them into the relevant company databases dedicated to applicants.

 The data may be accessed exclusively by persons expressly appointed by the Controller as data processors (Art. 28 GDPR), whose respective names are available upon request to the Controller, or as persons authorised to process data (Art. 29 GDPR), who may carry out collection, consultation, use, processing, comparison and any other appropriate operation, in full compliance with the appropriate technical and organisational measures pursuant to Art. 32 GDPR to ensure the confidentiality, integrity and availability of the data, as well as their accuracy, up-to-dateness and relevance with respect to the stated purposes.

The Controller does not take decisions based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.

5. Disclosure (recipients) of the Data

Within the scope of the purposes indicated above, your personal data may be made accessible or disclosed to third parties, including abroad, only where necessary for the purposes set out in this Notice.

The third-party recipients of the Data belong to the following categories: 

  1. offices, corporate functions and internal staff of the Controller expressly authorised to process the data;
  2. consultancy firms, recruitment and executive search companies or employment agencies assisting the Controller in the selection process;
  3. IT, technology and storage service companies and providers (including electronic data processing, software management, recruiting platforms, cloud services and information systems maintenance);
  4. the occupational physician, where a pre-employment medical examination is required under health and safety at work legislation (Legislative Decree 81/2008);
  5. companies belonging to the Technoform group.

External parties processing the data on behalf of the Controller are specifically appointed as data processors pursuant to Art. 28 GDPR or act as independent data controllers.

6. Nature of the provision of data and consequences of failure to provide them

Providing personal data for the purposes referred to in Section 3 is necessary in order to take pre-contractual steps at your request and to comply with the related legal obligations. Therefore, any refusal to provide, in whole or in part, the data requested will make it impossible for the Controller to assess your application and to consider your profile in its personnel selection procedures.

7. Data transfer

The Controller informs you that it does not transfer, nor intends to transfer, your personal data to third countries outside the European Union (EU) or the European Economic Area (EEA).

8. Data retention period 

For the purposes referred to in points 3.1 and 3.2, personal data will be retained for a maximum period of 12 months from their collection. If no employment relationship has been established by the end of that period, the data will be erased. If the selection is successful and the applicant is hired, personal data will be retained and processed in accordance with the time limits laid down by the legislation applicable to the employment relationship and as set out in the specific notice for employees that will be provided upon hiring. 

9. Source of the personal data 

The personal data processed are collected:

  • Directly from the Data Subject, through the unsolicited submission of a curriculum vitae or in response to specific job advertisements; or
  • From third parties or accessible sources, such as universities, vocational training institutes, authorised employment agencies or online platforms and professional social networks dedicated to matching job supply and demand. For further information on the specific source of the data (pursuant to Art. 14(2)(f) GDPR), the Data Subject may contact the Controller at any time at the contact details indicated in Section 11.

10. Rights of the data subject pursuant to Chapter III of Regulation (EU) 2016/679

The persons to whom the Data relate have the right, at any time, to: (I) obtain confirmation of the existence or otherwise of personal data concerning them; (II) know the purposes of the processing and the methods, the recipients of such Data, and the retention period; (III) obtain rectification or erasure, and, where applicable, restriction of processing; (IV) object to the processing; (V) where applicable, receive, in a structured, commonly used and machine-readable format, the Data concerning them provided to the Controller, and transmit such data to another data controller without hindrance from the Controller; (VI) lodge a complaint with the Italian Supervisory Authority. 

You may contact Technoform Bautec Italia SpA to exercise the rights listed above, by writing to the e-mail address: privacy [dot] oisit [at] technoform [dot] com (privacy[dot]oisit[at]technoform[dot]com). 

You may always apply to the Italian Supervisory Authority for the protection of your rights pursuant to Art. 77 GDPR.

11. Privacy Contact Person and persons who may become aware of personal data

The Privacy Contact Persons are Adalberto Banfi and Raffaella Galli, domiciled for this purpose at the Company. In any case, the updated list of the Data Processors is available to you at the registered office of the Company, the Data Controller.

Consistent with the purposes indicated above, personal data may become known to Company personnel in charge of the related administrative and IT management, and to personnel entrusted with activities involving the processing of your data for one of the purposes set out in this notice.