INFORMATION ABOUT THE PROCESSING OF PERSONAL DATA
According to Article 12 et seq. of the EU General Data Protection Regulation 2016/679 (“GDPR” or “Regulation”), and in general in accordance with the principle of transparency foreseen in the same Regulation, we provide the following information regarding the processing of personal data (i.e. every information concerning an identified or identifiable natural person: the interested party).
1. DATA CONTROLLER
The data controller (i.e. the person who determines the purpose and means of processing of personal data) is Famatec S.p.A., based in Via dell’Industria, 15 – Frazione Mollaro (TN), VAT registration number 01219170220, tel. +39 0463 461911.
For contacts specifically relating to the protection of personal data, including the exercise of the rights referred to in the following paragraph 8, we indicate in particular the e-mail address: firstname.lastname@example.org to which you may address any requests.
2. PURPOSE OF PROCESSING
The processing of personal data is carried out in the context of the selection process aimed at identifying the people to be included in the staff of the data controller and the evaluation that they are in line with the requirements of the same, to proceed then to the potential conclusion of the employment contract.
3. TYPES OF PROCESSED DATA
The following data categories may be processed for the requirements related to the evaluation and staff selection process:
– Personal and general data, address and other contact details, tax code, education, specialisations, work experience and any other necessary information in relation to the evaluation and staff selection process (curriculum vitae, presentation letter);
– (only if necessary) any data capable of detecting the health status, collected in connection with the belonging to protected categories or the ability to carry out certain tasks. It is recommended in this regard to communicate in the curriculum vitae only the information relevant to the selection purpose; please restrict your health information to what is strictly necessary to communicate to the potential employer the belonging to protected categories.
4. LEGAL BASIS FOR PROCESSING AND POTENTIAL TRANSFER OBLIGATION
Although there is no obligation to communicate the data, the failure to communicate them will result in the impossibility to participate to the staff selection process carried out by the data controller.
The legal basis of the data processing lies in the fact that it is necessary to enable the pre-contractual measures in the context of the selection procedure in which the interested party has participated or which he/she has promoted with the spontaneous submission of the curriculum vitae.
In the case of data falling within the special categories of personal data referred to in Art. 9 of the Regulation, the express consent of the interested party shall be necessary before the establishment of the employment relationship.
5. PROCESSING MODALITIES AND DURATION
The processing will be carried out: through the use of manual and automated systems; by entities or categories of authorized people in order to fulfil their duties, in compliance with the law; with the use of appropriate measures to ensure the confidentiality of data and to avoid access to them by unauthorised third parties.
There are no automated decision processes.
The retention of the data following the termination of the evaluation and staff selection process will take place for a period not exceeding that required to fulfil the obligations or tasks referred to in point 2, and in any case to pursue the specific purposes indicated therein, with cancellation of the data attributable to the specific purposes that are no longer pursued. Normally, unless the procedure does not end with the hiring, the data are cancelled within 6 months.
6. DATA COMMUNICATION
Without prejudice to the communications carried out in fulfilment of statutory and contractual obligations, all data collected and processed may be communicated, exclusively for the purposes specified above, to external consultants who work for the data controller in the context of the evaluation and staff selection process. Personal data is not subject to dissemination.
7. LOCATION OF DATA PROCESSING
The processing activity is carried out on the territory of the European Union and there is no intention of transferring personal data to a country not belonging to the European Union or to an international organisation.
8. RIGHTS OF THE INTERESTED PARTY
In relation to the above, the GDPR confers the person concerned the exercise of the following rights with regard to his/her personal data (the summary description is indicative, for the complete enunciation of the rights, please refer to the Regulation, and in particular to Articles 15-22):
– Right to access to personal data (Art. 15): It tells whether a processing of personal data is in progress or not; if it is in progress, the person concerned has the right to obtain, inter alia, the access to such data and information regarding the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the data has been or will be communicated.
– Right to rectification of personal data (Art. 16): (i) Correction of inaccurate personal data of the interested party without undue delay and (ii) integration of personal data, if they are incomplete.
– Right to erasure («right to be forgotten») (Art. 17): Cancellation of personal data concerning the interested party without undue delay (the data controller is obliged to cancel the personal data without undue delay in the cases provided for in Art. 17 of the Regulation).
– Right to restrict processing (Art. 18): In certain cases – objecting the accuracy of the data, during the time required for verification; objecting the lawfulness of processing with opposition to the erasure; need of using the data for the rights of defence of the interested party, while they are no longer useful for the processing; if there is objection to the processing, while the necessary verifications are carried out – the data will be stored in such a way in order to be able to be restored, but, in the meantime, they are not available to the controller except in relation to the validity of his/her restriction request or with the consent of the person concerned or for the assessment, exercise or defence of a right before the courts or to protect the rights of other natural or legal persons or for reasons of relevant public interest of the Union or of a Member State.
– Right to data portability (Art. 20): If the processing is based on consent or on a contract and is carried out by automated means, on request, the interested party will receive his/her personal data in a structured format, in common use and readable by an automatic device and he/she may transmit them to another controller, unimpeded by the controller which has provided them and, if technically feasible, he/she can obtain that such transmission is made directly by the latter.
– Right to object to processing (Art. 21): Opposition in whole or in part to the processing carried out on the basis of legitimate interest, for reasons related to the particular situation of the person concerned.
– Should the processing be carried out by virtue of the consent expressed by the person concerned, then for the processing activities covered by this information with regard to the special categories of personal data and, where applicable, the consent to the processing for periods exceeding six months, the interested party can withdraw the consent at any time without prejudice to the lawfulness of the processing which took place before the withdrawal of the consent.
– The person concerned has also the right to complain to the supervisory authority (Garante per la Protezione dei dati personali) if he/she considers that the processing concerned infringes the requirements of the Regulation; the supervisory authorithy is contactable through the contact details indicated on the site of Authority www.garanteprivacy.it .
In any case, we would like to have the opportunity to address in advance any doubts of the interested parties, who can contact the e-mail address email@example.com or other contact details of the controller indicated above for any clarification concerning the processing of their personal data and for the exercise of their rights, including the withdrawal of the consent.