PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
ART. 13 OF EU REGULATION 2016/679 (“GDPR”)
Artea.com, as Data Controller (“Data Controller”), with registered office at Via Bandello 5, Milan, hereby informs you that the personal data of candidates (“Data Subjects”), received on different occasions (such as, for example, the spontaneous submission of a CV or following a recruitment/selection process), or collected directly from databases held by other data controllers, are processed in compliance with the principles of lawfulness, fairness, transparency, adequacy, relevance and necessity established by the GDPR.
This notice (“Privacy Notice”) provides the necessary information on how the Data Controller collects, protects and safeguards the personal data of Data Subjects, as well as on their rights in relation to the personal data provided.
1. Purposes, nature of the provision of data and legal basis for processing
The personal data of the Data Subject collected in one of the circumstances indicated in the previous paragraph are processed by the Data Controller for the following purposes:
- to review the profile of a Data Subject who has submitted an application on their own initiative;
- to assess the Data Subject for the possible establishment of an employment relationship for which a selection process is underway;
- to offer a job position to the selected Data Subject.
The provision of data necessary for the implementation of pre-contractual measures is mandatory for the possible execution of an employment contract. Consequently, if the Data Subject refuses to provide their data, the Data Controller will be unable to assess whether the candidate’s professional profile is consistent with the position to be filled within the company.
- to offer the candidate additional job opportunities, including in the future, other than the position for which they initially applied.
The legal bases for processing are:
- the implementation of pre-contractual measures aimed at the possible conclusion of an employment contract to which the Data Subject is a party;
- and/or the performance of the above-mentioned contract following its execution;
- the legitimate interest of the Data Controller.
2. Types of data processed
The processing concerns the personal data contained in the Data Subject’s Curriculum Vitae. However, the Data Controller may also request additional information from the Data Subject, such as information relating to their professional classification, current contractual level and current remuneration.
During the personnel selection phase, the Data Controller does not generally need to collect data belonging to special categories of personal data (also referred to as “sensitive” data, such as health-related data or biometric and/or genetic data).
The Data Controller may request information such as that referred to above only where necessary for the specific assessment of the candidate’s profile (for example, membership of a protected category).
3. Transfer of data to a third country and/or an international organisation and safeguards
Personal data will not be transferred abroad on the initiative of the Data Controller, either within or outside the European Union.
However, certain third-party service providers may have their servers physically located abroad, as may be the case, for example, with server providers. In such circumstances, any transfer of data abroad will take place exclusively within the framework of, and in compliance with, applicable legislation.
4. Methods of data processing and retention period
The data provided by the Data Subject for the purposes indicated above will be processed both by automated and manual means, using methods and tools designed to ensure the highest level of security and confidentiality, by specifically authorised personnel.
The personal data collected will be stored in a form that allows the identification of the Data Subject for no longer than is necessary to achieve the purposes for which the data were collected and processed.
Where no immediate job offer is made, but the candidate’s profile is considered potentially suitable for other positions that the Data Controller may offer at a later date, the data may be retained in a protected archive for a limited period of time, in any case not exceeding 24 months.
At the end of the retention period, the data will be deleted from the Data Controller’s systems and document archives, unless applicable laws or other regulations to which the Data Controller may be subject require retention for longer periods.
5. Communication and disclosure of data
Artea.com does not communicate the data collected to other parties unless they are data controllers or have been appointed as data processors.
The data may also be communicated to specifically identified employees of the Data Controller who have been authorised by the Data Controller to process such data for purposes strictly necessary to achieve the purposes described above.
The data collected will not be publicly disclosed.
6. Rights of the Data Subject
The Data Subject may exercise against the Data Controller all rights provided for under Articles 15 et seq. of the GDPR by contacting Artea.com directly at the address indicated above or by writing to the following email address: info@artea.com.
More specifically, the Data Subject may exercise, at any time, the right of access to their personal data, the right to rectification, erasure, the “right to be forgotten”, restriction of processing, data portability, and the right to object at any time to the processing of personal data concerning them.
Pursuant to Article 77 of the Regulation, the Data Subject has the right to lodge a complaint with a supervisory authority if they believe that the processing of personal data infringes the provisions of the GDPR, without prejudice to any other administrative or judicial remedy.