Information note on data processing for the selection of personnel and trainees in accordance with the EU Regulation 2016/679 “General Data Protection Regulation - (GDPR)”
Foreword
Pursuant to the current national legislation on the protection of personal data and art. 13 of the EU Regulation 2016/679 (hereinafter GDPR), containing provisions for the protection of natural persons with reference to personal data processing, the Data Controller is required to provide the Data Subject with information regarding the use of the personal data collected from the Data Subject.
The personal data you provided are subject to paper and/or automated processing for the sole purpose of search and selection of personnel and/or activation of traineeships.
Data are collected from the Data Subject through spontaneous sending to the Data Controller; the data are organized in the form of a CV by registering it on the Calearo Antenne S.p.A. website.
The sending of your CV to our company may be:
A. a spontaneous application
B. a response to specific advertisements for recruitment and selection of personnel and/or trainees.
We ask you not to include data that are not relevant to the job search / offer in your CV.
In particular Calearo Antenne S.p.A. (hereinafter also DATA CONTROLLER) in the performance of its activities/functions needs to process personal data of individuals who apply as employees and/or trainees (hereinfater also "Data Subjects" or “Data Subject”) and acts as Data Controller. The personal data of the Data Subject and, if necessary, of third parties – for which you’ll have already obtained the consent – you have provided during the recruitment and selection process are processed in compliance with the applicable laws, with fairness, lawfulness and transparency, protecting your rights and the confidentiality of the personal data provided.
1. Data Controller
The Data Controller is Calearo Antenne SpA, based in via Bacchiglione, 49, Isola Vicentina 36033 VICENZA (ITALY), TAX CODE AND VAT N. 05059470962, +39.0444.901311, fax. +39.0444.901375 e-mail: privacy@calearo.com.
2. Type of data processed
The Data Controller processes the “common” personal data you provided, namely:
- personal data (surname and first name, address, date of birth, …), contact data (telephone number, email address, ...)
- codes from third parties (tax code, i.d. number, driving licence, ...)
- information relating to previous occupations, training courses and certificates obtained, skills acquired, aptitudes, etc.
The Data Controller acquires any variations of such data, that you will communicate as soon as they occur, and, where appropriate, you may request an update of your CV.
The Data Controller, during the research and selection activities, may also become aware of data classified as "special" according to art. 9 of the Regulation and judicial data according to art. 10 of the Regulation, for example those suitable to reveal:
- health conditions, membership in a trade union
- membership in political parties, religious beliefs, racial and ethnic origins, ...
because you provided them.
3. Purpose of data processing
The data processing is aimed at:
A. research and selection: evaluation of the candidate for available positions, management of the application and communication with the candidate for a possible job placement
B. in the case of employment: fulfilment of obligations in the field of work, social and fiscal assistance and fulfilment of all obligations in the field of safety at work, as well as for any other related function.
The Data Controller will provide specific information in relation to any further processing carried out.
4. Permissibility of data processing
The personal data processing by the Data Controller is legitimated by the following conditions (art.6 GDPR):
- the processing is necessary for the execution of a contract to which the Data Subject is a party or for the application of pre-contractual measures adopted at the request of the same; (purpose 3.A);
- the processing is necessary to fulfil a legal obligation to which the Data Controller is subject (purpose 3.B);
CVs that do not comply with Company’s requirements will be kept in the HR office in online archives accessible only to authorized persons for a period of 24 months from the application date, for the sole purpose of streamlining further staff selection and training procedures.
5. Compulsory/non-compulsory data provision and consequences of not providing data
For the purposes
3.A the spontaneous provision of data must be considered optional and consequently the consent is considered not required according to the applicable national privacy legislation.
3.B the provision of data must be considered compulsory. Failure to provide such data may make it impossible for the Data Controller to complete the selection process and/or to correctly carry out all the related tasks, as well as to correctly fulfil its obligations.
6. Categories of personal data recipients
Personal data, within the limits and for the purposes indicated, may be communicated or become known and therefore be processed by:
- Data Controller’s coworkers and consultants involved in the application analysis;
- companies or professionals providing services to the Data Controller: travel agencies, IT infrastructure management, ...
The personal data recipients operate under a contract and, if necessary, undertake the role of Independent Data Processor in accordance with Art.28 of the Regulation; in this context they are required to provide sufficient guarantees to implement proper technical and organizational measures, so that the processing meets the Regulation requirements and protects the Data Subject rights. The full list of recipients is available from the Data Controller.
7. Processing methods, data storage and possible data transfer.
These personal data are processed as follows:
- by the employees of the Data Controller in charge of activities related to the selection and organization of personnel;
- by paper, computer and telematic means;
- they are kept for the entire duration of the selection process and for a maximum of 24 months from the application date, anyway for a time in compliance with the applicable regulations that the Data Controller must observe;
- any automated decision-making process, including profiling, is excluded;
- personal data are normally processed in Italy, for specific business processes personal data may be transferred to countries outside EEA, in such event data protection is guaranteed by specific contract clauses.
8. Data Subject Rights
The Data Controller informs you that, with reference to the data provided, you (Data Subject) have the following rights:
A. access to the data and acquisition of a copy: to obtain confirmation from the Data Controller as to whether or not your Personal Data are being processed and, if so, to gain access to the Personal Data and to the information provided for by art. 15 of GDPR, including, by way of example: processing purposes, categories of Personal Data processed, etc.;
B. correction: to have inaccurate Personal Data rectified as well as, taking into account the processing purposes, incomplete Data integrated by the Data Controller, providing adequate documentation;
C. erasure of Personal Data: to ask for your Personal Data to be erased by the Data Controller, if one of the reasons provided for in art. 17 of the GDPR applies, including, by way of example, when your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed or if you have withdrawn the consent on which the processing of your Personal Data is based and there is no other legitimate reason for processing. The Data Controller shall have no obligation to erase your Personal Data if their processing is necessary, for example, for compliance with a legal obligation, to establish, exercise or defend a right before the courts;
D. restriction of processing: to restrict the processing of your Personal Data when one of the cases provided for in art. 18 of the Regulation applies, including, for example: the accuracy of your Personal Data is contested, for a period enabling the Data Controller to carry out the necessary checks; objection to processing, pending the verification by the Data Controller whether the legitimate grounds override those of the Data Subject;
E. portability of electronic data subject to automated processing: to receive from the Data Controller a copy of the Personal Data you provided in a structured, commonly used and machine-readable format (e.g. computer and/or tablet); to transmit your Personal Data to another Data Controller, third party, without hindrance from the Data Controller and according to your precise authorizations and indications;
F. objection to processing: to stop the processing if this is carried out in pursuit of a legitimate interest of the Data Controller, unless there are legitimate reasons for processing (reasons overriding the interests, rights and freedoms of the Data Subject), or processing is necessary to establish, exercise or defend a right before courts;
G. to withdraw your consent to processing, without prejudice to the permissibility of data processing based on the consent acquired before the withdrawal;
H. to lodge a complaint with the competent supervisory authority: the Data Protection Authority.
For any clarification and to exercise your right as Data Subject, you may contact the Data Controller by writing to Calearo Antenne SpA - via Bacchiglione n. 49 - 36033 ISOLA VICENTINA – or sending an email to: privacy@calearo.com
