As data protection is a very serious issue for us we want to inform you about the ways data is processed and the rights you can exercise pursuant to the data protection regulations in force, and in particular EU Regulation 2016/679 (hereinafter also: “GDPR”).
1. Data controller
Gaudenzi S.r.l.
Via Nuova Circonvallazione n. 57/B
47900, Rimini (RN)
E-mail: [email protected]
2. Categories of data subject to processing
The data processed by the Data Controller is exclusively “personal data” (pursuant to Art. 4.1 of the GDPR).
In particular, the possible categories of personal data subject to processing include but are not limited to:
3. Purposes and lawfulness of the processing of personal data
3.1 Purposes connected with the fulfilment of a legal obligation (art. 6 paragraph 1 (c) of the GDPR)
The processing of personal data is necessary to assess the application of the Data Subject (candidate), whether for a specific vacant position or speculative and, in this context, specifically for the following purposes:
a. the fulfilment of legal obligations connected with the application and the eventual hiring of the candidate, as above (e.g. verification of membership of a protected category).
The personal data retention period relative to the purposes outlined in this section is:
For purpose a: 12 months from the provision of consent or the receipt of a speculative CV.
3.2 Purposes connected with the performance of a contract or steps prior to entering into a contract (art. 6 paragraph 1 (b) of the GDPR)
The purpose connected with the execution of pre-contract steps is:
a. Management of the recruitment process with regard to one or more vacant positions and therefore aimed at the creation of a work contract (including, but not limited to, the assessment and identification of one or more persons to cover the aforementioned positions and the gathering of any information required for the hiring of said persons and the drafting of the relative contract).
The personal data retention period relative to the purposes outlined in this section is:
For purpose a: 12 months from the provision of consent or the acquisition of the data, except in the case of employment (in this case the retention period will follow the specific timeframes envisaged or required on the basis of individual relationships and indicated in the respective and specific policies).
3.3 Purposes covered by the consent of the data subject (art. 6, paragraph 1 (a) of the GDPR)
The purpose that requires consent is:
a. management of the process of recruiting and evaluating the CV of the candidate in the wider sense (relative to processing not connected with pre-contract activities and/or with reference to the processing of specific data).
The personal data retention period relative to the purposes outlined in this section is:
For purpose a: 12 months from the provision of consent or the receipt of a speculative CV.
4. Recipients or categories of recipients of the personal data, *(art. 13 paragraph 1 (e) of the GDPR)
With regard to the above purposes, the Data Controller may communicate your data to:
* More information on Recipients (art. 4.9 of the GDPR) is available from the personal data controller using the above contact details.
5. Recipients or categories of recipients of the personal data (art. 13 paragraph 1 (f) of the GDPR) and transfer of data to non-EU countries
The Data Controller communicates that it has no intention of transferring your data to countries outside the EU and the EEA for the abovementioned purposes.
6. Rights of the Data Subject (art. 13 paragraph 2 (b) of the GDPR) The data subject may exercise the following rights:
Additional information on the rights of the data subject can be obtained by requesting the full extract of the abovementioned articles from the Data Controller.
With regard to the purposes of processing, for which consent is required, the Data Subject may withdraw their consent at any time with immediate effect, subject to all legal constraints. In general, the withdrawal of consent only has effect in the future.
Pursuant to art. 19 of the EU Regulation, where possible the Data Controller shall inform recipients of the personal data of any requested rectification or erasure of personal data or restriction of processing.
To ensure a faster response to the requests you make when exercising the above rights, these requests may be addressed directly to the Data Controller using the contact details provided in point 1.
7. Right to lodge a complaint (art. 13 paragraph 2 (d) of the GDPR) If the data subject believes that their rights have been compromised, they have the right to lodge a complaint with the Data Protection Authority to protect their personal data, according to the methods indicated by said Authority on the following website
8. Possible consequences of failing to communicate the data and the nature of the processing of the data (art. 13 paragraph 2 (e) of the GDPR)
8.1 In the event of legal or contractual obligations
If the legal basis for the processing is a legal or contractual (also pre-contractual) obligation, the data subject must provided the requested data. Conversely, it will be impossible for the Data Controller to proceed with the specific purposes of processing.
8.2 In the event of the consent of the data subject
For other purposes, for which consent is required, the Data Subject may withdraw their consent at any time with immediate effect, subject to all legal constraints. In general, the withdrawal of consent only has effect in the future. As such, the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The failure or partial failure to provide your consent may prevent the services from being provided in full or some activities from being performed (e.g. participation in the selection process), with regard to the single purposes for which consent is denied.
When personal data is no longer required it is regularly deleted; if the deletion of said data is impossible or would involve a disproportionate effort because of a particular storage method, the data may not be processed and must be stored in inaccessible areas
9. The existence of automated decision-making (including profiling)
As detailed in article 22 of the GDPR, decisions based solely on automated processing are not permitted. If these processes are introduced for individual cases in the future, the data subject will be informed under separate cover if this is envisaged by law or the updating of this policy.
10. Processing methods
Personal data will be processed in paper, digital and electronic form and stored in the appropriate database (candidates, etc.) which may be accessed by, and therefore come to the knowledge of, workers expressly appointed by the Data Controller, such as Supervisors and Processors authorised to process personal data, who may carry out consultation, usage, processing, comparative and any other appropriate operations, also automated and with respect for all relevant legislation, necessary to guarantee the confidentiality and security of the data, and the accuracy, updating and relevance of the data with regard to the declared purposes.