Privacy for Employee Search and Selection

The company DUCKMA SRL, with registered office in (25122) Brescia, Via Vittorio Emanuele II, no. 1, registered at the Brescia Register of Companies R.E.A. no. BS - 543381, C.F. and P.IVA no. 03547240980, in the person of the legal representative pro tempore, Matteo Gazzurelli, as the data controller (hereinafter, the Data Controller), informs, pursuant to Art. 13 EU Regulation No. 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the GDPR) that the data will be processed as indicated below.

***

1. Object of Treatment

1.1 The Owner processes personal and identifying data (first name, last name, address, telephone, email, resume) (hereinafter, Personal Data) disclosed as part of selections for job positions.

2. Purpose of Treatment

2.1 The processing of Personal Data is carried out for purposes related or instrumental to the performance of the Owner's search and selection of candidates for open job positions.

2.2 The provision of Personal Data is mandatory for the pursuit of the purposes set forth in Article 2.1 above. Therefore, any refusal to provide Personal Data may prevent the Holder from carrying out the search and selection activity and not allow the application to be considered.

2.3 The processing of special categories of personal data (e.g., health status, membership in protected categories) requires the written consent of the data subject. Failure to provide written consent will not allow an application to be evaluated. The Holder requires applicants, who have personal data belonging to the special categories, to send their curriculum vitae by mail to the address indicated in Article 8, with their explicit declaration of consent to the processing by the Holder. Personal data belonging to special categories will not be retained by the Holder but deleted.

3. Mode of Treatment

3.1 Processing of Personal Data means any operation or set of operations, performed with or without the help of automated processes, referred to in Article 4 (2) GDPR, namely collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure and destruction. Personal Data are subject to processing, whether paper-based, electronic and/or automated.

3.2 The Data Controller will process the Personal Data for as long as necessary to fulfill the purposes set forth in Article 2 of the Disclosure and, in any case, for 20 (twenty) years. Once this retention period has expired, the Personal Data will be destroyed or anonymized.

4. Data Access

4.1 Personal Data may be made accessible:

  • to employees and collaborators of the Data Controller, in their capacity as persons in charge and/or internal data processors and/or system administrators;
  • to third party companies or other entities (e.g., lending institutions, professional firms, consultants) that perform activities on behalf of the Data Controller. These parties will operate as autonomous Data Controllers or will be designated External Data Controllers.

5. Data Communication

5.1 Without the need for express consent under Article 6 (b) and (c) GDPR), the Data Controller may disclose Personal Data to those entities to whom disclosure is mandatory by law (e.g., Judicial Authorities). These subjects will process the Personal Data in their capacity as autonomous data controllers. Outside of the aforementioned obligations, Personal Data will not be communicated to third parties other than the Data Controller or subjects to whom access is granted pursuant to Article 4 of the Policy.

6. Data Transfer

6.1 Personal Data is stored on servers located within the European Union. In any case, it is understood that the Data Controller, if necessary, will have the right to move the servers outside the European Union. In this case, the Data Controller will verify that the server provider transfers the data outside the European Union and processes it in compliance with the GDPR.

7. Rights of the Interested Part

7.1 The interested part is guaranteed the rights, namely:

  • the right to obtain confirmation of the existence or otherwise of Personal Data concerning him, even if not yet registered, and their communication in an intelligible form;
  • the right to obtain indication of the origin of the Personal Data, the purposes and methods of the processing, the logic applied in case of processing carried out with the aid of electronic instruments, the identification details of the Data Controller, the data controllers and the representative designated pursuant to Article 3, paragraph 2, GDPR, of the subjects or categories of subjects to whom the Personal Data may be communicated or who may become aware of it as designated representatives in the territory of the State, managers or agents;
  • the right to obtain 1) updating, rectification or, when interested, integration of data, 2) cancellation, transformation into anonymous form or blocking of data processed in violation of the law, including those of which conservation is not necessary in relation to the purposes for which the data were collected or subsequently processed, 3) certification that the operations referred to in numbers 1) and 2) have been made known, also with regard to their content, of those to whom the data have been communicated or disseminated, except in the case in which this fulfillment proves impossible or requires the use of means manifestly disproportionate to the protected right;
  • the right to object, in whole or in part, 1) for legitimate reasons to the processing of personal data concerning him, even if pertinent to the purpose of the collection, 2) to the processing of Personal Data concerning him for the purpose of sending advertising material.

7.2 Where applicable, the interested party also has the rights to be forgotten, to limitation of processing, to data portability as well as the right to complain to the Guarantor Authority.

8. Methods of Exercise of Rights

8.1 The interested party may at any time exercise the rights by means of a communication sent by registered mail. to DUCKMA SRL, Via Vittorio Emanuele II, n. 1, (25122) Brescia or by PEC to duckma@pec.it.

9. Owner, Manager and Appointees

9.1 The data controller is DUCKMA SRL. The updated list of data controllers and persons in charge of processing is kept at the headquarters of the Data Controller.