INFORMATION ON THE PROCESSING OF PERSONAL DATA FOR JOB APPLICANTS
IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER
Cappellotto S.p.A., a single-member company, hereinafter also referred to as “Cappellotto” or the “Data Controller”, with registered office at Via Malignani 2/N, 33074 Fontanafredda (PN), Italy, may be contacted by email at info@cappellotto.com, by certified email (PEC) at cappellotto@pec.it or by telephone at +39 0434 757575.
CATEGORIES OF DATA AND SOURCES
Cappellotto processes ordinary personal data, such as identification data, contact details, information relating to employment, education and cultural background, and image data, as well as special categories of personal data, such as health-related data that may be inferred from membership of protected categories and/or from fitness-for-work assessments, which may include specific requirements or restrictions.
This information may be collected directly from the data subject and/or from third parties, such as recruitment agencies, temporary employment agencies, headhunters, Employment Centres and occupational physicians.
PURPOSES AND LEGAL BASES
A. Management of the recruitment and selection process
Personal data is processed for all activities necessary to assess potentially suitable candidates and profiles.
B. Establishment, exercise or defence of legal claims
The Data Controller may need to process personal data for the management of complaints, disputes, and out-of-court or judicial proceedings.
| Purpose | Legal basis — ordinary personal data | Legal basis — special categories of personal data |
|---|---|---|
| A. | Taking steps at the request of the data subject prior to entering into a contract. | Compliance with obligations and the exercise of specific rights in the field of employment law. |
| B. | The legitimate interest of the Data Controller in establishing, exercising or defending a legal claim. | Establishment, exercise or defence of legal claims. |
RETENTION PERIOD
| Purpose | Retention period |
|---|---|
| A. | Personal data will be deleted by the end of the calendar year following the year in which the last contact with the candidate took place. |
| B. | 10 years from the final resolution of the dispute. |
NATURE OF THE PROVISION OF PERSONAL DATA AND CONSEQUENCES OF FAILURE TO PROVIDE IT
| Purpose | Nature | Consequences |
|---|---|---|
| A. | Necessary | The data subject will be unable to submit an application, and the Data Controller will be unable to manage the recruitment and selection process. |
| B. | Necessary | The Data Controller will be unable to manage the dispute or legal proceedings. |
DISCLOSURE OF PERSONAL DATA
Personal data is processed by internal personnel who have been specifically authorised to perform their respective duties. It may also be disclosed externally in accordance with the following criteria.
| Purpose | Categories of external recipients |
|---|---|
| A. | Occupational physicians, recruitment agencies, temporary employment agencies, headhunters and Employment Centres. |
| B. | Law firms and judicial authorities. |
Since personal data is also processed using information technology systems, it may be accessible to parties providing technical support or maintenance services for those systems.
TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY OR INTERNATIONAL ORGANISATION
As a general rule, personal data will not be transferred to non-European third countries or international organisations.
However, the Data Controller uses certain information technology services that may involve the transfer of personal data outside the European Economic Area. Any such transfer will be carried out in compliance with the specific safeguards for the protection of personal data provided for under applicable data protection legislation.
In particular, one or more of the following safeguards may apply:
- the destination country has data protection legislation that the European Commission has recognised as providing an adequate level of protection for data subjects;
- companies belonging to the same corporate group as the service provider are bound by Binding Corporate Rules approved by the competent Supervisory Authority;
- recipients established in the United States of America participate in the EU–U.S. Data Privacy Framework, which provides specific safeguards for data subjects; or
- recipients that do not meet any of the conditions listed above have entered into Standard Contractual Clauses adopted by the European Commission for the protection of data subjects.
RIGHTS OF DATA SUBJECTS
Data subjects are entitled to exercise the following rights in relation to their personal data:
Access: data subjects may obtain confirmation as to whether their personal data is being processed and, where that is the case, access such data and request a copy.
Rectification: data subjects may request that their personal data be updated, corrected where inaccurate, or completed where incomplete.
Erasure: data subjects may request the erasure of their personal data where the applicable legal conditions are met. For further information, please contact the Data Controller.
Restriction of processing: data subjects may request that their personal data be marked in order to restrict its future processing where the applicable legal conditions are met. For further information, please contact the Data Controller.
Objection: data subjects may object to the processing of their personal data on grounds relating to their particular situation where the processing is based on legitimate interests or is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller.
Data portability: data subjects may receive the personal data they have provided to the Data Controller in a structured, commonly used and machine-readable format and may request that it be transmitted to another data controller where the processing is based on consent or on a contract and is carried out by automated means.
Withdrawal of consent: data subjects may withdraw their consent in relation to any processing purposes based on consent, without affecting the lawfulness of processing carried out before its withdrawal.
The rights that may be exercised in relation to the specific processing activities described in this notice are set out below:
| Purpose | Right that may be exercised | ||||||
|---|---|---|---|---|---|---|---|
| Access | Rectification | Erasure | Restriction | Objection | Portability | Withdrawal of consent | |
| A. | X | X | X | X | |||
| B. | X | X | X | X | X | ||
To exercise the rights described above, data subjects may use the form available at the following address: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924
The completed form may be sent to:
privacy@cappellotto.com.
Data subjects may also use the same contact details to request further information concerning the matters described above, such as the legitimate-interest balancing test or the list of data processors.
Data subjects also have the right to lodge a complaint with a competent Supervisory Authority. In Italy, the competent authority is the Italian Data Protection Authority — Garante per la protezione dei dati personali: (www.garanteprivacy.it).