NOTICE PURSUANT TO ART. 13 of EU REG. No. 679/2016
ON THE PROCESSING OF PERSONAL DATA OF JOB APPLICANTS
Ustec S.r.l., with registered office at Via L. da Vinci, 28 – 47021, San Piero in Bagno (FC) – Italy, email address privacy@ustecgroup.com, tel. 0543 1902111, represented pro tempore by its legal representative, in the capacity of DATA CONTROLLER (hereinafter referred to as the “Controller”), hereby informs you, pursuant to Art. 13 of EU Regulation no. 2016/679 (hereinafter “GDPR”), that the data you provide will be processed for the following purposes:
Subject of processing
For the purpose of establishing and managing its relationship with you, the Controller processes:
your personal, identifying and contact data (e.g. name, surname, company name, address, telephone number, email, etc.);
where provided, your health data (e.g., membership in protected categories).
Purpose of processing and legal basis
Your personal data will be processed by the Controller for the purposes of recruiting, candidate selection and management of applications, in order to establish an employment relationship. The processing is based on the necessity to execute pre-contractual measures at the request of the data subject (Art. 6, para. 1, lett. b, GDPR). Pursuant to Art. 111-bis of Leg. Decree 196/2003, consent for processing personal data included in CVs is not required. Any special categories of personal data provided during the interview will be processed without prior explicit consent, pursuant to the decision of the Italian Data Protection Authority no. 146 of 5 June 2019.
Provision of data and consequences of non-disclosure
Providing data for the purposes described above is entirely optional, but please note that, without such data, it will not be possible to evaluate your application.
Data access, communication and disclosure
Your data may be made accessible:
To employees and collaborators of the Controller in their capacity as data processors and/or system administrators;
To third-party companies or other parties (e.g.: consultants and freelancers, including partnerships, etc.) carrying out outsourced activities on behalf of the Controller, in their capacity as external data processors.
Your personal data will not be disclosed publicly.
Data transfers
We inform you that we generally aim to avoid transferring data outside the European Union. However, should it be necessary, the Controller may transfer data to non-EU countries. In this case, the Controller ensures that the transfer of data to non-EU countries will comply with applicable legal provisions, including, if necessary, entering into agreements guaranteeing an adequate level of protection and/or adopting the standard contractual clauses provided by the European Commission and/or binding corporate rules.
Data retention
All personal data provided will be processed in compliance with principles of lawfulness, fairness, relevance and proportionality, using only methods, including electronic means, that are strictly necessary to achieve the purposes described above.
Personal data will be kept for 2 years from the date of collection. The data will only be visible to the Company’s HR function. If you request deletion, certain data may still be retained where necessary for the Controller’s legitimate interests or to comply with legal obligations. Information systems used to manage collected data are configured, from the start, to minimise the use of personal data.
Data subjects’ rights
Pursuant to Art. 15-22 of EU Reg. no. 679/2016, the data subject can exercise specific rights. In particular, the data subject has the right to: a) obtain confirmation of the existence of personal data concerning them and access such data; b) obtain the rectification of inaccurate personal data and the completion of incomplete personal data; c) obtain the erasure of personal data where permitted by the Regulation; d) obtain restriction of processing in the cases provided by the Regulation; e) be informed of the recipients to whom their personal data has been disclosed in case of requests for rectification/erasure or restriction of processing, unless this proves impossible or involves disproportionate effort;; f) receive personal data provided to the Controller in a structured, commonly used, machine-readable format, and transfer such data to another Controller, at any time, including after the termination of any relationship with the Controller; g) object at any time, for reasons relating to their particular situation, to the processing of personal data concerning them, pursuant to Art. 6, para. 1, lett. e) or f), including profiling. If personal data is processed for direct marketing purposes, the data subject has the right to object at any time to such processing, including profiling related to direct marketing; h) not be subject to a decision based solely on automated processing, including profiling, producing legal effects concerning them or similarly significantly affecting them; i) lodge a complaint with a supervisory authority pursuant to Art. 77.
Exercising your rights
You may exercise your rights at any time by contacting the Controller at the addresses indicated at the beginning of this notice.
External data processors and appointed persons
An updated list of external processors and appointed persons is kept at the Controller’s registered office.
Right to lodge a complaint with the Data Protection Authority
If you believe that the processing of your data infringes your rights in any way, you may lodge a complaint with the Italian Data Protection Authority, as provided under Art. 77 of the GDPR, following the procedures on the website: www.garanteprivacy.it.