NOTICE PURSUANT TO ARTICLES 13–14 OF EU REGULATION NO. 679/2016

REGARDING THE PROCESSING OF PERSONAL DATA OF JOB APPLICANTS

S.T.I. Solfotecnica Italiana S.p.A., with its registered office at Via Matteotti, 16 – Ravenna (RA), VAT No. 00081430399 (hereinafter the “Data Controller”), represented by its legal representative pro tempore, in its capacity as DATA CONTROLLER, hereby informs you, pursuant to Articles 13 and 14 of EU Regulation No. 2016/679 (hereinafter the “GDPR”), that the data provided by you will be processed in the manner and for the purposes set out below.

1. Subject matter of the processing

For the purpose of establishing and managing the relationship with you, the Data Controller processes:

1. your personal, identification, and contact data (e.g., first name, surname, company name, address, telephone number, e-mail address, etc.);
2. where disclosed, your health-related data (e.g., membership in protected categories).

2. Purposes of processing and legal basis
3. Pursuant to Art. 111-bis of Legislative Decree 196/2003, and within the limits of the purposes referred to in Article 6, paragraph 1, letter b) of the Regulation, consent for the processing of personal data contained in CVs is not required.
4. any special categories of personal data provided during the interview are processed without prior express consent, in accordance with the Data Protection Authority’s Measure No. 146 of June 5, 2019.

3. Nature of data provision and consequences of failure to provide data

Providing data for the purposes referred to in points 2.a) and 2.b) is necessary for the implementation of pre-contractual measures taken at the request of the data subject. In the absence of such data, it will not be possible to evaluate the application.

4. Data access, communication, and dissemination

Your data may be made accessible to:

1. Employees and collaborators of the Data Controller in their capacity as persons authorized to process data and/or system administrators;
2. Third-party companies or other entities (such as, by way of example: consultants and freelance professionals, including those practicing in associations, etc.) performing outsourced activities on behalf of the Data Controller, in their capacity as external data processors;

Your personal data will not be disseminated.

5. Data transfer

Please be advised that we generally seek to avoid transferring data outside the European Union. However, it is understood that the Data Controller reserves the right to transfer data to countries outside the EU should the need arise. In such cases, the Data Controller guarantees that any transfer of data outside the EU will take place in compliance with applicable legal provisions by—where necessary—entering into agreements ensuring an adequate level of protection and/or adopting standard contractual clauses approved by the European Commission and/or binding corporate rules.

6. Data retention

All personal data provided will be processed in compliance with the principles of lawfulness, fairness, relevance, and proportionality, using only the methods—including electronic and digital means—strictly necessary to pursue the purposes described above.

Personal data will be retained for 12 months from the date of collection. In the event of a deletion request by the data subject, data related to the controller’s legitimate interest or necessary for compliance with legal obligations may nonetheless be retained. Please note that the information systems used to manage the collected information are configured from the outset to minimize the use of personal data.

7. Rights of the data subject

Pursuant to Articles 15 to 22 of EU Regulation No. 679/2016, the data subject is granted the right to exercise specific rights. In particular, the data subject has the right to: a) obtain confirmation as to whether or not personal data concerning them are being processed and, where that is the case, access to such data; b) obtain the rectification of inaccurate personal data and the completion of incomplete personal data; c) obtain the erasure of personal data concerning them, in cases where this is permitted by the Regulation; d) obtain the restriction of processing, in the circumstances provided for by the Regulation; e) obtain notification to the recipients to whom the personal data have been transmitted regarding any requests for rectification/erasure of personal data or restriction of processing made by the data subject, unless this proves impossible or involves a disproportionate effort; f) receive, in a structured, commonly used, and machine-readable format, the personal data prov…provided to the Data Controller, as well as their transmission to another data controller, at any time, including upon the termination of any relationship maintained with the Data Controller; g) object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them pursuant to Article 6, paragraph 1, letters (e) or (f), including profiling based on those provisions. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing; h) not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them; i) lodge a complaint with a supervisory authority pursuant to Art. 77.

8. Procedures for exercising rights

You may exercise your rights at any time by contacting the Data Controller at the following e-mail address: privacy@solfotecnica.com

9. External processors and persons in charge of processing

The updated list of external processors and persons in charge of processing is kept at the Data Controller’s registered office.

10. Right to lodge a complaint with the supervisory authority

Should you believe that the processing violates your rights in any way, you may lodge a complaint with the Supervisory Authority for the protection of personal data, as provided for by Art. 77 of the GDPR, by checking the procedures on the website www.garanteprivacy.it.