pursuant to art. 13 of UE Regulation E 2016/679
Dear Candidate,
pursuant to art. 12 and following of UE Regulation 2016/679 (hereinafter referred to as GDPR), we inform you that the Company PIN-CRAFT S.r.l. (hereinafter referred to as the “Company” or “the Data Controller”) shall process the Personal Data you will supply due to your application also by means of your Curriculum Vitae.
1. The Data controller
The controller of your data is the company PIN-CRAFT S.r.l., whose registered office is in Via dei Comparini n. 85, 55049 Viareggio (Lu) – Italia, registered in the Company Registe of Lucca, VAT nr 01965100462; contacts: tel. +39 0584-383930, e-mail. info@pin-craft.com.
2. Categories of processed data and data source
Common Personal Data.
Collected data refer to personal data, residence data, contacts, data revealing the country of origin, the level of culture or education, data concerning previous professional experience, the knowledge of foreign languages, stages abroad, personal preferences (e.g. availability for relocation), hobbies, C.V. pictures, and all information usually contained in the C.V. Moreover, information may be collected regarding checks of your references, if any, such as academic records, employment history and other significant information to determine your suitability as a candidate. Data may also include information from your professional social networks (if applicable), notes taken during interviews and comments from other subjects, such as reference sources, that might arise during the selection process Data can be updated based upon publicly available information and/or collected by third parties (recruitment companies) and/or directly from you.
Special Personal Data.
During the search and recruiting of personnel, the Company does not usually need to collect special personal data (for example data revealing racial and ethnic origins, religious, philosophical or political beliefs, parties or trade union membership, as well as personal data that might reveal health conditions and sexual life). Therefore, only personal data needed for the assessment of the Candidate’s profile are requested. Do not indicate special data which, if voluntarily revealed or communicated, shall be deleted unless they might influence the working activity or represent a basic and crucial requirement for the work activity itself (e.g. in case of belonging to protected categories).
Data of third parties.
Should the Curriculum include data regarding third parts (e.g. references to be contacted for previous work experience), you shall operate as autonomous Data Controller and must make sure that you have obtained their consent to disclose their data to the Company and to be possibly contacted to provide references.
3. Purposes and legal bases of processing
Processing of personal data (also including special ones, if needed) supplied when applying for hiring and attached to the curriculum is only carried out for purposes connected or instrumental to the establishment of the work relationship with the Company and, more specifically, to (i) assess your professional profile in relation to the Company open positions (ii), management of search positions (iii) for fulfilments related to the establishment of the contractual relationship and of provision of activities in favour of the Company.
The legal base of data processing is the implementation of precontractual measures pursuant to art.6 paragraph 1b) of GDPR. In the event of the processing of special data needed for the search and establishment of the work relationship, the legal base is the fulfilment of obligation and the exercise of the rights of Data Controller and of the Data Subject regarding labour law (art. 9.2 b GDPR).
We inform you that the provision of personal data, though optional, is essential for the achievement of the indicated purpose.
In case you consent to the retention of your data after the end of the search for the specific position you applied for, to be contacted for possible future job opportunities, the legal base shall be your consent, pursuant to art. 6 paragraph 1.a of the GPDR, revocable at any time. Consent may be revoked without compromising the data processing carried out till then.
4. Methods of processing
Data can be processed with or without the help of electronic means or anyway automated and shall include all operations or group of operations necessary for the processing in question, including the communication to recipient subjects indicated below. Data processing shall take place in the manner and within the limits necessary to achieve the purposes of staff recruitment.
5. Nature and consequences in case of failure to provide the data
In the event of your unavailability to provide the data as described above, it will not be possible for the Data Controller to assess your profile, to schedule interviews and therefore, to establish the contractual relationship in compliance with the applicable law.
6. Data retention period
Your data shall be stored in the Company database for a period no longer than the strictly necessary time to assess your application for the purpose of introducing you in the company staff and, in any case, no longer then twelve months. Nevertheless, should you have agreed to retention and use of your data to be contacted in the future for potentially interesting positions, you r data shall be stored up to two years from the end of the search process. After the expiry of the storage time described above, data shall be deleted or made anonymous.
7. Data recipients
Data might occasionally be disclosed to third parties dealing with staff recruitment, as well as IT management and telecommunication companies including applications and network operators, company staff authorised to process the curricula, specifically instructed and bound by confidentiality and, eventually, Opacmare S.p.A., as majority shareholder appointed by the Company for the selection of CVs and for the maintenance of the website, shall as well acknowledge your data.
8. Rights of data subjects
Pursuant to art. 15 to 22 of UE regulation 2016/679, the Candidates, being data subjects, are granted the following rights
- Right of access: Art.15 of GDPR allows the subjects to be acknowledged by the Data Controller that their data are being processed and, in that case have access to those data.
- Right of rectification: Pursuant to art. 16 of GDPR the data subjects can obtain from the Data Controller the rectification of their incorrect personal data without unjustified delay. Considering the purpose of data processing the subjects have the right to obtain the integration of their incomplete personal data, also supplying and additional declaration, if needed.
- Right of cancellation: Art. 17 of GDPR the Data Subjects can obtain from the Data Controller the cancellation of the data that concern them with no unjustified delay if there is a reason provided by the regulation.
- Right of limitation: Pursuant to art. 18 of GDPR the Data Subjects can obtain the treatment limitation from the Data Controller when one of the assumptions provided by the regulation occurs.
- Right of opposition: Pursuant to art. 21 of GDPR the Data Subjects can oppose at any time for reasons regarding their situation, to personal data processing that concerns them pursuant to art. 6 paragraph 1, letters e) and f), including the profiling based on such provisions.
- Right of data portability: Pursuant to art. 20 of GDPR the Data Subjects can receive in structured, commonly used and legible by an automatic device, the data they supplied to the Data Controller and have the right to transfer such data to another Data Controller without restraints from the Data Controller to whom they were originally supplied in compliance with the regulation provisions
- Right of consent revocation: pursuant to art. 7 of GDPR the Data Subjects can revoke the given consent at any time. Consent revocation does not compromise the lawfulness of the data processing before the revocation.
- Right of claim: pursuant to art. 77 of GDPR, should the Data Subjects reckon that the processing of their data violates one or more GDPR provisions, they have the right to file a complaint to a Controlling Authority in particular in the Member State in which they are habitually resident or work, or in which the alleged violation has taken place (in Italy, the Authority for the protection of personal data).
Except for the claim to be filed to the Controlling Authority, rights listed above can be exercised by informally requesting with a letter to the Data Controller to the email address a info@pin-craft.com, using the form for the exercise of rights available on the website of the Guarantor of the Privacy at the link https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/1089924.
9. Modifications
The Company reserves the right to change or simply update the contents of this information partially or totally, also due to variations in the processing or in the applicable regulation.
The data controller - PIN-CRAFT S.R.L.