pursuant to Article 13 of Regulation (EU) 2016/679
Dear Candidate,
pursuant to Articles 12 et seq. of Regulation (EU) 2016/679 (hereinafter the “GDPR”), we hereby inform you that PIN-CRAFT S.r.l. (hereinafter the “Company” or the “Data Controller”) will process your personal data provided in connection with your application, including through the submission of your Curriculum Vitae.
1. DATA CONTROLLER
The Data Controller processing your personal data is PIN-CRAFT S.r.l., with registered office at Via dei Comparini no. 85, 55049 Viareggio (LU), Italy, registered with the Lucca Companies Register, VAT No. 01965100462; contacts: contatti: tel. +39 0584-383930, e-mail. info@pin-craft.com.
2. DATA PROTECTION OFFICER
The Data Controller has appointed a Data Protection Officer (“DPO”) operating at the level of the Opacmare Group, of which the Company is part. The DPO may be contacted at dpo@opacmare.it for all matters relating to the processing of personal data and the exercise of rights pursuant to the GDPR and according to the procedures described in Section 9 of this Privacy Notice.
3. CATEGORIES OF DATA PROCESSED AND SOURCE OF THE DATA
Ordinary Personal Data
The personal data collected include identification data, residence data, contact details, data capable of revealing national origin, information regarding education and qualifications, previous professional experience, language skills, periods spent abroad, personal preferences (e.g. willingness to relocate), hobbies, CV photographs, as well as the information generally contained in a Curriculum Vitae.
In addition, information resulting from reference checks (where carried out) may also be collected, such as academic background, employment history and other information relevant to assessing your suitability as a candidate.
Furthermore, the processing may include information from your professional social network profiles (where applicable), notes taken during interviews and comments provided by third parties such as referees during the recruitment process.
The data may be updated on the basis of publicly available information and/or collected from third parties (recruitment agencies) and/or directly from you.
Special Categories of Personal Data
During the recruitment and selection process, the Company does not generally need to collect “special categories” of personal data (such as data revealing racial or ethnic origin, religious, philosophical or political beliefs, membership of political parties or trade unions, as well as data concerning health or sex life).
Therefore, you are requested to include in your CV only the data necessary to assess your professional profile and to refrain from indicating such special categories of data. Where such data are voluntarily included or communicated, they will be deleted unless they concern characteristics affecting the performance of the job or constituting an essential and determining requirement for carrying out the work activity (e.g. membership of protected categories).
Third-Party Data
If your CV contains personal data relating to third parties (for example, referees to be contacted regarding previous work experience), you will act as an independent data controller and must ensure that you have obtained the consent of such persons for the communication of their data to the Company and for any subsequent contact by the Company for reference-checking purposes.
4. PURPOSES AND LEGAL BASIS OF THE PROCESSING
The processing of personal data (including, where necessary, special categories of data) provided in connection with your job application and attached CV is carried out exclusively for purposes related or instrumental to the establishment of an employment relationship with the Company and, more specifically, in order to:
i) assess your professional profile in relation to open positions within the Company;
ii) manage recruitment and selection procedures;
iii) fulfil obligations connected with the establishment of the contractual relationship and the performance of activities in favour of the Company.
The legal basis for the processing is the implementation of pre-contractual measures pursuant to Art. 6(1)(b) GDPR.
Where the processing of special categories of personal data is necessary for recruitment and establishment of the employment relationship, the legal basis is compliance with obligations and the exercise of specific rights of the Data Controller and the data subject in the field of employment law pursuant to Art. 9(2)(b) GDPR.
Although the provision of personal data is optional, it is essential for the achievement of the purposes described above.
Should you consent to the retention of your data beyond the duration of the recruitment process for the specific position for which you applied, in order to be contacted regarding future job opportunities, the legal basis for such processing will be your consent pursuant to Art. 6(1)(a) GDPR, which may be withdrawn at any time.
Any withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.
5. METHODS OF PROCESSING
The processing may be carried out with or without the aid of electronic or automated means and shall include all operations necessary for the relevant processing activities, including disclosure to the recipients indicated below.
The processing will be carried out within the limits and according to the methods necessary to pursue the above-mentioned recruitment purposes.
6. NATURE OF THE PROVISION OF DATA AND CONSEQUENCES OF FAILURE TO PROVIDE DATA
Any refusal to allow the Data Controller to process your data as described above will make it impossible to assess your profile, arrange interviews and consequently establish the contractual relationship in compliance with applicable legal and contractual provisions.
7. DATA RETENTION PERIOD
Your data will be retained in the Company databases for a period not exceeding that strictly necessary to assess your application for possible employment within the Company and, in any case, for no longer than 12 months. However, should you consent to the retention and use of your data in order to be contacted regarding future positions of potential interest, your data will be retained for up to two years from the conclusion of the recruitment process.
Upon expiry of the above-mentioned retention periods, the data will be deleted or anonymised.
8. RECIPIENTS OF THE DATA
The data may occasionally be disclosed to third-party recruitment companies.
Furthermore, the data may be accessed by companies entrusted with maintaining the IT and telematic systems (including applications and network devices), as well as by Company personnel authorized to process CVs on the basis of specific instructions and confidentiality obligations.
Finally, Opacmare S.p.A., as majority shareholder entrusted by the Company with the management and selection of CVs and with Website maintenance activities, will also have access to your data.
9. DATA SUBJECT RIGHTS
Pursuant to Articles 15 to 22 of Regulation (EU) 2016/679, candidates, as data subjects, are entitled to exercise the following rights:
- Right of access: pursuant to Art. 15 GDPR, the data subject has the right to obtain confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to such data.
- Right to rectification: pursuant to Art. 16 GDPR, the data subject has the right to obtain without undue delay the rectification of inaccurate personal data concerning him or her and the completion of incomplete personal data.
- Right to erasure: pursuant to Art. 17 GDPR, the data subject has the right to obtain the erasure of personal data concerning him or her without undue delay where one of the grounds provided for in the GDPR applies.
- Right to restriction of processing: pursuant to Art. 18 GDPR, the data subject has the right to obtain restriction of processing where one of the conditions provided for in the GDPR applies.
- Right to object: pursuant to Art. 21 GDPR, the data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions.
- Right to data portability: pursuant to Art. 20 GDPR, the data subject has the right to receive the personal data concerning him or her in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance, under the conditions provided for by the GDPR.
- Right to withdraw consent: pursuant to Art. 7 GDPR, the data subject has the right to withdraw consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
- Right to lodge a complaint: pursuant to Art. 77 GDPR, where the data subject considers that the processing relating to him or her infringes one or more provisions of the GDPR, he or she has the right to lodge a complaint with a supervisory authority, in particular in the Member State of habitual residence, place of work or place of the alleged infringement (in Italy, the Italian Data Protection Authority).
Without prejudice to the right to lodge a complaint with the supervisory authority, the rights listed above may be exercised by sending an informal request to the Data Controller by post using the contact details indicated above or by e-mail to info@pin-craft.com, also using the form available on the website of the Italian Data Protection Authority at: https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/1089924.
In the event of violations or denial of privacy rights, data subjects may also contact the Group Data Protection Officer (DPO) by writing to dpo@opacmare.it.
10. AMENDMENTS
The Company reserves the right to amend or simply update this Privacy Notice, in whole or in part, including as a result of changes in processing activities and/or applicable legislation.
The Data Controller – PIN-CRAFT S.R.L.