Privacy Notice
Privacy Policy - CV applications
Last updated: May 2024
-------------------------------------------
PRIVACY NOTICE PURSUANT TO ART. 13 OF EU REGULATION 2016/679 AND ART. 111-BIS OF LEGISLATIVE DECREE NO 196 OF 30 JUNE 2003 – ITALIAN DATA PROTECTION CODE
FIVERS Studio Legale e Tributario (hereinafter also only "FIVERS") informs that in the context of the management of the search and selection procedures for professionals and administrative staff in view of the possible establishment of an employment and/or professional relationship (regardless of the contractual type of the legal relationship) it is the Data Controller of the personal data of candidates for possible job positions, pursuant to Articles 4(7) and 24 of the EU Regulation 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data (hereinafter, "GDPR").
Processing of personal data shall mean any operation or set of operations which is performed upon personal data or sets of personal data, whether or not they are recorded in a database, whether or not they are collected, stored organisation, structuring, storage, processing, selection, blocking, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, restriction, erasure or destruction.
We therefore inform you that this data will be processed by paper, computer or telematic means for the following purposes.
Pursuant to art. 111-bis of the Italian Data Protection Code (Legislative Decree no. 196 of 30 June 2003, valid as national coordinating legislation to the GDPR), the information on the processing in case of receipt of curricula not solicited or requested by FIVERS, but spontaneously transmitted by interested candidates - through any communication channel - for the purpose of the possible establishment of an employment relationship is to be provided at the first contact following the sending of the curriculum sent by the interested party. FIVERS therefore provides the following information, which fulfils the obligations under Article 13 of the GDPR and 111-bis of the Italian Data Protection Code. This information on the processing of personal data is also released for the various cases of CVs whose sending was instead solicited by FIVERS, according to the internal procedures for the selection of personnel and professionals provided for and applicable.
Identification and contact details of the data controller.
As required by the Transparency Guidelines WP 260/2017, we first provide the identification details of the data controller and all contact information for contacting him quickly.
FIVERS – Studio Legale e Tributario
Via degli Omenoni 2
20121 Milan
Tax code and VAT number 08432520966
Tel +39 02 3041 331
e-mail: info@5rs.it
PEC: segreteria@pec.5rs.it
Purpose of processing.
The processing aims to: manage the recruitment procedures, receive requests for professional placement, evaluate the professional profiles of interest arising from the curricula vitae sent, manage all phases related to the selection of candidates (communications with interested parties, arranging meetings, conducting interviews - including through questionnaires - and evaluating the outputs, etc.), manage all the phases connected to the procedures for receiving applications sent spontaneously or requested by FIVERS, keep in compliance with data retention rules all the information and documents relating to the recruitment activities carried out, regardless of whether or not the candidate is then hired or anyhow included in FIVERS.
Modalities of processing.
The data contained in the CVs sent will be processed by computerised or telematic means (including the transformation of any paper CVs into electronic files by scanning).
More specifically, the ways in which personal data taken from CVs are collected and processed include, as appropriate, the official FIVERS website, and external electronic platforms or apps such as Linkedin; direct contacts with FIVERS, receipt of CVs from universities, and entrusting of recruitment and selection tasks to external recruitment companies.
Data and CVs are collected as a result of:
(a) spontaneous sending of the CV by the candidate, through the traditional or electronic communication channels made available by FIVERS, including dedicated sections of websites, electronic platforms or apps;
(b) sending of the CV by the candidate following a specific request from FIVERS, where "request" or "solicited sending" means the opening of formal recruitment and selection procedures for particular job positions (also through third parties, such as recruitment companies to which FIVERS may eventually entrust such procedures) as advertised by FIVERS, also online (e.g.: the section Careers our website).
Categories of personal data processed.
FIVERS will collect and process the following categories of personal data as typically related to recruitment procedures:
- personal and contact details of the candidate
- image and pictures, where included in the CV
- data contained in the CV
- other data provided by the candidates when submitting their online application or during interviews to which they were invited (e.g. bank details; data on tax relief; social security data; referrals, etc.)
- any processing of data of a special nature if required by law (e.g. quotas reserved for protected categories by specific legislation);
Communication and dissemination of personal data.
The candidate's personal data will be disclosed:
- the administrative staff and lawyers of FIVERS specifically in charge of the recruitment activities, and whose access to the data is authorised by virtue of specific instructions pursuant to Articles 29 and 32 of the GDPR;
- to professionals, consultants or external companies eventually in charge of the recruitment activity on behalf of FIVERS: the list of names and contact details of these external companies may be obtained by making a request to the e-mail info@5rs.it;
- the competent doctor for pre-employment examinations;
- to persons indicated by the candidate in the CV, such indication counting as authorisation for communication, which FIVERS will consider covered by the specific consent of the person concerned.
Personal data will not be disseminated.
Optional or mandatory consent. Provision of data of a particular nature in the CVs.
We inform you that - in the case of curricula vitae not solicited by FIVERS and sent spontaneously by the interested subject - the provision of data is necessary for the purposes indicated and for the purpose of evaluating and selecting applications. In this perspective, it is not compulsory to acquire any consent from the data subject, within the limits provided for by Article 6, paragraph 1, letter (b) of the GDPR, as recalled by Article 111-bis of the Privacy Code, since the recrutiment procedures imply a processing that is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures taken at the request of the data subject or for the pursuit of the legitimate interest of the third party (i.e. the candidate himself/herself).
We kindly ask you to include in your curriculum vitae or provide us with only the data necessary to assess your professional profile and not to indicate - unless strictly necessary in relation to legal constraints (e.g. quotas reserved for particular categories of workers) - any data of a particular nature pursuant to art. 9 of the GDPR ("data of a particular nature" are: data revealing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organisations of a religious, philosophical, political or trade-unionist character, as well as personal data disclosing health and sex life). The indication of data of a particular nature in the CV is only allowed insofar as provided for by specific laws regulating access to the labour market of persons entitled to it due to particular health or other conditions, which consequently make it compulsory for FIVERS to process data of a particular nature. In such cases, we inform you that pursuant to Article 9(2) of the GDPR, the condition of inapplicability of the processing prohibition is that provided for in letter (b), which legitimizes - as an exception to the prohibition - the processing of data of a particular nature that is necessary for the performance of the obligations and exercise of the specific rights of the data controller or the data subject in the field of labour and social security law and social protection. As to the basis for the lawfulness of the processing of data of a particular nature within the meaning of Article 6 of the GDPR, this is represented by the need to comply with a legal obligation under the laws of the system providing for reserved quotas for access to the labour market (Article 6(1)(c) of the GDPR). In this perspective, it is not necessary to acquire any specific consent from the data subject for the processing of data of a particular nature.
In the case of curricula vitae sent as solicited by FIVERS (and not spontaneously transmitted by the interested subject) any data of a particular nature therein (relating, in particular, to health, religious beliefs and political opinions) will be immediately deleted in the absence of the above-mentioned legal obligation grounding the processing.
The processing of data disclosing the state of health of the family members or cohabitants of candidates is allowed if it is aimed at the recognition of a specific benefit in favour of candidates, in particular for the purposes of compulsory recruitment or recognition of a qualification deriving from disability or infirmity, war events or reasons of service as provided for by specific regulations governing access to the labour market. We inform you that pursuant to Article 9(2) of the GDPR, the condition of inapplicability of the processing prohibition in such cases is that provided for in letter (b), which legitimises - as an exception to the prohibition - the processing of data of a particular nature of the family members or cohabitants of candidates necessary for them to exercise their specific rights in the field of labour law and social security and social protection. In this perspective, it is not necessary to acquire any specific consent to the processing. In those cases where it is not possible to base the processing of the data of the applicants' family members or cohabitants on labour and social security law and social protection, please obtain the specific consent of the persons concerned (to be documented in the application documentation) before sending the curriculum vitae, as FIVERS - if this is not possible - will have to delete the relevant information.
Retention period - deletion of personal data and CVs and place of processing.
Regardless of whether or not a contractual relationship is established with FIVERS, we inform you that your personal data will be kept for a maximum of 24 (twenty-four) months starting from the sending of your application or the uploading of the last modification in our archives. At the expiry of the aforementioned time limits, the data and the CVs containing them will be deleted, unless the candidate indicates otherwise. During this period, the candidate may also ask FIVERS to supplement or update the personal data contained in the CV concerning him/her.
Personal data included in the CVs or anyhow gathered during the recruitment procedures shall be processed exclusively in Italy and not sent outside the Economic European Space.
The address for the exercise of rights as recognised in Articles 15 to 22 of the GDPR (also with reference to requests to third parties to whom the data have been disclosed with the specific consent of the data subject) is the e-mail info@5rs.it.
Statements and commitments.
By submitting his curriculum vitae, the candidate grants:
1. that all the information given corresponds to the truth;
2. that you have communicated all relevant information that may be relevant to your application for the position applied for;
3. that I am aware that in the event that I have provided false or misleading information leading to the establishment of an employment relationship, the latter may be terminated for that reason;
4. to have provided the information solely for the purpose of evaluations for possible employment;
5. to be aware that by offering the application, obtaining employment will be subject to the fulfilment of the requirements and results requested by the employer regarding any checks that may be required on previously acquired training.
Exercise of rights by the data subject.
Pursuant to Articles 13(2)(b) and (d), 15 to 22 of the GDPR, we inform the data subject that:
a) he/she has the right to ask FIVERS for access to his/her personal data, their rectification or deletion or the restriction of their processing or to object to their processing or not to be subjected to decisions based on fully automated processing, including profiling;
b) he/she has the right to lodge a complaint with the Italian Data Protection Authority, following the procedures and indications published on the Authority's official website at www.garanteprivacy.it, or with the competent authority of the place of habitual residence or domicile of the person alleging a violation of his/her rights;
c) any rectification or erasure or restriction of processing carried out at the request of the data subject - unless this proves impossible or involves a disproportionate effort - will be communicated to each of the recipients to whom the personal data have been transmitted.
The exercise of rights is not subject to any formal constraints and is free of charge. Only if further copies of the data are requested by the data subject, FIVERS may charge a reasonable fee based on administrative costs. If the data subject submits the request by electronic means, and unless otherwise specified by the data subject, the information shall be provided in a commonly used electronic format The specific address for transmitting requests to exercise rights as recognised by the GDPR is: info@5rs.it. No other formalities are required. Acknowledgement will be given within the time limits set out in Article 12(3) of the GDPR ("The data controller shall provide the data subject with information on the action taken in respect of a request pursuant to Articles 15 to 22 without undue delay and, at the latest, within one month of receipt of the request. That period may be extended by two months, if necessary, having regard to the complexity and number of the requests. The data controller shall inform the data subject of this extension, and of the reasons for the delay, within one month of receipt of the request. If the data subject makes the request by electronic means, the information shall be provided, where possible, by electronic means, unless otherwise specified by the data subject").
For your convenience, please find below the link to Articles 15 to 23 of the GDPR on the rights of the data subject (access, rectification, updating, erasure, restriction, portability, objection, right not to undergo fully automated processing, including profiling).
