Dear Candidate, pursuant to Articles 13 and 14 of EU Regulation 2016/679 (the Regulation), we provide you with the following information regarding the processing of your personal data.
The details of the Joint Controllers of the processing of personal data are set out in the list at the end of this privacy notice. We inform you that the companies indicated in the above-mentioned list entered into a Joint Controllership Agreement on 31 January 2024, as provided for by Article 26 of the GDPR, in order to jointly determine the purposes and means and to coordinate certain stages of the personnel selection process within the Sella Group companies. In particular, the joint processing concerns the sharing of data of candidates responding to job postings published by at least one Sella Group company and the comparison of such data to assess the opportunity to place the candidate, including for job positions different from the one for which the candidate applied, but consistent with his or her profile.
The Data Protection Officer (hereinafter also referred to as “DPO”) of the Controllers may be contacted using the contact details indicated for each Controller in the list at the end of this privacy notice.
The personal data that the Controllers may process in carrying out the processing in question consist of ordinary personal data (such as, by way of example, identification, contact and contractual data, as well as data relating to the individual’s economic situation).
We inform you that, during the selection phase, the Controllers may also process data belonging to special categories (also known as “sensitive data”). In particular, any special categories of your data that may be processed during the selection process concern your possible inclusion in protected categories and the corresponding percentage of disability. Such data are processed within the limits of Article 9(2)(b) of the GDPR, i.e. for the purpose of fulfilling legal obligations and exercising specific rights of the data controller or the data subject in the field of employment and social security and social protection; for this reason, your consent is not required for the processing of such data.
Personal data are collected directly by you as the interested party or by other Data Controllers with whom you have come into contact, in compliance with the relevant regulations.
In addition, personal data may be collected through third parties, such as, for example:
If within this context you directly provide your personal data to the Data Controllers, we would like to point out that such provision is necessary, as a refusal to do so would not allow your possible employment in one of the companies belonging to the Sella Group.
The processing of your personal data is carried out, on the basis of the execution of pre-contractual measures, in order to follow up your application.
The processing, therefore, is carried out in compliance with the conditions of lawfulness provided for by the Regulation and is limited to what is necessary for the processing, by the Data Controllers, of activities connected with and necessary for the search and recruitment of personnel to be included in their organisation, in relation to their open positions.
Following your application, the Data Controllers may use your data to contact you and, on the basis of their legitimate interest, to carry out pre-employment checks on the suitability of the candidate. As part of this processing, the Data Controllers may consult external, private and public databases and search websites where the candidate's profile is visible for professional purposes only. We would like to inform you that the data processing carried out within the framework of these pre-employment checks is for consultation only, therefore the Data Controllers do not keep any data consulted from external databases and websites where the candidate's profile is visible for professional purposes only, and not for private purposes. This type of processing is not carried out on a co-ownership basis.
Moreover, following your application, the Data Controllers may use your data to contact you and, on the basis of their own legitimate interest, to carry out activities to assess your potential. In fact, the selection process may involve your involvement in cognitive and/or technical interviews, tests and questionnaires to assess your aptitude and professional orientation. This type of processing is carried out on a co-ownership basis. Also on the basis of the co-ownership agreement mentioned in the introduction to this privacy policy, the Data Controllers may process your data in order to evaluate your application for positions open in companies of the Sella Group other than the one to which you have applied, if your profile is relevant to them. This type of processing, therefore, is also carried out on a co-ownership basis.
Within the limits of the specific purposes indicated above, processing is carried out by means of manual, IT and telematic tools (such as, for example, e-mails or calls). The Data Controllers take appropriate organisational and technical measures to guarantee security and confidentiality.
Furthermore, the selection process may involve the use of artificial intelligence tools to support the analysis of applications. For the avoidance of doubt, no decision is based exclusively on automated processing, and the ultimate assessment of applications is always performed by a human recruiter.
Your personal data may be disclosed to the Data Controllers' staff authorised to process them in the performance of their duties.
The Data Controllers may also communicate your personal data to third parties who act as Data Processors, specifically appointed pursuant to Article 28 of the Regulation.
In addition, your data may be communicated to the following categories of third parties, for the same purposes expressed in the previous paragraph, including parties who provide assistance and consultancy services for the recruitment of Company's personnel, who act as autonomous Data Controllers:
Finally, your personal data may be shared with authorities and/or entities that also act as autonomous Data Controllers.
We inform you that the Data Controllers do not transfer your personal data to countries outside the European Union. However, please note that any data transfer outside the European Union can only take place in the presence of one of the guarantees provided by the Regulation in Articles 45 and 46.
The Data Controllers will keep your personal data in a form that allows their identification only for the period of time necessary to achieve the specific purpose of the processing referred to above, in compliance with contractual and/or regulatory obligations.
In particular, we inform you that your personal data and further data collected during the process may be used and stored for a period of time not exceeding 24 months from their collection or from the last contact, if any. In the event that the recruitment process is successful, resulting in your employment in one of the companies belonging to the Sella Group, your data will be transmitted to the group's internal Managers specifically appointed for the purpose of managing your employment process. On this point, you will be provided with a specific privacy policy containing detailed information on such further processing.
We inform you that you, as an interested party, may exercise the following rights in relation to the processing of your personal data:
right of access: right to obtain from the Data Controllers confirmation as to whether or not any processing of your personal data is taking place and, if so, to obtain access to the same (provided that this does not infringe the rights of others), in accordance with Article 15 of the Regulation;
right of rectification: the right to obtain from the Data Controller the rectification of your inaccurate personal data without undue delay, as well as the integration of your incomplete personal data, also by providing a supplementary declaration;
the right of cancellation ("oblivion"): the right to obtain from Data Controllers the removal of your personal data without undue delay, in accordance with Article 17 of the Regulation and, by way of example but not limited to, if:
right to restriction of processing: the right to obtain from Data Controllers the restriction of processing in cases where:
the right to data portability: the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit such personal data to another Data Controller, only for cases where the processing is based on consent (pursuant to Art. 6(1)(a) or Art. 9(2)(a) of the Regulation) or on contract and only for personal data processed by electronic means;
right to object to processing: on grounds relating to your particular situation, the right to object at any time to the processing of personal data which have as their legal basis a legitimate interest of the individual Data Controller, unless they can demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
right to lodge a complaint with a Supervisory Authority: without prejudice to any other administrative or judicial remedy, if you consider that the processing operations concerning you are in breach of the Regulation, you have the right to lodge a complaint with the Supervisory Authority of the Member State in which you reside or habitually work, or of the State where the alleged breach has occurred;
Data Controllers will provide information on the action taken with regard to the specific request without undue delay and at the latest within one month of receipt of the request. In order to exercise the above rights, a request may be made to the contact details listed at the end of this notice. Should the exercise of the rights listed above result in an actual and concrete prejudice to the interests protected under the provisions on money laundering, pursuant to Article 2-undecies of the Privacy Code, the scope of such rights and of certain related obligations of the Data Controller may be limited. In such circumstances, the exercise of these rights may be delayed, limited or excluded, for such time and to the extent that this constitutes a necessary and proportionate measure. If the conditions are met, a reasoned notice will be sent without delay.