Dear Candidate, in accordance with Articles 13 and 14 of the EU Regulation 2016/679 (Regulation), we provide you with the following information on the processing of your personal data:
Details of the Personal Data Controllers can be found in the list at the end of this notice (Art. 9).
We inform you that the companies mentioned in the aforementioned list entered into a co-ownership agreement on January 31, 2024, as provided for by art. 26 of the GDPR, in order to jointly determine modalities and purposes and to carry out in a coordinated manner some phases of the recruitment process within the companies of the Sella group. Specifically, co-ownership processing concerns the sharing of applicant data regarding job advertisements published by at least one company of the Sella group and the comparison of such data in order to assess the opportunity to hire such candidate, including for job positions other than the one to which the candidate has applied, yet relevant to their profile. We inform you that this notice concerns the aforementioned processing carried out under a co-ownership regime and, in general, all processing of personal data concerning the management of your application, some of which is not carried out under a co-ownership regime, as detailed below.
With regard to the processing of personal data not carried out on a joint basis, the Data Controller is the company to which you have submitted your application (refer to the list in Article 9).
The Data Protection Officer (hereinafter also referred to as “RPD” or “DPO – Data Protection Officer”) of the Controllers can be contacted at the references provided for each Data Protection Officer in the list at the end of this notice (Art. 9).
The personal data that Data Controllers may process in the course of the processing in question are common personal data (such as, for example, personal, contact and contractual data and data revealing the economic situation). We would like to inform you that during the selection phase the Data Controllers may also process data belonging to special categories (also known as "sensitive data"). Specifically, your special data, which may be processed during the selection process, concern the fact that you may belong to protected categories and the corresponding percentage of disability. Such data are processed within the limits of Article 9(2)(b) of the GDPR, i.e. in order to comply with legal obligations and to exercise the specific rights of the Data Controller or the interested party in the field of labour law and social protection; for this reason, your consent to the processing of such data is not required.
Personal data are collected directly by you as the interested party or by other Data Controllers with whom you have come into contact, in compliance with the relevant regulations.
In addition, personal data may be collected through third parties, such as, for example:
If within this context you directly provide your personal data to the Data Controllers, we would like to point out that such provision is necessary, as a refusal to do so would not allow your possible employment in one of the companies belonging to the Sella Group.
The processing of your personal data is carried out, on the basis of the execution of pre-contractual measures, in order to follow up your application.
The processing, therefore, is carried out in compliance with the conditions of lawfulness provided for by the Regulation and is limited to what is necessary for the processing, by the Data Controllers, of activities connected with and necessary for the search and recruitment of personnel to be included in their organisation, in relation to their open positions.
Following your application, the Data Controllers may use your data to contact you and, on the basis of their legitimate interest, to carry out pre-employment checks on the suitability of the candidate. As part of this processing, the Data Controllers may consult external, private and public databases and search websites where the candidate's profile is visible for professional purposes only. We would like to inform you that the data processing carried out within the framework of these pre-employment checks is for consultation only, therefore the Data Controllers do not keep any data consulted from external databases and websites where the candidate's profile is visible for professional purposes only, and not for private purposes. This type of processing is not carried out on a co-ownership basis.
Moreover, following your application, the Data Controllers may use your data to contact you and, on the basis of their own legitimate interest, to carry out activities to assess your potential. In fact, the selection process may involve your involvement in cognitive and/or technical interviews, tests and questionnaires to assess your aptitude and professional orientation. This type of processing is carried out on a co-ownership basis. Also on the basis of the co-ownership agreement mentioned in the introduction to this privacy policy, the Data Controllers may process your data in order to evaluate your application for positions open in companies of the Sella Group other than the one to which you have applied, if your profile is relevant to them. This type of processing, therefore, is also carried out on a co-ownership basis.
Within the limits of the specific purposes indicated above, processing is carried out by means of manual, IT and telematic tools (such as, for example, e-mails or calls). The Data Controllers take appropriate organisational and technical measures to guarantee security and confidentiality.
Your personal data may be disclosed to the Data Controllers' staff authorised to process them in the performance of their duties.
The Data Controllers may also communicate your personal data to third parties who act as Data Processors, specifically appointed pursuant to Article 28 of the Regulation.
In addition, your data may be communicated to the following categories of third parties, for the same purposes expressed in the previous paragraph, including parties who provide assistance and consultancy services for the recruitment of Company's personnel, who act as autonomous Data Controllers:
Finally, your personal data may be shared with authorities and/or entities that also act as autonomous Data Controllers.
We inform you that the Data Controllers do not transfer your personal data to countries outside the European Union. However, please note that any data transfer outside the European Union can only take place in the presence of one of the guarantees provided by the Regulation in Articles 45 and 46.
The Data Controllers will keep your personal data in a form that allows their identification only for the period of time necessary to achieve the specific purpose of the processing referred to above, in compliance with contractual and/or regulatory obligations.
In particular, we inform you that your personal data and further data collected during the process may be used and stored for a period of time not exceeding 24 months from their collection or from the last contact, if any. In the event that the recruitment process is successful, resulting in your employment in one of the companies belonging to the Sella Group, your data will be transmitted to the group's internal Managers specifically appointed for the purpose of managing your employment process. On this point, you will be provided with a specific privacy policy containing detailed information on such further processing.
We inform you that you, as an interested party, may exercise the following rights in relation to the processing of your personal data:
right of access: right to obtain from the Data Controllers confirmation as to whether or not any processing of your personal data is taking place and, if so, to obtain access to the same (provided that this does not infringe the rights of others), in accordance with Article 15 of the Regulation;
right of rectification: the right to obtain from the Data Controller the rectification of your inaccurate personal data without undue delay, as well as the integration of your incomplete personal data, also by providing a supplementary declaration;
the right of cancellation ("oblivion"): the right to obtain from Data Controllers the removal of your personal data without undue delay, in accordance with Article 17 of the Regulation and, by way of example but not limited to, if:
right to restriction of processing: the right to obtain from Data Controllers the restriction of processing in cases where:
the right to data portability: the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit such personal data to another Data Controller, only for cases where the processing is based on consent (pursuant to Art. 6(1)(a) or Art. 9(2)(a) of the Regulation) or on contract and only for personal data processed by electronic means;
right to object to processing: on grounds relating to your particular situation, the right to object at any time to the processing of personal data which have as their legal basis a legitimate interest of the individual Data Controller, unless they can demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
right to lodge a complaint with a Supervisory Authority: without prejudice to any other administrative or judicial remedy, if you consider that the processing operations concerning you are in breach of the Regulation, you have the right to lodge a complaint with the Supervisory Authority of the Member State in which you reside or habitually work, or of the State where the alleged breach has occurred;
Data Controllers will provide information on the action taken with regard to the specific request without undue delay and at the latest within one month of receipt of the request. In order to exercise the above rights, a request may be made to the contact details listed at the end of this notice. Should the exercise of the rights listed above result in an actual and concrete prejudice to the interests protected under the provisions on money laundering, pursuant to Article 2-undecies of the Privacy Code, the scope of such rights and of certain related obligations of the Data Controller may be limited. In such circumstances, the exercise of these rights may be delayed, limited or excluded, for such time and to the extent that this constitutes a necessary and proportionate measure. If the conditions are met, a reasoned notice will be sent without delay.