Information pursuant to Art. 13 EU Reg. April 27, 2016 No. 679
Pursuant to Article 13 of the European Regulation, on the protection of individuals with regard to the processing of personal data, we inform you that the personal data of the candidate for the establishment of an employee relationship are processed in accordance with the following principles and rules.
General principles of processing
Processing will be carried out by means of collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction and will be carried out by the owner, managers and persons authorized for processing.
Personal data are: processed in a lawful, correct and transparent manner; collected for specified, explicit and legitimate purposes and thereafter will be processed in a manner not incompatible with those purposes; adequate, relevant, limited to what is necessary in relation to the purposes for which they are processed; accurate and up-to-date, committing the co-owner to take the necessary measures to delete or rectify the data in relation to the purposes for which they are processed; kept in a form that allows the identification of the interested party for the time strictly necessary to achieve the purposes for which they are processed; processed with the utmost confidentiality, both with computer and paper tools, in compliance with the principles dictated by the European Regulation on the protection of personal data, the prescriptions issued by the Control Authority and in any case in such a way as to ensure adequate security, including protection, with appropriate technical and organizational measures, from unauthorized or unlawful processing or from loss, even accidental.
(a) Identity and contact details of the co-owner of data processing
The co-owners of the data processing, in co-ownership, are Arithmos S.r.l., with registered office in Italy, Via Germania 2, 37136 Verona VAT N. IT03568990232, and Arithmostech Ltd., with its place of business at Booths Hall, Suite M3, Chelford Road, Knutsford, WA16 8GS, United Kingdom. The Joint Controlling Agreement is available here.
For the purposes of exercising the rights provided by the Regulations and for any request relating to personal data, the data subject may contact the co-owners of the data processing by sending a communication to the email address firstname.lastname@example.org.
(b) Purpose and legal basis of data processing
The personal data provided by the candidate will be processed by Arithmos S.r.l. exclusively for personnel search and selection activities and in particular:
(a) to carry out the necessary assessments regarding the possible establishment of an employment or collaboration relationship with our company;
b) in case of positive evaluation, prepare the necessary documentation for the establishment of the employment or collaboration relationship.
The data processing is lawful in accordance with Art. 6, letter b) of the European Regulation 679/2016 insofar as it is aimed at implementing pre-contractual measures at the request of the data subject.
Where the processing concerns particular categories of data (for example, in the event that the CV refers to the candidate’s membership in protected categories), the processing of the data provided for the purposes of personnel search and selection has a legal basis in the consent of the data subject pursuant to Art. 9 lett. a) of European Regulation 679/2016.
(c) Possible recipients or categories of recipients of personal data
The personal data that the co-owners of the data processing will come into possession of are not subject to dissemination.
The data may be known by the persons in charge and those responsible for processing. In particular, the data may be known by other employees and/or collaborators, internal and external, of the undersigned Facility (e.g., employees working within the Personnel Department; external company that has access to the data controller’s computer system).
(d) Data transfer to third countries
ArithmosTech is a company with registered office and business place in United Kingdom, a country that offers – according to European Commission – an adequate protection in the data processing.
The transfer will be performed in compliance with the conditions of lawfulness set forth in Articles 44 et seq. of European Regulation 679/2016.
(e) Period of storage of personal data
The data shall be kept for a period not exceeding that necessary to pursue the purposes explained above and in any case for a period not exceeding two (2) years.
(f) Right to withdraw consent
The processing of the applicant’s personal data for the establishment of the employment relationship does not have a legal basis in the consent of the person concerned. Therefore, a candidate who has disclosed his or her personal data does not have the right to revoke consent to the processing of personal data; in any case, revocation of consent to the processing does not affect the lawfulness of the processing based on the consent given before revocation.
(g) Right to lodge a complaint
The data subject has the right to propose a complaint to the Supervisory Authority of the country where the co-owners of the data processing have their registered office.
(h) Mandatory or optional nature of providing data
The provision of personal data is not mandatory, but optional.
However, the provision of the data is strictly necessary for the pursuit of the purposes of personnel search and selection, and any refusal on the part of the candidate may result in the impossibility of carrying out the job proposal or offer.
(i) Data subject’s rights
The Data Subject has the right to obtain access to personal data from the co-owner of the data processing.
In particular, the Data Subject has the right to obtain from the co-owner of the data processing confirmation as to whether or not personal data concerning him or her is being processed and, if so, access to the personal data and the following information:
(a) the origin of the personal data, if the data are not collected from the data subject;
(b) the purposes and methods of processing;
(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if recipients in third countries or international organizations;
(d) the expected period of retention of personal data, or, if this is not possible, the criteria adopted to determine this period;
(e) the existence of the data subject’s right to request from the controller the rectification or erasure of personal data or the restriction of the processing of data concerning him or her or to object to their processing;
(f) the right to lodge a complaint with a supervisory authority;
(g) the existence of an automated decision-making process, including profiling, and, at least in such cases, meaningful information about the logic used, as well as the importance and the expected consequences of such processing for the data subject;
(h) where the data are transferred to a third country or international organization, the adequate safeguards under Article 46 of Regulation 679/2016 of such transfer.