INFORMATION FORM WORK WITH US

This information is provided to users who fill in the form (form) of spontaneous application for a job position proposed by the website www.cittadinidellordine.com of Citizens of the Order, in accordance with Article 13 of the European Regulation (EU) 2016/679 on the protection of personal data (GDPR).

Data controller

The data controller (hereinafter “Controller”) is Cittadini dell’Ordine S.p.A., with registered office in Via Lancia 6/A – 39100 Bolzano (BZ) and administrative office in Via dell’Arrigoni, 60/120 – 47522 Cesena (FC) – Tax code and VAT number 02415990213. Data Protection Officer (DPO) is Uomo & Ambiente S.r.l. Benefit Society, whose contact person Ing. Gianluigi Carbone can be contacted at the e-mail address privacy@cittadinidellordine.com.

Source and Type of Data

The personal, identifying (name and surname, date and place of birth, citizenship, sex, age, tax code, generalities, etc.) and contact data (address or other personal identification elements, such as telephone, e-mail, etc.) as well as pertaining to the issues that identify the area of interest or to one’s professional profile (education and work experience, qualification, etc.) and attributable to the curriculum vitae.) and traceable to the curriculum vitae, as well as possibly of a “particular” nature (where, for example, suitable to reveal the membership of protected categories) are conferred spontaneously by the interested party through the form (form) proposed by the website on the occasion of:

• Spontaneous submission of one’s application;
• response to a job advertisement;
• sending the curriculum vitae;
• Request to participate in selection and evaluation interviews.

Purpose of processing

The personal data of those (interested parties) who, either spontaneously or as a result of a personnel search, fill in the fields provided by the “work with us” form and send their curriculum vitae, are collected and processed to the extent strictly necessary to enable them to take advantage of telematic services having the following purposes:

• Submit an unsolicited application or respond to an advertisement;
• Evaluate and select candidates for a job position;
• Propose any job offers consistent with the professional profile of the person concerned.

Legal Basis

The legal basis for the processing of personal data, consisting of the receipt of a request or spontaneous application by the user, is based on the legitimate interest of the Data Controller. The personal data of the interested party, freely given by filling in the appropriate form (form) and/or sending their CV, are in fact legitimately collected and processed for the execution of measures taken (evaluation of the application and selection of candidates) at the explicit request of the interested party. Useful legal basis for the processing of any data of a “particular” nature (so-called sensitive data) spontaneously conferred by the user, is constituted by explicit consent, manifested by declaration or unequivocal positive action (such as checking the box at the bottom of the form).

Mandatory or optional nature of providing data

The data subject may refuse to provide the Data Controller with his or her personal data, as the provision of such data is optional. However, completion of the indicated fields is essential in order to be able to fulfill the requests received. Any refusal to provide all or part of the requested data may therefore jeopardize the successful outcome of the application and may result in our inability to select and evaluate the submitted application.

Mode of treatment

Personal data will be processed by electronic means, including automated means, in accordance with the principles of lawfulness, necessity and relevance, taking safeguards to identify adequate security measures at any stage of the processing, having regard to the specific purposes of processing. In this regard, the anonymization of personal data and the removal of identifying data shall be carried out if there is no need to process the data in an identifiable form for the aforementioned processing purposes and, in any case, upon expiry of the retention period indicated in the following paragraph. The Data Controller does not carry out processing that consists of automated decision-making processes (such as profiling) on the data of users who, either spontaneously or as a result of a job search, intend to use this service. The data will be processed by individuals expressly authorized and trained in personal data protection. The data may be accessed, incidentally, by ICT personnel and computer technicians (including outsourced) who oversee the operation of the computer system.

Data retention

The Data Controller will retain personal data for as long as is strictly necessary to pursue the purposes stated in this information, as long as the position for which the CV was sent is available and even beyond, if further conditions and interests exist in the search and selection of personnel for a job position, and in any case for a period not exceeding twelve months from their receipt.

Data recipients

Personal data processed by the Data Controller will not be disseminated, i.e., it will not be disclosed to unspecified parties, in any possible form, including making it available or mere consultation. Personal data may, on the other hand, be communicated, to the extent strictly necessary to perform services or services on our behalf, to third parties (we mention, by way of example, companies that provide IT services, companies that provide cloud storage services, companies specializing in the management, development and maintenance of websites, etc.) that we use exclusively for the provision of services related to the purpose pursued, which our organization, in order to ensure greater protection, has from time to time appointed as Data Processors (art. 28 of the GDPR) of the processing operations they put in place. The list of data processors, identified and appointed in writing, is available from the Data Controller. Finally, personal data may be communicated to the subjects entitled to access them by virtue of provisions of law, regulations, and EU legislation.

Data Transfer

There are no plans to transfer personal data to a third country or international organization (Art. 13(1)(f) GDPR) outside the European Union (or the European Economic Area). However, the Data Controller reserves the option to use cloud services, in which case, service providers will be chosen from those companies that can provide specific third-country adequacy guarantees recognized through a decision of the European Commission or, in the absence thereof, suitable contractual or covenant-based guarantees provided by the data controllers involved (including Binding Corporate Rules “BCRs” and Standard Contractual Clauses “SCCs”).

Rights of the data subject

The data subject, to whom the personal data refer, is entitled to exercise his or her rights (under Articles 15-22 of the GDPR) at any time in order to obtain:

• confirmation as to whether or not personal data concerning him or her are being processed and to obtain access to the data and the following information (purpose of processing, categories of personal data, recipients and/or categories of recipients to whom the data have been and/or will be disclosed, storage period);
• rectification of inaccurate personal data concerning him/her and/or supplementation of incomplete personal data, including by providing a supplementary statement;
• The deletion of personal data, in the cases provided for by current legislation;
• restriction (as a means of reacting to unlawful or improper processing) and/or opposition (as a manifestation of willingness to have a particular processing operation cease) to the processing of personal data (it being understood that this right is applicable only if there are no legitimate grounds for processing that override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of a right in a court of law) in the cases provided for by current legislation;
• the portability of data, pertaining to the data subject and provided by the data subject, in order in particular to request from the data controller the personal data concerning him/her and/or to request from the data controller the direct transmission of his/her data to another data controller (it is understood that this right applies only if the processing is based on contract or consent and is carried out through electronic processing) in the cases provided for by the applicable legislation.

Regarding the exercise of his or her rights, the data subject may address his or her requests through specific communication by mail addressed to the Data Controller (at the above address) or by sending communication to the e-mail address privacy@cittadinidellordine.com, specifying the subject of his or her request and the right he or she legitimately intends to exercise.

Right of complaint

Data subjects who believe that the processing of personal data relating to them occurs in violation of the provisions of the Regulations, have the right to lodge a complaint with the competent supervisory authority (Guarantor for the Protection of Personal Data) in the manner provided on the website www.garanteprivacy.it (pursuant to Article 77) or to take appropriate legal action pursuant to Article 79 of the Regulations themselves (GDPR).