INFORMATION ON THE PROCESSING OF PERSONAL DATA
We hereby inform you about the processing of your personal data with regard to management of the recruiting process, including interviews, meetings and online work events, in accordance with the provisions of the current personal data protection legislation and in compliance with articles 13-14 of Regulation (EU) 2016/679 (hereinafter "GDPR").
Data Controller and related contact data
The data controller (hereinafter also the "Data Controller" or "GVM") is Gruppo Villa Maria Spa, with registered office in Lugo (RA), Corso Garibaldi, 11.
Email: [email protected]
Telephone: 0545/909711
Contact details of the Data Protection Officer (DPO)
The Data Protection Officer (DPO) can be contacted at the following addresses:
Gruppo Villa Maria S.p.A., Piazza F. Trisi no 16 – 48022 Lugo (RA)
Phone 0545-909711
PEC (Certified email address): [email protected]
Nature of the data processed
Filling out the form dedicated to registration on the jobgvm.intervieweb portal and the related integrations on company websites entails GVM’s acquisition of the personal data entered by the user and essentially consisting of:
identification data such as name, address, telephone number, tax ID code, age, gender, place and date of birth, photographs, etc.; family data (e.g. marital status);
personal data relating to the evaluation of the job application such as educational qualifications, internships or professional training, professional skills and references, salaries, any company assets which are available as benefits or other;
information relating to user access.
Processing will also be extended to the personal data contained in the Curriculum Vitae which the candidate will make available by uploading it on the portal as well as to any other data referred to in additional communications which the candidate will possibly include as a specific note (e.g. letter of introduction).
All data originating during any tests and interviews which the candidate takes part in and during any assessment of mental and physical fitness for the position may also be processed.
Please omit particular categories of data pursuant to EU Regulation 2016/679 (relating, in particular, to health, religious beliefs and/or political opinions) and not pertinent to the application.
Purpose of processing
The personal data acquired will be processed exclusively for the purpose of selecting and recruiting candidates and, therefore, for the possible establishment of an employment/collaboration relationship with the Data Controller and/or with the affiliated and/or subsidiary companies belonging to the GVM Group.
By sending the aforementioned data, the data subject will obtain a personal account via which he/she can keep his/her CV updated. Therefore, the data subject's personal data are also used to keep this account active.
Legal basis of processing
The legal basis of data processing is the data subject's consent, without prejudice to GVM's need to carry out pre-contractual measures (specifically, evaluation of the job application for the possible establishment of an employment/collaboration relationship), adopted on request from the data subject in return for spontaneous submission of the application.
Processing methods
For the purposes indicated, collection, registration, storage and modification of data on paper, computerised and computer form may take place, with logics strictly related to said purposes and, in any case, always in compliance with the regulatory provisions aimed at guaranteeing, inter alia, confidentiality and data security.
Any use of the data for statistical purposes will be strictly anonymous.
The aforementioned processing will be carried out by company operators, expressly appointed persons authorised to process the data, suitably trained on the appropriate technical and organisational measures to be adopted and subject to constant supervision by the Data Controller and/or the internal data processing manager, if appointed.
The personal data acquired will be processed in compliance with the principles of lawfulness, correctness, transparency, proportionality, limitation of conservation, minimisation, integrity, accuracy and confidentiality, referred to in art. 5 of EU Regulation 2016/679.
Data transmission - categories of data recipients
Any hypothesis of data dissemination not imposed by law or expressly authorised by the data subject is excluded.
Personal data may be transmitted to companies, currently or in the future, belonging to GVM or managed by GVM, which may possibly be interested in the professional profiles available on the portal.
Furthermore, the data may be communicated to external companies to which the Data Controller may possibly entrust the selection and evaluation service of the personnel to be recruited.
Transfer to recipients in third countries
The management and storage of data takes place on the the Data Controller's server and/or that of of third-party companies appointed as external data processors. These servers are located at the Data Controller’s premises (in Italy) and in all cases within the European Union.
Personal data are not transferred outside the European Union. In any case, it is understood that, if necessary, the Data Controller may also transfer personal data to non-EU countries, guaranteeing henceforth that said transfer will take place in compliance with the applicable legal provisions (starting with EU Reg. No. 679/2016) and therefore entering into, if and as necessary, specific agreements which guarantee an adequate level of protection of the personal data or in any case adopting the standard contractual clauses provided for by the European Commission for the transfer of personal data outside the EU.
Existence of an automated decision-making process, including profiling
The data will not be subject to an automated decision-making process, including profiling, as per article 22, paragraphs 1 and 4, of EU Regulation no. 679/2016.
Data retention period
After 6 months and 2 weeks from the last access and update of the CV within the reserved area by the candidate, registration will be cancelled and data will be deleted.
Data subject's rights
Without prejudice to the exceptions and limitations provided for by the applicable legislation, pursuant to articles 15 and following of the GDPR, the data subjects can ask, without formalities:
- to access their personal data;
- for the rectification or integration of the data under certain conditions;
- for the erasure of the data under certain conditions;
- for the limitation of data processing, under certain conditions and within the limits established by current legislation;
- for the portability of data, i.e. to receive the data provided in a structured and commonly used format, and to transmit these to a different Data Controller, should the conditions for exercising such a right exist (in particular, when processing is based on consent or on an agreement and when the processing is carried out by automated means);
Data subjects also have the right:
- to object to the processing of their data should reasons exist relating to their personal situation, with particular reference to processing based on a legitimate interest of the Data Controller, including any profiling.
- not to undergo an automated decision-making process;
- to receive notification of serious violations that their data may suffer;
- to lodge a complaint with the Supervisory Authority (for Italy, the Italian data protection authority).
Without prejudice to the above, the data subject can withdraw consent to data processing at any time. Any revocation of consent does not affect the lawfulness of the processing based on the consent given prior to revocation.
For the purposes of exercising the rights listed above and/or of revoking consent to the data processing, the data subject can contact the Data Controller, at any time and without formalities, at the following addresses:
Gruppo Villa Maria S.p.A. – Privacy Office
Address: P.zza F. Trisi no. 16 - 48022 Lugo (RA)
Phone: 0545-909711
Email: [email protected]
Additional information
Lastly, the Candidate is invited to periodically update his/her data or to cancel his/her registration should he/she no longer be interested in joining the GVM world, bearing in mind that:
- GVM will NOT be able to take into consideration, for the purposes of the selections, curricula which have not been updated for more than 6 months and that after this deadline, only the name, contact details and generic indication of the position he/she is interested in will be used to ask the interested party for a possible update of the data and a confirmation of his/her availability;
- the registration will be cancelled and the data deleted in any case after 6 months and 2 weeks from the candidate’s last access and CV update within the reserved area.