The Data Controller of personal data, C.I.M.E.S. Spa (hereinafter the “Data Controller” or the “Company”), pursuant to and for the purposes of Regulation (EU) 2016/679 on the protection of personal data (hereinafter “GDPR”), provides data subjects with information on the processing of their personal data.

Data subjects

Individuals who submit their job application or who attend a job interview with the Data Controller.

Purposes and legal basis of processing

The personal data acquired or collected will be processed for purposes relating to the evaluation and selection of candidates for the establishment of an employment relationship, and also for any training preparatory to the job placement. The legal basis for processing pursuant to Article 6 of the GDPR is based on the performance of pre-contractual measures at the request of the data subject who submits the application, or, in the case of an introductory interview, on the performance of agreements with the data subject and on the Data Controller’s legitimate interest. Providing personal data is optional: failure to provide the data, or providing incorrect data, may make it impossible for the Data Controller to pursue the stated purposes and to ensure the appropriateness of the processing.

Processing of special categories of personal data

During the assessment, the Data Controller may become aware of special categories of personal data as defined by Article 9 of the GDPR (“health data and health status, trade union or political affiliations, religious or philosophical beliefs, biometric and genetic data”). Pursuant to Legislative Decree 101/2018, the processing of such data communicated by the data subject for the purposes of assessment for employment is permitted without the need for consent, with the exception of genetic data, which cannot be processed even with the data subject’s consent. In compliance with Article 9 of the GDPR, processing of these data will be carried out only if necessary; genetic and biometric data will not be processed in any case.

Methods of processing and retention

Processing is carried out through manual procedures on paper files and through IT procedures and electronic tools on digital archives, by personnel authorized by the Data Controller pursuant to Article 29 of the GDPR, by other companies that are parent companies, subsidiaries or affiliates pursuant to Article 2359 of the Italian Civil Code, and also by third parties (e.g., payroll/labour consultant) appointed as our data processors pursuant to Article 28 of the GDPR for the relevant processing activities, in compliance with the principles set out in Articles 5 and 6 of the GDPR and with the adoption of appropriate security measures. In compliance with the principles of lawfulness, purpose limitation and data minimization, the retention period of CVs and other candidates’ data held by the Data Controller is set for an indicative period of two years from collection.

Regulation (EU) 2016/679 – Articles 15 to 22 – Data subject’s rights

Pursuant to Article 37 of the GDPR, the Data Controller is not subject to the obligation to appoint a Data Protection Officer. The data subject has the right to contact the Data Controller, using the contact details indicated at the bottom of the page, to exercise the rights provided by applicable law: to obtain information on the existence of their personal data, even if not recorded, and to receive them in an intelligible form; to request deletion, communication, updating, rectification, and integration of their personal data. The data subject has the right to withdraw consent at any time for optional processing activities; however, withdrawal does not affect processing already carried out. The data subject has the right to lodge a complaint with the Italian Data Protection Authority: see the website www.gpdp.it for further details.