Privacy Notice pursuant to Art. 13 of Regulation (EU) 2016/679 – Candidates
By means of this document (the “Notice”) the Data Controller, as defined below, wishes to inform you of the purposes and methods of the processing of your personal data and of the rights granted to you by Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”). This Notice may be supplemented by the Controller should any additional services requested by you entail further processing.
Data Controller
GKSD S.R.L. (Tax Code and VAT no. 11451170960), with registered office at Via Senato 12, 20121 Milan (MI), Italy, e-mail: info@gksdholding.com (hereinafter the (“Data Controller”)
Types of data processed
The processing activities carried out are aimed at acquiring the following personal data:
- Personal details
- Job Title
- Further ordinary data contained in the Curriculum Vitae
Categories of data subjects
The processing activities carried out are addressed to the following categories of data subjects: Candidates
Purposes, Legal Basis and Retention Periods
Purpose | Legal Basis | Retention Period |
A) Purposes connected with candidate sourcing/selection and assessment activities - · the collection and analysis of curricula vitae; · the management of individual interviews; · the verification of professional, educational and experience requirements in relation to the profile sought; · communications with the candidate providing updates on the status of the selection process
| Ordinary data Performance of a contract to which the data subject is party or of pre-contractual measures, pursuant to Art. 6(1)(b) of the GDPR.
| The data will be retained until the conclusion of the recruiting and candidate assessment process, for a maximum of 24 months. Curricula that are not in line with open and/or future positions will be deleted immediately. |
B) To exercise or defend a right of | Ordinary data Pursuit of the legitimate interest of the data controller, pursuant to Art. 6(1)(f) of the GDPR
| The provision of personal data is mandatory; should it not be provided, it will not be possible to proceed with the establishment of the employment relationship. For the entire duration of the complaint and/or of the out-of-court and/or court proceedings, until the expiry of the time limits for bringing judicial actions and/or challenges. |
C) Handling of data subject rights | Ordinary data The processing is necessary for compliance with obligations laid down by laws, regulations and EU legislation, pursuant to Art. 6(c) of the GDPR
| The provision of personal data is optional; however, should it not be provided, it will not be possible to handle requests made pursuant to Art. 15 of Regulation (EU) 2016/679 (GDPR). The data will be retained for a maximum period of five years from the fulfilment of the request. |
Processing methods
Data are processed both electronically and in paper form.
Transfers of data outside the EU
Personal data will be processed exclusively within the European Economic Area (EEA). No transfer of data to third countries outside that area is envisaged. In any event, the data will be processed in compliance with security measures adequate to ensure the protection of the rights and freedoms of data subjects.
Recipients of the data
Personal data may be processed by the staff of the Data Controller duly appointed as persons authorised to process data pursuant to Art. 29 of the GDPR.
Personal data may also be shared with providers of services strictly related and instrumental to the Controller's activities, which typically act as data processors pursuant to Art. 28 of the GDPR. The complete list may be obtained by contacting the Controller at the addresses indicated above.
Rights of the data subject - complaint to the supervisory authority
In relation to the processing described in this Notice, as a data subject you may, under the conditions laid down by the GDPR, exercise the rights set out in Articles 15 to 22 of the GDPR and, in particular, the following rights:
right of access – Article 15 GDPR: the right to obtain confirmation as to whether or not personal data concerning you are being processed and, in that case, to obtain access to your personal data;
right to rectification – Article 16 GDPR: the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data;
right to erasure (right to be forgotten) – Article 17 GDPR: the right to obtain, without undue delay, the erasure of personal data concerning you. The right to erasure does not apply to the extent that the processing is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or for the establishment, exercise or defence of legal claims.
right to restriction of processing – Article 18 GDPR: the right to obtain restriction of processing where: a) the data subject contests the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) the personal data are required by the data subject for the establishment, exercise or defence of legal claims; d) the data subject has objected to the processing, pending verification as to whether the legitimate grounds of the controller override those of the data subject.
right to data portability – Article 20 GDPR: the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning you provided to the Controller, and the right to transmit them to another controller without hindrance, where the processing is based on consent and carried out by automated means. In addition, the right to have your personal data transmitted directly from this controller to another controller, where technically feasible;
right to object – Article 21 GDPR: the right to object, at any time, to the processing of personal data concerning you based on the lawfulness condition of legitimate interest, including profiling, unless there are legitimate grounds for the Controller to continue the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
right not to be subject to automated decision-making – Article 22 GDPR: the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless this is necessary for entering into or performing a contract or you have given your consent. In any event, automated decision-making will not concern your personal data and you may at any time obtain human intervention on the part of the data controller, express your point of view and contest the decision.
right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): http://www.garanteprivacy.it;
to withdraw consent given, on any occasion and as easily as it was given, without affecting the lawfulness of processing based on the consent given before its withdrawal.
The above rights may be exercised vis-à-vis the Controller by contacting the references indicated above.
The exercise of your rights as a data subject is free of charge pursuant to Article 12 of the GDPR. However, in the case of manifestly unfounded or excessive requests, including because of their repetitive character, the Controller may charge you a reasonable fee taking into account the administrative costs incurred in handling your request, or refuse to act on the request.
Finally, please note that the Controller may request further information necessary to confirm the identity of the data subject.