Last update date: 07/12/2018

PRIVACY INFORMATION PURSUANT TO ART. 13 OF EU REGULATION 2016/679

Definitions

“Personal data” (as per art. 4 number 1 of the EU Regulation 2016/679): any information relating to an identified or identifiable individual («person concerned»); an identifiable person is an individual that can be identified, directly or indirectly, by particular reference to an identifier such as name, identification number, information relating to location, on-line identification data or to one or more characteristic elements of their physical, physiological, genetic, mental, financial, cultural or social identity.
“Processing”, (as per art. 4 number 2 of the EU Regulation 2016/679) means any operation or set of operations, which is performed with or without the aid of automated processes and performed upon personal data or a set of personal data, such as the collection, registration, organisation, structuring, storage, modification or adaptation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Who is the Data Controller? And how can I contact him?

The Data Controller:

CALZAVARA S.p.A. with sole shareholder
Registered office:
Piazza Camillo Finocchiaro Aprile, 3 int. B27
00181 Roma (RM)
Ph. +39 06 700 9315
Email: info@calzavara.it

Local Unit:
Via Corecian, 60
33031 Basiliano (UD)
Ph. +39 0432 84831
Email: info@calzavara.it

1.1 Purposes in accordance with fulfilling a legal obligation (Art. 6 paragraph 1 (c) of GDPR)

a. Fulfillment of legal obligations related to the candidacy and possible activation of professional insertion (eg. verification of belonging to a protected category)

1.2 Purposes in accordance with the expression of consent (Art. 6 paragraph 1 (a) of GDPR)

a. Management of the selection and evaluation process of the candidate’s CV in its broadest sense.

2. The categories of data that are processed

The data processed by the Data Controller is exclusively “personal data” (under Art. 4.1 of the GDPR).

In particular, the pertinent categories of personal data may be, including without limitation:

• Biographical and identification data
• Contact details
• Particular data as suitable to reveal the state of health (eg. belonging to protected categories)

3. Recipients or categories of recipients of the personal data (under art. 13 paragraph 1 (e) of the GDPR)

Within the above-mentioned purposes, the Data Controller may communicate your data:

• to companies that are responsible for the processing and the sending of material and communications relating to the past or present relationship with the person concerned;
• to companies and professional operators who provide computing services, including electronic data processing, software management and information technology consulting;
• Occupational doctor (if you need a preventive visit or other initiative in favor of the health plan)
• Payroll study / employment consultants, professional firms in general (lawyers, accountants, etc.)

4 Conservation period of the data.

4.1 With reference to section 1.1

The personal data collected for the purposes referred to in point a) for legal obligations, will be kept for a period not exceeding 24 months.

Rights of the person concerned (art. 13 paragraph 2 (c) of the GDPR)

For the purposes referred to in this section, failure to collect personal data, even in part, by opposing the data subject makes it impossible to proceed with the realization of the purposes set out in this section. On the other hand, when the data are no longer necessary to meet the obligations set out in section 3.1, they are regularly deleted, if their cancellation is impossible or possible only when a disproportionate effort is made due to a particular storage mode, the data will not be treated and must be stored in areas that are not accessible.

4.2 With reference to section 1.2

The data collected for the purposes referred to in point a) on the basis of the consent of the interested party will be kept for a period not exceeding 24 months.

Rights of the person concerned (art. 13 paragraph 2 (c) of the GDPR)

The interested party may revoke his consent at any time and the effects will start from the moment of revocation, subject to the terms established by law. In general terms, withdrawal of consent only takes effect for the future. The treatment that was carried out before the withdrawal of consent is not affected by this for which it remains legal.
When the data are no longer necessary to meet the obligations set out in this “consent” section, these are regularly deleted, if their cancellation is impossible or possible only when a disproportionate effort is made due to a particular mode of preservation. it can be treated and must be stored in areas that are not accessible.
Failure or partial consent may not guarantee the complete provision of services, limiting them to the purposes described above.

5. Rights of the person concerned

The person concerned, in relation to the personal data object of this privacy statement, may exercise the rights as described in the EU Regulation, which are reported below:

• right to access of the person concerned [art. 15 of the EU Regulation] (which consists in the possibility to be informed about the processing carried out on his/her personal data and to receive a copy of it);
• right to rectification of the personal data [art. 16 of the EU Regulation] (the person concerned has the right to rectify incorrect personal data relating to him/her);
• right to erasure of the personal data without undue delay (“Right to be forgotten”) [art. 17 of the EU Regulation] (the person concerned has, and shall have, right to cancellation of his/her own data);
• right to limitation of processing of the personal data in the cases established by art. 18 of the EU Regulation including in case of unlawful data processing or complaint regarding the accuracy of the personal data by the person concerned [art. 18 of the EU Regulation];
• right to data portability [art. 20 of the EU Regulation], (the person concerned may request his/her personal data in a structured format so that it may be transmitted to another Data Controller, in the cases established by the same article);
• right to object to the processing of the personal data [art. 21 of the EU Regulation] (the person concerned has, and shall have, the right to object to the processing of the personal data concerning him/her in the cases established and regulated by art. 21 of the EU Regulation);
• right not to be subject to automated decision-making processes [art. 22 of the EU Regulation] (the person concerned has, and shall have, the right to not be subject to a decision based purely on automated processing).

The above-mentioned rights may be exercised in accordance with what has been established by the EU Regulation by sending an email to privacy@calzavara.it

Calzavara S.p.A., pursuant to art. 19 of the EU Regulation, will proceed to informing the recipients to whom the personal data was communicated of any rectification, cancellation or limitation requested of the processing, where this is possible.

When the processing purposes pursued by Calzavara S.p.A. have consent as their legal basis, the person concerned may proceed, at any time, to revocation by sending an email to privacy@calzavara.it. In accordance with art. 7 of the EU Regulation the revocation of consent does not affect the lawfulness of the processing based on the consent given before the revocation.

Exercise of the rights of the person concerned

The person concerned, in relation to the personal data object of this privacy statement, may exercise the rights as described in the EU Regulation, which are reported below:

• right to access of the person concerned [art. 15 of the EU Regulation]: the person concerned has the right to obtain confirmation from the Data Controller whether any such personal data is being processed and, in this case, to access the information expressly envisioned by the mentioned article, including without limitation the processing purposes, the category of the data and recipients, the conservation period, the existence of the right to erasure, rectification or limitation, the right to lodge a complaint, all information available regarding the origin of the data, the existence of an automated decisional process in accordance with art. 22 of the Regulation, as well as a copy of such personal data.
• right to rectification [art. 16 of the EU Regulation]: the person concerned has the right to obtain rectification and/or integration of the inaccurate personal data which concern him by the Data Controller, without undue delay;
• right to cancellation (“right to be forgotten”) [art. 17 of the EU Regulation]: the person concerned has the right to erasure of the personal data relating to him/her without undue delay, if one of the grounds expressly provided for in the aforementioned article, including without limitation the lack of necessity of the processing with respect to the purposes, the revocation of the consent on which the processing is based, objection to the processing in case it is based on a legitimate interest that does not prevail, unlawful use of the data, cancellation required under law, data of minors processed in absence of the conditions for applicability provided for by art. 8 of the Regulation;
• right to limitation of the processing [art. 18 of the EU Regulation]: in the cases established by art. 18, including unlawful processing, complaint regarding the accuracy of such data, objection by the person concerned and the lack of necessity of the processing by the Data Controller, the data of the person concerned shall only be processed for conservation subject to his consent and the other cases expressly established by the mentioned article;
• right to the portability of the data [art. 20 of the EU Regulation]: the person concerned, in case the processing is based on consent or on a contract and carried out by automated means, may request to receive his/her personal data in structured format, commonly used and readable on an automatic device, and has the right to transmit them to another Data Controller;
• right to object [art. 21 of the EU Regulation]: the person concerned has the right to object to the processing of this personal data, in case the processing is based on a legitimate interest that does not prevail or is carried out for direct marketing purposes;
• right not to be subject to automated decision-making processes [art. 22 of EU Regulation]: the person concerned has the right to not be subject to a decision, including profiling, based merely on automated processing (for example carried out exclusively by electronic instruments or computer programs).

The aforementioned description does not replace the text of the articles mentioned to which are referred in full and the full text of the EU regulation can be read at the link below or at the following link.

6. Right to lodge a complaint (art. 13 paragraph 2 (d) of the GDPR)

The person concerned, should he/she feel that his/her rights have been compromised, has the right to lodge a complaint to the Italian Data Protection Authority. For additional information relating to the rights and exercising these, please refer to http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524 or send a written communication to the Italian Data Protection Authority (Autorità Garante per la Protezione dei Dati Personali), Piazza Monte Citorio n. 121, 00186 Rome.

7. Possible consequence of a failure to communicate the data (art. 13 paragraph 2 (e) of the GDPR)

Please note that in case the processing purposes have a legal or contractual obligation (or pre-contractual) as legal basis, the person concerned must provide the requested data.

It this is not the case, it will be impossible for the Data Controller to proceed with the pursuit of the specific purposes of the processing.

8. Existence of an automated decisional process (including profiling)

Currently the use of purely automated decisional processes as mentioned in detail by article 22 of the GDPR is excluded. Should it in the future be decided to establish such processes for single cases, the person concerned will receive a separate notification in case this is envisioned by law or an update of this privacy statement.

9. Methods of processing

The personal data will be processed in paper, electronic and telematic form and included in the relevant databases (potential clients, clients, users, etc.) which may be accessed by, and thus they may gain knowledge of them, the staff expressly designated by the Data Controller such as Controllers or Subjects authorised to process personal data, who may consult, use, elaborate, compare or carry out any other activity, also automated, in compliance with the applicable legal provisions to guarantee, amongst others, the confidentiality and the safety of the data as well as their accuracy, their updating and the relevance of the data for the purposes declared.

10. Right to lodge a complaint (art. 13 paragraph 2 (d) of the GDPR)

The person concerned, should he/she feel that his/her rights have been compromised, has the right to lodge a complaint to the Italian Data Protection Authority, according to the methods indicated by this Authority at the following Internet address http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524 or by sending a written communication to the Italian Data Protection Authority, Piazza Monte Citorio n. 121, 00186 Rome.

11. Possible consequence of a failure to communicate the data (art. 13 paragraph 2 (e) of the GDPR)

Please note that in case the processing purposes have a legal or contractual obligation (or pre-contractual) as legal basis, the person concerned must provide the requested data.
It this is not the case, it will be impossible for the Data Controller to proceed with the pursuit of the specific purposes of the processing.

12. Existence of an automated decisional process (including profiling)

Currently the use of purely automated decisional processes as mentioned in detail by article 22 of the GDPR is excluded. Should it in the future be decided to establish such processes for single cases, the person concerned will receive a separate notification in case this is envisioned by law or an update of this privacy statement.

13. Methods of processing

The personal data will be processed in paper, electronic and telematic form and included in the relevant databases which may be accessed by, and thus they may gain knowledge of them, the staff expressly designated by the Data Controller such as Controllers or Subjects authorised to process personal data, who may consult, use, elaborate, compare or carry out any other activity, also automated, in compliance with the applicable legal provisions to guarantee, amongst others, the confidentiality and the safety of the data as well as their accuracy, their updating and the relevance of the data for the purposes declared.

---

 

Notice regarding minors of under 14 years

The minors of under 14 years cannot provide personal data. Calzavara S.p.A. shall not be responsible in any way for the collection of personal data or false declarations supplied by the minor and in the event that use of these were to be identified, Calzavara S.p.A. shall facilitate the right of access and of erasure forwarded by the legal guardian or whoever holds parental responsibility.

---

 

Exercise of the rights of the person concerned

The person concerned, in relation to the personal data object of this privacy statement, may exercise the rights as described in the EU Regulation, which are reported below:

• right to access of the person concerned [art. 15 of the EU Regulation]: the person concerned has the right to obtain confirmation from the Data Controller whether any such personal data is being processed and, in this case, to access the information expressly envisioned by the mentioned article, including without limitation the processing purposes, the category of the data and recipients, the conservation period, the existence of the right to erasure, rectification or limitation, the right to lodge a complaint, all information available regarding the origin of the data, the existence of an automated decisional process in accordance with art. 22 of the Regulation, as well as a copy of such personal data.
• right to rectification [art. 16 of the EU Regulation]: the person concerned has the right to obtain rectification and/or integration of the inaccurate personal data relating to him/her by the Data Controller, without undue delay;
• right to cancellation (“right to be forgotten”) [art. 17 of the EU Regulation]: : the person concerned has the right to erasure of the personal data relating to him/her without undue delay, if one of the grounds expressly provided for in the aforementioned article, including without limitation the lack of necessity of the processing with respect to the purposes, the revocation of the consent on which the processing is based, objection to the processing in case it is based on a legitimate interest that does not prevail, unlawful use of the data, cancellation required under law, data of minors processed in absence of the conditions for applicability provided for by art. 8 of the Regulation;
• right to limitation of the processing [art. 18 of the EU Regulation]: in the cases established by art. 18, including unlawful processing, complaint regarding the accuracy of such data, objection by the person concerned and the lack of necessity of the processing by the Data Controller, the data of the person concerned shall only be processed for conservation subject to his/her consent and the other cases expressly established by the mentioned article;
• right to the portability of the data [art. 20 of the EU Regulation]: the person concerned, in case the processing is based on consent or on a contract and carried out by automated means, may request to receive his/her personal data in a structured format, commonly used and readable on an automatic device, and has the right to transmit them to another Data Controller;
• right to object [art. 21 of the EU Regulation]: the person concerned has the right to object to the processing of this personal data, in case the processing is based on a legitimate interest that does not prevail or is carried out for direct marketing purposes;
• right not to be subject to automated decision-making processes [art. 22 of EU Regulation]: the person concerned has the right to not be subject to a decision, including profiling, based merely on automated processing (for example carried out exclusively by electronic instruments or computer programs).

The aforementioned description does not replace the text of the articles mentioned therein to which are referred in full and the full text of the EU regulation can be read at the following link

Right to lodge a complaint
The person concerned, should he/she feel that his/her rights have been compromised, has the right to lodge a complaint to the Italian Data Protection Authority, according to what is specified by mentioned Authority at the following Internet address:
http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524.

For more detailed information regarding the rights of the persons concerned set out by the Guarantor, please refer to the following link.

---

Amendments and updates

This privacy statement shows the last update date in its header.

Calzavara S.p.A. may also make amendments and/or integrations to mentioned privacy policy also as a consequence of possible subsequent legislative amendments and/or integrations.

---

Regulatory references relating to the rights of the person concerned

Article 15
Right to access of the person concerned

1. The person concerned has the right to obtain confirmation from the Data Controller whether any such personal data is being processed and, in this case, to access the personal data and the following information:

a) the processing purposes;
b) the categories of the personal data in question;
c) the recipients or the categories of recipients to who the personal data have been or shall be communicated, especially if recipients of third counties or international organisations;
d) if possible, the planned conservation period of the personal data or, if this is not possible, the criteria used to determine such a period;
e) the existence of the right of the person concerned to request the Data Controller to rectify or erase personal data or to limit the processing of the personal data that concern him/her or to object to their processing;
f) the right to lodge a complaint to supervisory authorities;
g) in the event the data was not collected from the person concerned, all information available relating to their origin;
h) the existence of an automated decisional process, including profiling as set forth in article 22, paragraphs 1 and 4 and, at least in these cases, significant information relating to the logic used, as well as the importance and the consequences of such processing for the person concerned.

2. In the event the personal data is transferred to a third country or to an international organisation, the person concerned has the right to be informed of the existence of adequate guarantees pursuant to article 46 on transfer.

3. The Data Controller shall supply a copy of the processed personal data. In case the person concerned requests additional copies, the Data Controller may charge a reasonable fee based on administrative costs. If the person concerned presents the request via electronic means, and unless stated otherwise by the person concerned, the information shall be supplied in a commonly used electronic format.

4. The right to obtain a copy as laid down in paragraph 3 shall not affect the rights and freedoms of others.

Article 16
Right to rectification

The person concerned has the right to obtain rectification and/or integration of the inaccurate personal data relating to him/her by the Data Controller, without undue delay. Bearing in mind the purpose of the processing, the person concerned has the right to obtain integration of incomplete personal data, also by supplying a supplementary statement.

Article 17
Right to cancellation («right to be forgotten»)

1. The person concerned has the right to obtain erasure of the personal data relating to him/her by the Data Controller without undue delay and the Data Controller has the obligation to erase the personal data without undue delay, if one of the following grounds exists:

a) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
b) the person concerned revokes the consent on which the processing is based in compliance with article 6, paragraph 1, letter a), or with article 9, paragraph 2 letter a), and if there is no other legal ground for the processing;
c) the person concerned objects to the processing in accordance with article 21, paragraph 1 and there is no legitimate ground that prevails to proceed to processing, or objects to the processing in accordance with article 21, paragraph 2;
d) the personal data has been processed unlawfully;
e) the personal data needs to be erased in order to fulfil a legal obligation established by the EU law or a Member State to which the Data Controller is subject;
f) the personal data is collected with regard to the offering of information society services referred to in article 8, paragraph 1.

2. The Data Controller, in the event he has made the personal data public and is obliged, pursuant to paragraph 1, to erase them, bearing in mind the available technology and the costs for the implementation, will adopt reasonable measures, also technical to inform the Data Controllers that they are processing the personal data on request of the person concerned to erase all links, copies or reproduction of his/her personal data.

3. Paragraphs 1 and 2 shall not apply to the extent in which the processing is necessary:

a) to exercise the right to the freedom of expression and information;
b) to fulfil a legal obligation which requires the processing established by the EU law or a Member State to which the Data Controller is subject or to carry out work in the public interest or in the exercise of official authority vested in the Data Controller;
c) for reasons of public interest in the public health pursuant to article 9, paragraph 2, letters h) and i) and of article 9, paragraph 3;
d) for public archiving, scientific or historic research purposes, or for statistic purposes in accordance with article 89, paragraph 1 to the extent in which the right under paragraph 1 may make it impossible or seriously affect the pursuit of the objectives of such processing; or
e) for the determination, execution or defence of a right before a court.

Article 18
Right to limitation of the processing

1. The person concerned has the right to obtain the limitation of the processing from the Data Controller in one of the following assumptions:

a) the person concerned disputes the accuracy of the personal data, for the time required for the data controller to verify the accuracy of such personal data;
b) the processing is unlawful and the person concerned objects to the erasure of the personal data but rather requests that the use of them is limited;
c) even though the data controller does not require them any more for processing purposes, the personal data is necessary for the person concerned in order to determine, exercise or defend a right before a court;
d) the person concerned has objected to the processing in accordance with article 21, paragraph 1 pending verification in relation to the prevalence of the legitimate grounds of the Data Controller with respect to those of the person concerned.

2. If the processing is limited in accordance with paragraph 1, such personal data is processed, with the exception of storage, only with the consent of the person concerned or in order to determine, exercise or defend a right before a court or to protect the rights of another natural or legal person or for reasons of relevant public interest of the EU law or a Member State.

3. The person concerned who has obtained the limitation of the processing in accordance with paragraph 1 is informed by the Data Controller before such limitation is revoked.

Article 19
Obligation to notify in case of rectification or cancellation of the personal data or limitation of processing

The Data Controller shall communicate all rectifications or cancellations or limitations of the processing to each of the recipients to whom the personal data has been transmitted in accordance with article 16, article 17, paragraph 1 and of article 18, unless this proves impossible or requires a disproportionate effort. The Data Controller shall communicate such recipients to the person concerned should the person concerned so request.

Article 20
Right to the portability of the data

1. The person concerned has the right to receive the personal data relating to him/her in a structured format, commonly used and readable on an automatic device, supplied to a Data Controller and has the right to transmit such data to another Data Controller without hindrance from the Data Controller to which he/she supplied them if:

a) the processing is based on the consent in accordance with article 6, paragraph 1, letter a), or with article 9, paragraph 2, letter a), or on a contract in accordance with article 6, paragraph 1, letter b): and
b) the processing is carried out with automated means.

2. In exercising his/her rights relating to the portability of the data in accordance with paragraph 1, the person concerned has the right to obtain the direct transmission of the personal data by one Data Controller to another, if technically feasible.

3. The exercise of the right to which refers paragraph 1 of this article does not affect article 17. Such a right does not apply to the processing necessary for the performance of a task in the public interest or in the exercise of official authority vested in the Data Controller.

4. The right referred to in paragraph 1 shall not affect the rights or the freedoms of others.

Article 21
Right to object

1. The person concerned has the right to object, at any time, for reasons relating to his/her particular situation, to the processing of the personal data relating to him/her in accordance with article 6, paragraph 1, letters e) and f), including profiling on the the basis of these provisions, the Data Controller shall abstain from further processing the personal data unless he demonstrates that there are relevant legitimate grounds to proceed to the processing which prevail on the interests, on the rights and on the freedoms of the person concerned or to determine, exercise or defend a right before a court.

2. In the event the personal data is processed for direct marketing purposes, the person concerned has the right to object at any time to the processing of the personal data relating to him/her for such marketing, including profiling to the extent in which it is connected to the direct marketing.

3. In the event the person concerned should object to the processing for direct marketing purposes, the personal data is no longer subject to the processing for those purposes.

4. The right referred to in paragraphs 1 and 2 is explicitly brought to the attention of the person concerned and is clearly and separately presented from any other information, at the latest at the time of the first communication with the person concerned.

5. In the context of the information society services and without prejudice to Directive 2002/58/EC, the person concerned may exercise his/her right to object by automated means which use technical specifications.

6. In the event that the personal data is processed for scientific or historic research purposes or for statistic purposes in accordance with article 89, paragraph 1, the person concerned, for reasons connected to his/her particular situation, has the right to object to the processing of the personal data relating to him/her, unless the processing is necessary in order to carry out a task of public interest.

Article 22
Automated decisional process relating to natural persons, including profiling

1. The person concerned has the right to not be subjected to a decision based merely on automated processing, including profiling, which produces legal effects concerning him/her or which affects this natural person significantly in the same way.

2. Paragraph 1 does not apply in the event in which the decision:

a) is necessary for the conclusion or the performance of a contract between the person concerned and the Data Controller;
b) is authorised by the EU law or of a member State to which the Data Controller is subject, which also specifies adequate measures for the protection of the rights, of the freedoms and of the legitimate interests of the person concerned;
c) is based on the explicit consent of the person concerned.

3. In the cases referred to under paragraph 2, letters a) and c), the Data Controller shall implement appropriate measures to protect the rights, the freedoms and the legitimate interests of the person concerned, at least the right to obtain human intervention by the Data Controller, to express his/her own opinion and to contest the decision.

4. The decisions referred to under paragraph 2 are not based on the particular categories of personal data as laid down in article 9, paragraph 1, unless article 9, paragraph 2, letters a) or g) are applicable and there are no adequate measures in force to protect the rights, the freedoms and the legitimate interests of the person concerned.