Privacy Policy Curricula2019-01-17T11:34:36+00:00

Last update date: 07/12/2018

PRIVACY INFORMATION PURSUANT TO ART. 13 OF EU REGULATION 2016/679

Definitions

“Personal data” (as per art. 4 number 1 of the EU Regulation 2016/679): any information relating to an identified or identifiable individual («person concerned»); an identifiable person is an individual that can be identified, directly or indirectly, by particular reference to an identifier such as name, identification number, information relating to location, on-line identification data or to one or more characteristic elements of their physical, physiological, genetic, mental, financial, cultural or social identity.
“Processing”, (as per art. 4 number 2 of the EU Regulation 2016/679) means any operation or set of operations, which is performed with or without the aid of automated processes and performed upon personal data or a set of personal data, such as the collection, registration, organisation, structuring, storage, modification or adaptation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Who is the Data Controller? And how can I contact him?

The Data Controller:

CALZAVARA S.p.A. with sole shareholder
Registered office:
Piazza Camillo Finocchiaro Aprile, 3 int. B27
00181 Roma (RM)
Ph. +39 06 700 9315
Email: info@calzavara.it

Local Unit:
Via Corecian, 60
33031 Basiliano (UD)
Ph. +39 0432 84831
Email: info@calzavara.it

1.1 Purposes in accordance with fulfilling a legal obligation (Art. 6 paragraph 1 (c) of GDPR)

a. Fulfillment of legal obligations related to the candidacy and possible activation of professional insertion (eg. verification of belonging to a protected category)

1.2 Purposes in accordance with the expression of consent (Art. 6 paragraph 1 (a) of GDPR)

a. Management of the selection and evaluation process of the candidate’s CV in its broadest sense.

2. The categories of data that are processed

The data processed by the Data Controller is exclusively “personal data” (under Art. 4.1 of the GDPR).

In particular, the pertinent categories of personal data may be, including without limitation:

  • Biographical and identification data
  • Contact details
  • Particular data as suitable to reveal the state of health (eg. belonging to protected categories)

3. Recipients or categories of recipients of the personal data (under art. 13 paragraph 1 (e) of the GDPR)

Within the above-mentioned purposes, the Data Controller may communicate your data:

  • to companies that are responsible for the processing and the sending of material and communications relating to the past or present relationship with the person concerned;
  • to companies and professional operators who provide computing services, including electronic data processing, software management and information technology consulting;
  • Occupational doctor (if you need a preventive visit or other initiative in favor of the health plan)
  • Payroll study / employment consultants, professional firms in general (lawyers, accountants, etc.)

4 Conservation period of the data.

4.1 With reference to section 1.1

The personal data collected for the purposes referred to in point a) for legal obligations, will be kept for a period not exceeding 24 months.

Rights of the person concerned (art. 13 paragraph 2 (c) of the GDPR)

For the purposes referred to in this section, failure to collect personal data, even in part, by opposing the data subject makes it impossible to proceed with the realization of the purposes set out in this section. On the other hand, when the data are no longer necessary to meet the obligations set out in section 3.1, they are regularly deleted, if their cancellation is impossible or possible only when a disproportionate effort is made due to a particular storage mode, the data will not be treated and must be stored in areas that are not accessible.

4.2 With reference to section 1.2

The data collected for the purposes referred to in point a) on the basis of the consent of the interested party will be kept for a period not exceeding 24 months.

Rights of the person concerned (art. 13 paragraph 2 (c) of the GDPR)

The interested party may revoke his consent at any time and the effects will start from the moment of revocation, subject to the terms established by law. In general terms, withdrawal of consent only takes effect for the future. The treatment that was carried out before the withdrawal of consent is not affected by this for which it remains legal.
When the data are no longer necessary to meet the obligations set out in this “consent” section, these are regularly deleted, if their cancellation is impossible or possible only when a disproportionate effort is made due to a particular mode of preservation. it can be treated and must be stored in areas that are not accessible.
Failure or partial consent may not guarantee the complete provision of services, limiting them to the purposes described above.

5. Rights of the person concerned

The person concerned, in relation to the personal data object of this privacy statement, may exercise the rights as described in the EU Regulation, which are reported below:

  • right to access of the person concerned [art. 15 of the EU Regulation] (which consists in the possibility to be informed about the processing carried out on his/her personal data and to receive a copy of it);
  • right to rectification of the personal data [art. 16 of the EU Regulation] (the person concerned has the right to rectify incorrect personal data relating to him/her);
  • right to erasure of the personal data without undue delay (“Right to be forgotten”) [art. 17 of the EU Regulation] (the person concerned has, and shall have, right to cancellation of his/her own data);
  • right to limitation of processing of the personal data in the cases established by art. 18 of the EU Regulation including in case of unlawful data processing or complaint regarding the accuracy of the personal data by the person concerned [art. 18 of the EU Regulation];
  • right to data portability [art. 20 of the EU Regulation], (the person concerned may request his/her personal data in a structured format so that it may be transmitted to another Data Controller, in the cases established by the same article);
  • right to object to the processing of the personal data [art. 21 of the EU Regulation] (the person concerned has, and shall have, the right to object to the processing of the personal data concerning him/her in the cases established and regulated by art. 21 of the EU Regulation);
  • right not to be subject to automated decision-making processes [art. 22 of the EU Regulation] (the person concerned has, and shall have, the right to not be subject to a decision based purely on automated processing).

The above-mentioned rights may be exercised in accordance with what has been established by the EU Regulation by sending an email to privacy@calzavara.it

Calzavara S.p.A., pursuant to art. 19 of the EU Regulation, will proceed to informing the recipients to whom the personal data was communicated of any rectification, cancellation or limitation requested of the processing, where this is possible.

When the processing purposes pursued by Calzavara S.p.A. have consent as their legal basis, the person concerned may proceed, at any time, to revocation by sending an email to privacy@calzavara.it. In accordance with art. 7 of the EU Regulation the revocation of consent does not affect the lawfulness of the processing based on the consent given before the revocation.

Exercise of the rights of the person concerned

The person concerned, in relation to the personal data object of this privacy statement, may exercise the rights as described in the EU Regulation, which are reported below:

  • right to access of the person concerned [art. 15 of the EU Regulation]: the person concerned has the right to obtain confirmation from the Data Controller whether any such personal data is being processed and, in this case, to access the information expressly envisioned by the mentioned article, including without limitation the processing purposes, the category of the data and recipients, the conservation period, the existence of the right to erasure, rectification or limitation, the right to lodge a complaint, all information available regarding the origin of the data, the existence of an automated decisional process in accordance with art. 22 of the Regulation, as well as a copy of such personal data.
  • right to rectification [art. 16 of the EU Regulation]: the person concerned has the right to obtain rectification and/or integration of the inaccurate personal data which concern him by the Data Controller, without undue delay;
  • right to cancellation (“right to be forgotten”) [art. 17 of the EU Regulation]: the person concerned has the right to erasure of the personal data relating to him/her without undue delay, if one of the grounds expressly provided for in the aforementioned article, including without limitation the lack of necessity of the processing with respect to the purposes, the revocation of the consent on which the processing is based, objection to the processing in case it is based on a legitimate interest that does not prevail, unlawful use of the data, cancellation required under law, data of minors processed in absence of the conditions for applicability provided for by art. 8 of the Regulation;
  • right to limitation of the processing [art. 18 of the EU Regulation]: in the cases established by art. 18, including unlawful processing, complaint regarding the accuracy of such data, objection by the person concerned and the lack of necessity of the processing by the Data Controller, the data of the person concerned shall only be processed for conservation subject to his consent and the other cases expressly established by the mentioned article;
  • right to the portability of the data [art. 20 of the EU Regulation]: the person concerned, in case the processing is based on consent or on a contract and carried out by automated means, may request to receive his/her personal data in structured format, commonly used and readable on an automatic device, and has the right to transmit them to another Data Controller;
  • right to object [art. 21 of the EU Regulation]: the person concerned has the right to object to the processing of this personal data, in case the processing is based on a legitimate interest that does not prevail or is carried out for direct marketing purposes;
  • right not to be subject to automated decision-making processes [art. 22 of EU Regulation]: the person concerned has the right to not be subject to a decision, including profiling, based merely on automated processing (for example carried out exclusively by electronic instruments or computer programs).

The aforementioned description does not replace the text of the articles mentioned to which are referred in full and the full text of the EU regulation can be read at the link below or at the following link.

6. Right to lodge a complaint (art. 13 paragraph 2 (d) of the GDPR)

The person concerned, should he/she feel that his/her rights have been compromised, has the right to lodge a complaint to the Italian Data Protection Authority. For additional information relating to the rights and exercising these, please refer to http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524 or send a written communication to the Italian Data Protection Authority (Autorità Garante per la Protezione dei Dati Personali), Piazza Monte Citorio n. 121, 00186 Rome.

7. Possible consequence of a failure to communicate the data (art. 13 paragraph 2 (e) of the GDPR)

Please note that in case the processing purposes have a legal or contractual obligation (or pre-contractual) as legal basis, the person concerned must provide the requested data.

It this is not the case, it will be impossible for the Data Controller to proceed with the pursuit of the specific purposes of the processing.

8. Existence of an automated decisional process (including profiling)

Currently the use of purely automated decisional processes as mentioned in detail by article 22 of the GDPR is excluded. Should it in the future be decided to establish such processes for single cases, the person concerned will receive a separate notification in case this is envisioned by law or an update of this privacy statement.

9. Methods of processing

The personal data will be processed in paper, electronic and telematic form and included in the relevant databases (potential clients, clients, users, etc.) which may be accessed by, and thus they may gain knowledge of them, the staff expressly designated by the Data Controller such as Controllers or Subjects authorised to process personal data, who may consult, use, elaborate, compare or carry out any other activity, also automated, in compliance with the applicable legal provisions to guarantee, amongst others, the confidentiality and the safety of the data as well as their accuracy, their updating and the relevance of the data for the purposes declared.

10. Right to lodge a complaint (art. 13 paragraph 2 (d) of the GDPR)

The person concerned, should he/she feel that his/her rights have been compromised, has the right to lodge a complaint to the Italian Data Protection Authority, according to the methods indicated by this Authority at the following Internet address http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524 or by sending a written communication to the Italian Data Protection Authority, Piazza Monte Citorio n. 121, 00186 Rome.

11. Possible consequence of a failure to communicate the data (art. 13 paragraph 2 (e) of the GDPR)

Please note that in case the processing purposes have a legal or contractual obligation (or pre-contractual) as legal basis, the person concerned must provide the requested data.
It this is not the case, it will be impossible for the Data Controller to proceed with the pursuit of the specific purposes of the processing.

12. Existence of an automated decisional process (including profiling)

Currently the use of purely automated decisional processes as mentioned in detail by article 22 of the GDPR is excluded. Should it in the future be decided to establish such processes for single cases, the person concerned will receive a separate notification in case this is envisioned by law or an update of this privacy statement.

13. Methods of processing

The personal data will be processed in paper, electronic and telematic form and included in the relevant databases which may be accessed by, and thus they may gain knowledge of them, the staff expressly designated by the Data Controller such as Controllers or Subjects authorised to process personal data, who may consult, use, elaborate, compare or carry out any other activity, also automated, in compliance with the applicable legal provisions to guarantee, amongst others, the confidentiality and the safety of the data as well as their accuracy, their updating and the relevance of the data for the purposes declared.


 

Notice regarding minors of under 14 years

The minors of under 14 years cannot provide personal data. Calzavara S.p.A. shall not be responsible in any way for the collection of personal data or false declarations supplied by the minor and in the event that use of these were to be identified, Calzavara S.p.A. shall facilitate the right of access and of erasure forwarded by the legal guardian or whoever holds parental responsibility.


 

Exercise of the rights of the person concerned

The person concerned, in relation to the personal data object of this privacy statement, may exercise the rights as described in the EU Regulation, which are reported below:

  • right to access of the person concerned [art. 15 of the EU Regulation]: the person concerned has the right to obtain confirmation from the Data Controller whether any such personal data is being processed and, in this case, to access the information expressly envisioned by the mentioned article, including without limitation the processing purposes, the category of the data and recipients, the conservation period, the existence of the right to erasure, rectification or limitation, the right to lodge a complaint, all information available regarding the origin of the data, the existence of an automated decisional process in accordance with art. 22 of the Regulation, as well as a copy of such personal data.
  • right to rectification [art. 16 of the EU Regulation]: the person concerned has the right to obtain rectification and/or integration of the inaccurate personal data relating to him/her by the Data Controller, without undue delay;
  • right to cancellation (“right to be forgotten”) [art. 17 of the EU Regulation]: : the person concerned has the right to erasure of the personal data relating to him/her without undue delay, if one of the grounds expressly provided for in the aforementioned article, including without limitation the lack of necessity of the processing with respect to the purposes, the revocation of the consent on which the processing is based, objection to the processing in case it is based on a legitimate interest that does not prevail, unlawful use of the data, cancellation required under law, data of minors processed in absence of the conditions for applicability provided for by art. 8 of the Regulation;
  • right to limitation of the processing [art. 18 of the EU Regulation]: in the cases established by art. 18, including unlawful processing, complaint regarding the accuracy of such data, objection by the person concerned and the lack of necessity of the processing by the Data Controller, the data of the person concerned shall only be processed for conservation subject to his/her consent and the other cases expressly established by the mentioned article;
  • right to the portability of the data [art. 20 of the EU Regulation]: the person concerned, in case the processing is based on consent or on a contract and carried out by automated means, may request to receive his/her personal data in a structured format, commonly used and readable on an automatic device, and has the right to transmit them to another Data Controller;
  • right to object [art. 21 of the EU Regulation]: the person concerned has the right to object to the processing of this personal data, in case the processing is based on a legitimate interest that does not prevail or is carried out for direct marketing purposes;
  • right not to be subject to automated decision-making processes [art. 22 of EU Regulation]: the person concerned has the right to not be subject to a decision, including profiling, based merely on automated processing (for example carried out exclusively by electronic instruments or computer programs).

The aforementioned description does not replace the text of the articles mentioned therein to which are referred in full and the full text of the EU regulation can be read at the following link

Right to lodge a complaint
The person concerned, should he/she feel that his/her rights have been compromised, has the right to lodge a complaint to the Italian Data Protection Authority, according to what is specified by mentioned Authority at the following Internet address:
http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524.

For more detailed information regarding the rights of the persons concerned set out by the Guarantor, please refer to the following link.


Amendments and updates

This privacy statement shows the last update date in its header.

Calzavara S.p.A. may also make amendments and/or integrations to mentioned privacy policy also as a consequence of possible subsequent legislative amendments and/or integrations.


Regulatory references relating to the rights of the person concerned

Article 15
Right to access of the person concerned

1. The person concerned has the right to obtain confirmation from the Data Controller whether any such personal data is being processed and, in this case, to access the personal data and the following information:

a) the processing purposes;
b) the categories of the personal data in question;
c) the recipients or the categories of recipients to who the personal data have been or shall be communicated, especially if recipients of third counties or international organisations;
d) if possible, the planned conservation period of the personal data or, if this is not possible, the criteria used to determine such a period;
e) the existence of the right of the person concerned to request the Data Controller to rectify or erase personal data or to limit the processing of the personal data that concern him/her or to object to their processing;
f) the right to lodge a complaint to supervisory authorities;
g) in the event the data was not collected from the person concerned, all information available relating to their origin;
h) the existence of an automated decisional process, including profiling as set forth in article 22, paragraphs 1 and 4 and, at least in these cases, significant information relating to the logic used, as well as the importance and the consequences of such processing for the person concerned.

2. In the event the personal data is transferred to a third country or to an international organisation, the person concerned has the right to be informed of the existence of adequate guarantees pursuant to article 46 on transfer.

3. The Data Controller shall supply a copy of the processed personal data. In case the person concerned requests additional copies, the Data Controller may charge a reasonable fee based on administrative costs. If the person concerned presents the request via electronic means, and unless stated otherwise by the person concerned, the information shall be supplied in a commonly used electronic format.

4. The right to obtain a copy as laid down in paragraph 3 shall not affect the rights and freedoms of others.

Article 16
Right to rectification

The person concerned has the right to obtain rectification and/or integration of the inaccurate personal data relating to him/her by the Data Controller, without undue delay. Bearing in mind the purpose of the processing, the person concerned has the right to obtain integration of incomplete personal data, also by supplying a supplementary statement.

Article 17
Right to cancellation («right to be forgotten»)

1. The person concerned has the right to obtain erasure of the personal data relating to him/her by the Data Controller without undue del