Privacy Policy Job Candidates

Information document pursuant to and for the purposes of Article 13 Regulation (EU) 2016/679 (GDPR), other sources

In compliance with Regulation (EU) 2016/679 (GDPR), we are providing the necessary information regarding the processing of personal data.
This is information provided pursuant to Article 13 GDPR as well as in accordance with Opinion 2/2017 “processing of employee data” prepared by the Article 29 Working Party on Data Protection.

 

1. THE ‘OWNER’ OF THE PROCESSING

Pursuant to articles 4 and 24 of the GDPR, is BOMI ITALIA SPA, with head office in Spino d’Adda (CR), Via Madonna del Bosco 7/A,
in the person of its Legal Representative.
Holder’s contact data, telephone: +39 0373085000, e-mail: privacy@bomigroup.com.

 

2. DATA PROTECTION OFFICER (RPD/DPO-Data Protection Officer)

is identified pursuant to Articles. 37 – 39 of EU Reg. 2016/679. To contact the DPO: e-mail dpo@bomigroup.com.

3. PURPOSE OF PROCESSING LEGAL BASIS, PERIOD OF DATA RETENTION, NATURE OF CONFERMENT/SOURCE

 

PURPOSE OF PROCESSING

LEGAL BASIS

STORAGE PERIOD

NATURE OF CONTRIBUTION O SOURCE OF DATA PROCESSING
A) Personnel selection, the carrying out of personnel research and selection activities with a view to the possible
establishment of an employment relationship, including for any positions other than those for which the person concerned has spontaneously applied; storage of personal data also for future selections; management of applications in response to job offers published on our website; interviews and any video interviews (data processing, including image/audio data).		 processing is necessary for the performance of pre-contractual measures to which the data subject is party or at the request of the data subject; (C44) Art. 6(1)(b) GDPR processing is necessary for the performance of pre-contractual measures to which the data subject is party or at the request of the data subject; (C44) Art. 6(1)(b) GDPR Data provided by you in interview:
The provision of personal data is necessary to process data for selections Failure to provide personal data will make it impossible to apply
Source of data not provided by
you:
Personal data were provided by: third companies belonging to the Group, personnel selection companies, recruitment, social networks, or by universities or educational institutions in general, third parties
B) for the above selections, the Data Controller may view the candidate’s publicly accessible ‘social profile’ on social media. The Controller may collect and process the candidate’s personal data to the extent that such collection is necessary and relevant for the performance of the job. processing is necessary for the purposes of pursuing the legitimate interests of the data controller or a third party, provided that the interests or the fundamental rights and freedoms of the data subject requiring the protection of personal data (C47-C50) Art. 6(1)(f) GDPR are not overridden. In principle, data collected during the recruitment process will be deleted as soon as it becomes clear that no job offer will be made or that the offer will not be accepted by the candidate; but the maximum time will be 12 months. Opposition to the processing of personal data does not result in the impossibility of being selected.
C) Communication of personal data and CVs to group companies for their selections. List of group companies on request at mail to: privacy@bomigroup.com. processing is necessary for the purposes of pursuing the legitimate interests of the data controller or a third party, provided that the interests or the fundamental rights and freedoms of the data subject requiring the protection of personal data (C47-C50) Art. 6(1)(f) GDPR are not overridden. In principle, data collected during the recruitment process will be deleted as soon as it becomes clear that no job offer will be made or that the offer will not be accepted by the candidate; but the maximum time will be 12 months. Opposition to the processing of personal data does not make it impossible to be selected.

 

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF DATA

Personal data will be communicated to subjects based in Italy who will process the data in their capacity as natural persons acting under the authority of the Data Controller and Data Processor (Art. 29 of EU Reg. 2016/679) and as data processors (Art. 28 of EU Reg. 2016/679), for the purposes listed above, and to autonomous third parties.
Precisely, the data will also be communicated to:

  • group companies based in EEA and Extra-EEA countries (it will depend on the job location listed in the job description);
  • subjects providing services for the management of the information system and communication networks (including email and platforms/software also in the USA);
  • firms or companies within the scope of assistance and consulting relationships based in Italy;
  • any third parties and labour consultants and companies for the purposes of personnel selection;
  • competent authorities for the fulfilment of legal obligations and/or provisions of public bodies, upon request.

Subjects belonging to the above categories perform the function of Data Processor, or operate completely independently as separate Data Controllers.
The list of Data Processors is constantly updated and available by writing to privacy@bomigroup.com.

 

5. DATA TRANSFER TO A THIRD COUNTRY

Personal data will be transferred to countries outside the EEA, in order to fulfil data processing purposes.
Data will be transferred according to Article 44 et seq. of the GDPR to entities that have provided adequate safeguards, with standard contractual clauses (SCC) of the European Commission (Art. 46, para. 2, lett. c and lett. d) in the USA.
For information about copies of the guarantees for data transfer outside the EEA write to privacy@bomigroup.com

 

6. AUTOMATED PROCESS

Personal data will be subject to traditional manual, electronic and automated processing. Please note that no fully automated decision-making processes are carried out.

 

7. RIGHTS OF DATA SUBJECTS

You may assert your rights as expressed in Art. 15 et seq. GDPR, by contacting DPO/RPD at dpo@bomigroup.com or by contacting the Data Controller at privacy@bomigroup.com. You have the right, at any time, to request access to your personal data (Art. 15), rectification (Art. 16), deletion of the same (Art. 17), restriction of processing (Art. 18).
The data controller shall inform (art. 19) each of the recipients to whom the personal data have been transmitted of any rectification or erasure or restriction of processing carried out. The controller shall inform the data subject of these recipients if the data subject so requests.
He may object to processing based on legitimate interest (Art. 21). If you consider that the processing of personal data carried out by the Controller is in breach of the provisions of Regulation (EU) 2016/679, you have the right to lodge a complaint with the supervisory authority, in particular in the Member State in which you normally reside or work or in the place where the alleged breach of the Regulation occurred (https://www.garanteprivacy.it/), or to bring an action before the appropriate courts.

Update date: 03/08/2023

Back To Top