Notice on the processing of Candidate data

pursuant to Articles 12, 13, and 14 of Regulation 2016/679/EU

TECNOBODY S.P.A. (hereinafter "Data Controller"), Tax Code - VAT Number 02323900163, represented by its legal representative, Mr. Alessandro Carminati, with its registered and operational office located at Via Lodi 10, Dalmine (BG), in its capacity as "Data Controller", informs you that your personal data collected for the purpose of personnel selection (employee, collaborator, intern, apprentice, etc.) for TECNOBODY S.P.A. will be processed in compliance with Regulation 2016/679/EU, regarding the protection of natural persons with regard to the processing of personal data and the free movement of such data, as well as applicable legislative and contractual provisions, and for the purposes and in the manner outlined below.


Origin and Types of Data Processed

The processing of your personal data, provided directly by you (via email, in paper format, or by filling out the appropriate form on the company’s website), or by third parties entrusted with the selection activity (headhunting companies, specialized job recruitment sites), is carried out by TECNOBODY S.P.A. for the selection of potential candidates for establishing a collaboration, in the forms and ways identified from time to time, in compliance with the obligations arising from applicable laws.
This processing involves:
a) personal data, contact data, and information related to the educational background (e.g., name, date and place of birth, residence address, tax code, gender, phone number, email address, qualifications, training courses, etc.);
b) data related to previous and current professional work experience, foreign language proficiency, and any other information useful for evaluating your CV, including salary levels, etc.;
c) data obtained from public sources such as websites, newspapers, and specialized magazines, scientific publications, or other documents published or freely accessible, as part of the recruitment process;
d) public data related to your profiles on professional social networks (e.g., data contained in your public LinkedIn profile, etc.);
e) any other data you voluntarily include in your CV or provide to third-party recruiters;
f) data collected from third parties regarding your previous work experience.

Among the data mentioned, there may also be "special" data as defined by current legislation, such as data related to criminal convictions and offenses (judicial data).
Candidates are advised not to include in their CVs or otherwise communicate personal data that reveals racial or ethnic origin, religious, philosophical, or other beliefs, political opinions, party affiliations, trade union membership, or membership in religious, philosophical, political, or trade union organizations, as well as data related to health or sexual life (special data).
However, special categories of personal data may be processed if one of the conditions allowing such processing under Article 9.2 of the GDPR applies, particularly health-related data such as belonging to protected categories, if contained in the CV or any additional documentation received.
If you decide to apply, you are free to provide personal data you deem appropriate for the purpose. However, if the personal data necessary for your identification (e.g., personal details, educational background, and data necessary for evaluating your qualifications and conditions for the job position you are applying for) is not provided, TECNOBODY S.P.A. will not be able to assess your application, as such data is essential for this purpose, and your application will not be considered.


Legal Basis and Purpose of Processing

Your personal data, requested or acquired either beforehand or during the selection activities, will be processed by the Data Controller for the following purposes:
a) managing activities related to or instrumental for the selection and evaluation of your CV, as well as scheduling and managing individual or group interviews;
b) proposing your candidacy to other companies collaborating with TECNOBODY S.P.A. Additionally, all criteria under Legislative Decree 125/91 will be followed to guarantee non-discrimination between genders in the selection process;
c) obtaining information about your references from previous employers;
d) processing public information related to your profile on professional social networks;
e) establishing or defending the rights of the Data Controller in out-of-court and/or judicial proceedings.

For the purposes referred to in point (a), consent to the processing of personal data contained in CVs or received is not required, as the processing is strictly necessary to follow up on your request and to acquire preliminary information for the potential establishment of a contractual relationship, or to comply with an obligation to which the Data Controller is subject (Article 6, paragraph 1, letters b) and c) of the GDPR). Any personal data you provide related to special categories under Article 9 of the GDPR will be processed only when necessary and relevant to assess your candidacy for positions related to targeted placement, or when necessary to fulfill obligations and exercise specific rights of the Data Controller or yourself (as the Data Subject) concerning labor law, social security, and social protection, as authorized by Union or Member State law or a collective agreement (Article 9.2. b) of the GDPR), as well as when necessary for the purposes of preventive medicine or occupational medicine, evaluating work capacity (Article 9.2. h) of the GDPR), and, where necessary, for the purpose referred to in point e) (Article 9.2 f). Judicial data will be processed only in the presence of a legal provision or when authorized by law or regulation where necessary in relation to the job position for which the recruitment is intended.
For purposes (b) and (c), prior consent is required, while for purpose (d), our legitimate interest in verifying that the provided data corresponds to what is declared in the CV or by the candidate applies, limited to professional information.


Disclosure and Communication of Data to Third Parties

Your data may be communicated to third parties, such as trusted external companies operating in personnel selection, competence assessment activities, and, if necessary, to health structures used by TECNOBODY S.P.A. for technical and organizational reasons in managing your candidacy.
Your data may also be communicated to professionals and companies affiliated with or controlled by TECNOBODY S.P.A., as well as to companies, consortia, or other legal entities in which Mr. Alessandro Carminati is a partner, interested in establishing a working relationship with you. These parties, companies, and professionals will process your data as independent controllers. Moreover, due to the coordination and management role played by Mr. Alessandro Carminati, your data may be processed by individual employees authorized and properly trained for necessary organizational, administrative, financial, and accounting activities that each of these companies may carry out for others.
Your personal data will not be subject to dissemination.
In terms of personal data protection, the candidate is invited, under Article 33 of the European Regulation 2016/679, to report to TECNOBODY S.P.A. any circumstances or events that may lead to a potential "personal data breach" in order to allow for immediate evaluation and the adoption of measures to address such an event.
Such a report can be made by sending a communication to TECNOBODY S.P.A. at the email address: privacy@tecnobody.it
The obligation of TECNOBODY S.P.A. as the Data Controller to communicate data to Public Authorities upon specific request remains unchanged.


Transfer Abroad

Personal data may be transferred to countries and international organizations within the European Union (EU) and the European Economic Area (EEA) and, as a rule, will not be transferred to non-EU/EEA countries (third countries). However, when necessary for the purposes indicated in this notice, data may be transferred to third countries. In such cases, to ensure an adequate level of protection for personal data, the transfer will comply with Articles 44 and subsequent of the EU Regulation 2016/679 (GDPR), or to third countries for which the European Commission has adopted adequacy decisions, based on Standard Contractual Clauses approved by the European Commission, or in application of specific derogations provided by the GDPR. For the processing of information and data that may be communicated to these entities, equivalent levels of protection adopted for the processing of employees' personal data will be required. In any case, only the data necessary to achieve the intended purposes will be communicated, and the regulatory tools provided by Chapter V of the GDPR will be applied. Further information on data transfers can be requested by emailing the Data Controller.


Processing Methods and Retention Times

Your data will be collected and recorded lawfully and fairly, for the purposes indicated above and in compliance with the fundamental principles established by Chapter II of Regulation 2016/679/EU.
Data processing may take place through manual, electronic, or telematic means, but always under appropriate technical and organizational measures to ensure security and confidentiality, particularly to reduce risks of destruction or accidental loss, unauthorized access, or unlawful processing inconsistent with the collection purposes.
Personal data will be processed by TECNOBODY S.P.A. for the duration of the selection activities: for spontaneous applications, data will be stored for 48 months and then deleted; in the case of responding to an ongoing selection by TECNOBODY S.P.A., the retention period will be as indicated in the prospectus and in any case will not exceed 48 months from the closing of the selection process; in any case, you may request that your CV be kept for potential future needs within TECNOBODY S.P.A. However, any further retention for the purpose of defending rights, including third-party rights, in judicial proceedings will be allowed for the period strictly necessary for their pursuit, with reference to ongoing disputes or pre-litigation situations, in accordance with the principle of data retention limitation.


Nature of Provision and Consent to Processing

Regarding the purposes mentioned in point 1 a), processing of your data, including special data when strictly necessary as outlined above, is mandatory for evaluating your candidacy, to assess your skills and qualifications in relation to the needs of TECNOBODY S.P.A., and therefore, consent to processing is not required.
However, providing personal data for purposes such as proposing your candidacy to other companies cooperating with TECNOBODY S.P.A., verifying references, or processing public information from professional social networks is optional. You may freely choose whether to grant specific consent for each of these purposes, which you can always withdraw.


Rights of the Data Subject

In accordance with the limitations and conditions set forth in the legislation on personal data protection concerning the exercise of data subject rights (Chapter III of Regulation 2016/679), regarding the processing covered by this notice, you, as the Data Subject, have the right to:

  • request confirmation of whether or not your personal data is being processed, and access the data and related information (right of access);
  • request correction and supplementation of incomplete personal data (right of rectification);
  • request limitation of processing in cases provided by Article 18 of the GDPR and deletion in cases provided by Article 17 of the GDPR, where applicable (right to restriction of processing and right to erasure);
  • obtain data portability, meaning receiving your data in a structured, commonly used, and machine-readable format, also for transferring it to another data controller, in cases where the legal basis for processing is the contract or consent, and the processing is automated (right to data portability);
  • object, for reasons related to your particular situation, to the processing of your data at any time, specifically objecting to processing based on the legitimate interest of the Data
  • withdraw consent, where given, without prejudice to the lawfulness of processing based on consent;
  • file a complaint with the supervisory authority (in Italy, the Privacy Guarantor) pursuant to Article 77 of the GDPR, if they believe that the processing concerning them violates the provisions of the GDPR.

The Data Subject may exercise their rights regarding privacy and personal data protection by requesting the appropriate form from TECNOBODY S.P.A., completing it, and sending it by email to privacy@tecnobody.it or by registered mail to the Data Controller's office.

Best regards,

The Data Controller
TECNOBODY S.P.A.