Privacy policy - work with us

PRIVACY POLICY – WORK WITH US – CANDIDATES, RECRUITMENT

Information document pursuant to and for the purposes of Article 13 of Regulation (EU) 2016/679 (GDPR)

WHY THIS INFORMATION

WHO IS THE DATA PROCESSING OWNER? HOW TO CONTACT HIM?
The Data Controller is BTS SPA with legal head office in Garbagnate Milanese Via Forlanini, 40 in the person of its pro-tempore Legal Representative, who can be contacted for any information by telephone + 39 02 366 49000 e-mail [email protected].

TYPE OF DATA THAT CAN BE PROCESSED
Personal data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, with reference to an identifier such as a name, an identification number, location data, an online identifier or one or more characteristic elements of his physical identity, physiological, genetic, psychic, economic, cultural, or social. Any Particular Data: personal data revealing racial or ethnic origin and data relating to the health of the person and based on Laws on mandatory employment (e.g. protected categories and mandatory employment as per applicable regulations.

PURPOSE OF THE TREATMENT, LEGAL BASIS, PERIOD OF DATA STORAGE, PROVISION NATURE

PURPOSE OF THE TREATMENT	LEGAL BASIS	PERIOD OF DATA STORAGE	PROVISION NATURE
A) Recruitment, performance of personnel search and selection activities for the purpose of establishing an employment relationship, also for any positions other than those for which the interested party has applied spontaneously; retention of personal data also for future selections; handling applications in response to vacancies posted on our website; interviews and any video interviews (data processing including image/audio).	Data processing is necessary for the execution of pre-contractual measures adopted also at the request of the interested party. Article 6 par. 1 lit. b) of the GDPR For particular data: General authorization n.1 of the Guarantor and Laws on compulsory employment.	In general, the data collected during the recruitment process will be deleted as soon as it is evident that no offer of employment will be made or that the offer will not be accepted by the candidate and a maximum of 24 months.	The provision of personal data is necessary to process data for selections. Failure to provide the necessary personal data will make it impossible to apply.
B) Management of your requests and requests from other interested parties, pursuant to art. 15 and following the GDPR (rights of the interested party).	Processing is necessary for compliance with a legal obligation to which the controller is subject (C45). Article 6 par. 1 lit. c) of the GDPR.	5 years from the closure of the request, except for disputes.	The provision of personal data is mandatory, as it is essential to be able to implement legal obligations.
C) Recruitment, references and verification of curriculum vitae: check at the training/educational institutions declared by the candidate, including the years attended and the title/diploma received, contact with the people listed, such as references from the candidate. Third parties, such as universities, educational institutions, former employers.	The processing is based on consent to the processing of personal data (C42, C43). Article 6 par. 1 lit. a) of the GDPR.	In general, the data collected during the recruitment process will be deleted as soon as it is evident that no job offer will be made or that the offer will not be accepted by the candidate and a maximum of 24.	The provision of personal data is optional. Failure to provide personal data does not make recruitment impossible.

TO WHOM WILL THE PERSONAL DATA BE COMMUNICATED? DATA RECIPIENTS
The data will not be disclosed.
Personal data will be communicated to subjects who will process the data as independent Data Controllers, or Data Processors (art. 28 GDPR) and processed by natural persons (art. 29 GDPR) who act under the authority of the Data Controller and the Responsible based on specific instructions provided in relation to the purposes and methods of treatment. The data will be communicated to recipients belonging to the following categories:
– entities that provide services for the management of the information system and communication networks (including e-mail and platforms/software); – studies or companies in the context of assistance and consultancy relationships; – any third parties and labor consultants and companies for recruitment purposes based in Italy;
– competent authorities for the fulfillment of legal obligations and/or provisions of public bodies, upon request. The subjects belonging to the aforementioned categories perform the function of data processing manager or operate in total autonomy as separate data controllers.
The list of data processors art. 28 is available by writing to [email protected] or to the other addresses indicated above.

IS THERE A DATA TRANSFER TO A NON-EEA COUNTRY?
Personal data will be transferred to non-EEA countries, to comply with related purposes based on the processing purposes indicated above. The data will be transferred based on Article 44 et seq. of the GDPR:
– art. 45 towards third countries international organizations for which the Commission has intervened with an assessment of adequacy;
– towards subjects who have provided adequate guarantees, with standard contractual clauses (SCC) of the European Commission (Article 46, paragraph 2, letter c and letter d).
For information about the guarantees concerning the transfer of data outside the EEA, write to [email protected].

IS THERE AN AUTOMATED PROCESS?
Personal data will be subjected to traditional manual, electronic and automated processing. It should be noted that fully automated decision-making processes are not carried out.

RIGHTS OF DATA SUBJECTS
You will be able to assert the rights as expressed by the articles 15 and following GDPR, Data Controller at the e-mail address [email protected], or at the contacts indicated above or. You have the right, at any time, to request access to your personal data (art.15), rectification (art.16), cancellation of the same (art.17), limitation of treatment (art.18). The data controller communicates (art. 19) to each of the recipients to whom the personal data have been transmitted any corrections or cancellations or limitations of the carried-out treatment. The data controller communicates these recipients to the interested party if requested. In the foreseen cases, you have the right to the portability of your data (art.20) and in this case they will be provided to you in a structured format, commonly used and readable, by automatic device. You have the right to oppose, in the envisaged cases (art.21), at any time, the processing of data based on legitimate interest, and in cases where the legal basis is consent, you have the right to revoke the consent given without prejudice to the lawfulness of the treatment based on the consent before the revocation. In the event that he believes that the processing of personal data carried out by the Data Controller is in violation of the provisions of Regulation (EU) 2016/679, the interested party has the right to lodge a complaint with the Supervisory Authority, in particular in the Member State where he/she habitually resides or works or in the place where the alleged violation of the regulation has occurred (Privacy Guarantor https://www.garanteprivacy.it/), or to take the appropriate judicial offices.

POLICY CHANGES
The owner may change, modify, add, or remove any part of this Privacy Policy to facilitate the verification of any changes, the information will contain an indication of the update date of the information.

Updated date: November 30, 2022

The treatment owner
BTS Spa