Disclosure for processing of personal data
In compliance with the provisions of D.Lgs 196/03, as amended, and of Regulation (EU) 2016/679 of the European Parliament and Council (“General Data Protection Regulation” or “GDPR”), Stefano Boeri Architetti S.r.l., with registered office at Via Donizetti 4 – 20122 Milano, VAT Registration No. 07526210963, acting in its capacity as Controller, informs you of the procedures and purposes of the processing of personal data provided by job candidates.
- Data collection
The curricula vitae sent by job candidates either on their own, spontaneous initiative or in response to an advertisement published by Stefano Boeri Architetti S.r.l. may be received, stored and examined by assigned staff members only after the data subject has certified that he or she has read this disclosure and after granting his/her express consent.
- Data which are subject to the Processing
Stefano Boeri Architetti S.r.l. only collects the following “common” personal data of the data subjects who send their curricula vitae: name, surname, address, telephone number, e-mail, professional experience details, and any photo (hereinafter, the “personal data” or “data”).
The data subject must not communicate the personal data which may be categorised as “special” pursuant to Articles 9 et seq. of European Regulation 2016/679.
If Stefano Boeri Architetti S.r.l. comes into possession of special data contained in the curricula vitae which contain, for example, data that could reveal the ethnic origin of the data subject or that person’s membership in one of the protected categories, the Controller shall process exclusively those data which are relevant to evaluation of the candidate’s professional qualification, and within the limits for which the acquisition of that information is strictly necessary to establish the employment relationship.
In any event, both in the case of candidates who spontaneously submit job applications and in the case of responses to specific help wanted ads, Stefano Boeri Architetti S.r.l. shall process the data in compliance with the processing purposes and procedures set out in this data processing disclosure.
- Legal basis and purpose of processing
The data subjects’ personal data, including their special data, shall be processed on the basis of the data subject’s express consent and to the extent necessary for the execution of pre-contractual measures adopted on their request (Article 7 GDPR), for the sole purpose of evaluating the candidates in view their possible hiring at our firm.
- Processing procedures
The data subjects’ personal data shall be processed both manually and with the aid of information technology tools, while protecting the security and confidentiality of the data themselves. That processing shall be performed exclusively by the staff members of the Office assigned to process the data and on specific instruction by the Controller.
- Duration of the processing
The processing shall not last longer than the period necessary to achieve the purposes for which the data were collected. In any event, they shall be deleted within 12 months after they are collected, or earlier, on specific request by the data subject.
The Controller reserves the right to destroy the curricula vitae or any document containing personal data found to be not in compliance with the purposes indicated in Article 3 hereinabove.
- Access to the data
The data subjects’ data may be rendered accessible only for the purposes indicated in Article 3 hereinabove, to the Controller’s employees and contract workers in their capacity as persons in charge of the processing and/or external data processors and/or system administrators.
- Distribution of the data
The personal data transmitted by the interested candidates shall not be distributed.
- Transfer of the data
The personal data transmitted by the interested candidates shall not be transferred to other persons or entities and shall be kept on servers owned by Stefano Boeri Architetti S.r.l., located in Milan and within the European Union. Regardless, it is agreed that the Controller may also move the servers within or even outside the European Union if necessary. In that case, the Controller hereby assures that the data shall be transferred outside the European Union in compliance with the provisions of applicable laws, after stipulating the standard contractual clauses required by the European Commission.
- Nature of the provision of data and consequences of failure to provide them
Provision of the data and issuance of the consent to processing for the processing indicated at Article 3 hereinabove are absolutely necessary to accomplish the purposes described hereinabove. Failure to provide the data will render it impossible for Stefano Boeri Architetti S.r.l. to consider the candidate in any staff recruitment and evaluation process.
- Data subject’s rights
In connection with the purposes of processing, you may exercise the rights envisaged in Articles 15 et seq. GDPR, and in particular the right to:
- access, or to obtain confirmation whether or not information concerning you exists, to know their origin, and the logic and purposes on which the processing is based, the recipients or categories of recipients to whom the data may be transmitted, and determination of the data retention period, if that can be defined;
- correction of inexact data;
- deletion (“right to be forgotten”), when the data are no longer necessary for the purposes of the data collection, or when the data subject has revoked his/her consent to the processing (when that consent is envisaged as optional or when there are no legal grounds for the processing);
- limitation, the right to have the Controller limit access to the personal data by all those parties who have a service agreement or employment agreement with the Controller. In all cases, the Controller guarantees access to his or her special category and judicial personal data to a restricted number of persons to guarantee the security, integrity, and accuracy of those data;
- portability, the right to receive the personal data concerning the data subject in a structured and commonly used format that can be read by an automated device, with the possibility of transmitting them to another Controller. This right shall not apply to non-automated processing (e.g. archives or paper records). Moreover, only the data that are processed with the data subject’s consent may be processed, and only if the data have been provided by the data subject himself or herself;
- opposition, i.e. the right to oppose processing for reasons connected with your own particular situation;
- complaint, to be sent to the personal data protection authority: Garante per la Protezione dei dati personali, Piazza di Monte Citorio n. 121 – 00186 Roma ([email protected]; telephone + 39 06 69677.1; fax + 39 06 69677.3785).
Moreover, pursuant to Article 7, paragraph 3, GDPR, you are granted the right to revoke your consent at any time. The revocation of consent does not prejudice the legality of the processing based on your consent before revocation.
- Procedure for exercising rights
The data subject may exercise his or her rights at any time, as provided at clause 10 hereinabove, by sending:
– a certified letter with return receipt to Stefano Boeri Architetti S.r.l., Via Donizetti 4 – 20122 Milano, VAT Registration No. 07526210963
– an e-mail to [email protected].
- Controller, data processors, and persons in charge of the processing
The Controller is Stefano Boeri Architetti S.r.l. with registered office at Via Donizetti 4 – 20122 Milano, VAT Registration No. 07526210963.
The updated list of categories of data processors and persons in charge of the processing is kept at the registered office of the Controller.