EU Regulation 2016/679 of the European Parliament and Council of 27 April 2016, General Regulation on the protection of personal data and on the free movement of such data – Legislative Decree 196 – 30 June 2003, Personal data protection code

Pursuant to Articles 12 et seq. of the Regulation (EU) 2016/679 (hereinafter “GDPR”), and Article 13 of Legislative Decree 196/2003 (“Privacy Code”), we herebyinform you that Pavesioe Associati, having its offices in Corso Vittorio Emanuele II, 68, Turin and in via Bigli, 2, Milan (the “Firm“), shall carry out the processing (e.g. registration, use, communication) of the personal data you will directly provide with regard to your application, including further to submitting your CV.

1. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER
   Whilst processing your personal data, the Firm acts as data controller (“Data Controller” or “Controller”).
   In the event of any query regarding the processing of your personal data by the Firm, in particular in relation to the exercise of your rights (briefly described in section 7 below), you may contact the Controller at its premises as indicated above or via email at: dataprotection@pavesioassociati.it.
2. CATEGORIES OF PROCESSED DATA, LAWFULNESS AND PURPOSES OF THE PROCESSING, CONSEQUENCES IN THE EVENT DATA IS NOT PROVIDED
   
   2.1 With regard to your application, the Controller shall collect and process your personal data (such as, e.g., biographical data, data concerning your work experience and educational history). The Controller processes such data for the assessment of your professional skills in view of your potential recruitment by the firm, pursuant to Article 6(1)(b) of the GDPR (pre-contractual actions).

2.2 The processing may also concern specific categories of data (defined as “sensitive” by Recital 10 of the GDPR): such as data revealing race or ethnicity, political opinions, religious or philosophical beliefs, membership of trade unions, as well as genetic data, biometric data intended to uniquely identify a physical person, data relating to health or sexual life or sexual orientation of the individual. The Controller shall process the abovementioned data only with your consent pursuant to point Article 9(2)(a) of the GDPR. In this regard, we invite you to provide such data only if it is strictly necessary. The firm may be unable to process your application if you do not grant your consent to the processing of such data.

In particular, the processing is carried out for the following purposes:
(a) for the assessment of your professional skills with reference to vacant positions at the Firm;
(b) for the management of the selection procedure;
(c) purposes connected with establishing a professional or contractual relationship;
d) for communication purposes, in order to plan interviews.
The failure to providing data, as described above, will make it impossible to assess your professional skills, to organize interviews and as such, to establish a relationship with you in compliance with applicable legal and contractual provisions.
2.3 In the event you provide or otherwise process third-parties’ personal data, you will take on the capacity of autonomous data controller and, in any case, you shall guarantee that there is a proper legal basis for the processing pursuant to Articles 6 and 9 of the GDPR. You shall also verify to have permission to upload content protected by national and international law provisions.

3. PROCESSING METHODS
   With regard to the above-mentioned purposes, the processing shall be carried out in full compliance with the confidentiality, integrity, fairness, minimization, accuracy, necessity, relevance, lawfulness and transparency principles, by automated, electronic, manual and telematics means, with means strictly related to the same purposes and, in any case, implementing technical and organizational measures capable of ensuring the security and confidentiality of the data.
   Adequate safeguards for the security and confidentiality of the data processing shall be provided for also with regard to the recipients specified under section 4.
4. DATA RECIPIENTS
   Your personal data shall not be delivered to the public, however they may be disclosed – including, if needed, sensitive data – exclusively for the abovementioned purposes, to natural persons and legal persons who collaborate with or work for the Firm and who have accepted a confidentiality undertaking or have an appropriate statutory obligation of confidentiality.
   The processing of your data by the abovementioned categories of recipients may be carried out, where necessary, in order to take pre-contractual steps you may request.
   You are entitled to request the Controller for a list of the names and contacts of the entities that are part of the above-mentioned categories to which your data have been disclosed.
5. TRANSFER OF DATA ABROAD
   The Firm, with regard to your application, shall not transfer your personal data outside the European Union.
6. DATA RETENTION
   The Controller will retain your personal data in its databases for 12 months from being provided, during which they may be used in order to make contacts and possibly to plan future interviews. Subsequently, unless a professional relationship is established, such data will be deleted.
7. DATA SUBJECT RIGHTS
   You are entitled to request the Controller, at any time, via the contact details indicated above, confirmation as to whether
   or not your personal data are being processed, as well as access such data. You are entitled to the rectification or, when provided, erasure of data and the limitation of processing or objection to it for legitimate reasons.
   In your capacity as Data Subject, you are entitled to lodge a complaint with the Italian Data Protection Authority. Pavesio e Associati with Negri-Clementi.

Studio Legale Pavesio e Associati with Negri-Clementi