INFORMATION NOTICE FOR THE PROCESSING OF CANDIDATES’ DATA
Pursuant to Articles 13 and 14 of EU Regulation 2016/679
- DATA CONTROLLER AND DATA CONTACT DETAILS
The Data Controller for Personal Data is F.C.R. – Filtrazione Condizionamento Riscaldamento S.p.A.
Registered Office: Corso Vittorio Emanuele II, 15 – Milano (MI)
Administrative Office: Via E. Fermi 3 – Cinisello Balsamo (MI)
Company Contacts: e-mail fcr@fcr.it – phone 02.61798.1; Privacy e-mail: privacy@fcr.it - DATA PROCESSED, PURPOSES AND LEGAL BASES
*In the absence of this case and in the absence of the conditions referred to in art. 9 of the GDPR, such data will not be considered and will be immediately deletedData Processed Purpose Legal Basis Common Data (e.g., name, surname, place and date of birth, residence, phone contacts, educational qualification, work experience, and any other data you include in your CV)Special Categories of Data (Your CV might indirectly reveal racial or ethnic origin) Recruitment and selection of personnel for a potential employment relationship Art. 6, par. 1, letter b) GDPR The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contractArt. 9, par. 2, letter b) GDPR Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment law Special Categories of Data
Results of the pre-employment medical examination carried out by the Competent Physician or ATS (Health Agency)Verifying if the candidate who passed the selection process is fit for the duties they would be assigned upon hiring Art. 9, par. 2, letter h) and par. 3 GDPR Processing is necessary for the purposes of preventive medicine and for the assessment of the working capacity of the employee under the responsibility of a professional subject to professional secrecy.
Legislative Decree 81/08 art. 41 paragraph 9 – Law 203/24Special Categories of Data (Data relating to membership of protected categories) Where necessary and relevant, to evaluate the candidacy for job positions subject to targeted placement provisions * Art. 6, par. 1, letter b) GDPR Obligations arising from Law 68/99 on the hiring of protected categories.
Art. 6, par. 1, letter c) GDPR Processing is necessary for compliance with a legal obligation to which the controller is subject.
Art. 9, par. 2, letter b) GDPROther (Professional information and data relating to the recruitment and candidate evaluation process) Demonstrating compliance with the principles of transparency, impartiality, and non-discrimination in the selection process.
Verifying that the data you have provided corresponds to what you have declared, limited only to professional informationArt. 6, par. 1, letter f) GDPR Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party - SOURCES
The data will be collected directly from the data subject or through employment agencies - NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL TO PROVIDE IT
The provision of data and the related processing are functional to the execution of the personnel search and selection activity; however, failure or insufficient provision could make it impossible for the Controller to carry out the selection process - PROCESSING METHODS AND DATA RETENTION
The data will be processed using manual and/or automated and computerized systems to store, manage, and transmit the data itself, with logic strictly connected to the purposes indicated in point 2. Non-pertinent or uninteresting curricula will be immediately deleted or destroyed. Curricula of interest and data relating to the candidate evaluation process will be retained for a maximum period of 12 months, after which they will be deleted or destroyed - SCOPE OF COMMUNICATION
Personal data will be communicated exclusively to the extent strictly necessary to pursue the purposes indicated above, in compliance with current legislation and/or based on contractual agreements, to the following categories of recipients:- Internal personnel authorized to process data for the activities of:
- conducting interviews
- internal audits aimed at maintaining and improving the quality management system compliant with the ISO 9001 standard
- Service providers related and/or consequential to the agreed services, acting as Data Processors, such as:
- companies appointed for the maintenance of information systems, software, and hardware
- professional firms or consultants in labor law or HR, who collaborate in managing the selection phases
- Third parties operating as Autonomous Data Controllers, such as:
- Employment Agencies (pursuant to art. 4 Legislative Decree 276/2003), when they directly receive and process candidate data for intermediation purposes
- Certification bodies or bilateral organizations that require data in case of adherence to calls for tenders, employment programs, etc.
- Public authorities or social security/welfare bodies, if the processing is necessary to comply with regulatory obligations (e.g., INPS, INAIL, Labor Inspectorate, Employment Center)
The updated list of subjects designated as Data Processors pursuant to art. 28 of the GDPR is available at the registered office of the Controller and can be requested through a specific written request
- Internal personnel authorized to process data for the activities of:
- DATA DISSEMINATION
No dissemination of the data subject’s data is foreseen in the context of managing the employment relationship - AUTOMATED PROCESSING AND PROFILING
Personal data is not subject to any entirely automated decision-making process, including profiling - TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES
There are no voluntary transfers of data to third countries; any transfer of personal data outside the European Union will only take place to subjects that guarantee an adequate level of processing protection and/or to countries for which the competent Authorities have issued an adequacy decision and to subjects who have provided suitable guarantees for the processing of personal data through adequate regulatory/contractual instruments - RIGHTS OF THE DATA SUBJECT
Within the limits of current legislation, pursuant to articles 15-18 and 20-21 of EU Regulation 2016/679 and in relation to the purposes of the processing, you have the right:- to obtain confirmation as to whether or not personal data concerning you are being processed, even if not yet recorded, and to have them communicated in an intelligible form
- to obtain the indication of: the origin of the personal data; the purposes and methods of the processing; the logic applied in case of processing carried out with the aid of electronic instruments; the identification details of the controller and any processors; the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them as processors or persons authorized to process the data
- to obtain: a) the updating, rectification or, when interested, the integration of the data; b) the erasure, anonymization or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed; c) certification that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except where this fulfillment proves impossible or involves a manifestly disproportionate effort compared with the right protected
- to object, in whole or in part: for legitimate reasons, to the processing of personal data concerning you, even if pertinent to the purpose of the collection; to the processing of personal data concerning you for the purpose of sending advertising material or direct sales or for carrying out market research or commercial communication
- to data portability, i.e., to receive the personal data concerning you in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance