pursuant to Article 13 and 14 of Regulation (EU) No 2016/679 (GDPR)
Dear Candidate, as the Controller pursuant to Article 4 of the GDPR, Zanasi Group S.r.l. wishes to inform you that it will process your personal data in compliance with the provisions of the Regulation (EU) No 2016/679 (European General Data Protection Regulation - GDPR) adopted on 27 April 2016 and published in the Official Journal of the European Union on 4 May 2016 and the Italian Privacy Code (Italian Legislative Decree 196/2003, as amended by Italian Legislative Decree 101/2018).
We therefore wish to inform you that, as a result of you having submitted your CV or having filled out the dedicated section on our website, our company will collect and process your personal data.
The following definitions will be used herein, as provided by the aforementioned European Regulation.
Personal data: means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Processing: means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Controller and Data Protection Officer
The Controller is Zanasi Group S.r.l., (VAT number 04166780363) with registered office in Via Farina 31, 41053, Maranello (MO), certified e-mail (PEC) address zanasigroup@pec.zanasigroup.com. The Controller has appointed a Data Protection Officer (hereinafter also DPO) pursuant to Article 37 of the GDPR, who can be contacted at the e-mail address: dpo@zanasigroup.it.
Data subjects
- a) Candidates who spontaneously submit their CV via the 'Work with us' section of the website or through other company contact channels.
b) Persons referred for possible selection processes by recruitment companies appointed by the Controller.
Type of data processed
The data subject to processing are:
- personal details (given name, surname, date and place of birth);
- contact details (address, telephone number, e-mail address);
- data contained in your curriculum vitae (educational qualifications, professional qualifications, work experience, technical and language skills, references, any additional information you have voluntarily provided);
- special categories of personal data pursuant to Article 9 of the GDPR that may be contained in your CV (e.g. belonging to protected categories, data concerning health, trade union membership or religious or philosophical beliefs), which will be processed within the limits and in the manner permitted by current legislation;
- any data acquired during interviews or recruitment tests.
Purpose of processing and legal basis
| Purposes of processing |
Legal basis of processing |
| Management of spontaneous applications and recruitment processes, including the storage of CVs for future evaluation. |
Processing is necessary in order to implement pre-contractual measures taken at the request of the data subject (Article 6(1)(b) of the GDPR) |
| Compliance with legal obligations regarding labour law and social security, tax and equal opportunities regulations. |
Need to fulfil legal obligations to which the Controller is subject (Art. 6(1)(c) of the GDPR). |
| Processing of any special data contained in the CV. |
The processing is based on Article 9(2)(b) of the GDPR, as it is necessary to fulfil obligations and exercise specific rights of the Controller or the data subject concerning labour law, social security and social protection. |
| Protection of the legitimate interests of the Controller in the event of in-court or out-of-court disputes related to recruitment procedures. |
Legitimate interest of the Controller pursuant to Article 6(1)(f) of the GDPR. |
Legal nature of the provision of data
The provision of personal data is necessary for the assessment of your application. Failure to provide this information will make it impossible for us to process your application for inclusion in recruitment processes.
Processing methods
Data is processed using IT procedures, electronic means and paper media by internal or external parties who are specifically authorised, trained and bound by confidentiality obligations. The data is processed and stored using appropriate technical and organisational measures to ensure security, integrity and confidentiality, in accordance with Article 32 of the GDPR.
Recipients of personal data
The data will be processed by:
- internal staff of the Controller who are expressly authorised and appointed for this purpose;
- recruitment agencies and specialised consultants appointed, where necessary, as Processors pursuant to Article 28 of the GDPR;
- public bodies and authorities, within the limits of applicable regulations.
The data will not be disclosed or transferred to unauthorised third parties.
Personal data storage period
The data will be stored for a maximum of 24 months from the date of collection, unless an employment relationship is established or there is a different regulatory obligation that justifies further storage. After this period, the data will be erased or anonymised.
Transfer of personal data
Personal data are transferred to third countries or international organisations exclusively for the purposes indicated in this notice and in compliance with the provisions of Regulation (EU) 2016/679. Such transfers are carried out in accordance with Articles 44 et seq. of the Regulation, through the adoption of appropriate technical and organisational measures that ensure a level of protection substantially equivalent to that ensured in the European Union. Specifically, transfer is carried out on the basis of the European Commission adequacy decisions or, failing that, by signing the standard contractual clauses approved by the Commission and, where necessary, by implementing additional measures to strengthen the protection of personal data. The data subject may obtain further information on the guarantees applied and a copy of the standard contractual clauses by contacting the Controller using the contact details provided in this notice.
Rights of the data subject
Pursuant to Articles 15-22 of the GDPR, you may exercise the following rights:
- right to access your personal data;
- right to rectification or updating;
- right to erasure (right to be forgotten);
- right to restrict processing;
- right to object to processing on legitimate grounds;
- right to data portability;
Procedure for exercising rights
Data subjects may exercise their rights at any time by sending:
Furthermore, if you believe that your data have been processed in breach of personal data protection legislation, you have the right to lodge a complaint with the Data Protection Authority, which is headquartered at Piazza Venezia n. 11, 00187 Rome.
