DATA PRIVACY NOTICE
INFORMATION TO CANDIDATES FOR SELECTION PROCEDURES
for the processing of personal data (EU Regulation 2016/679)
According to Section 2 Art. 13 of the EU Data Protection Regulation 2016/679 ("GDPR") and in compliance with Lgs. 30 June 2003, n.196 in short "Privacy Code", as amended by Lgs. 2018/101, concerning the processing of personal data provided by the Candidate during the application and personnel selection processes at our organization, Guala Pack S.p.A. as Data Controller,
informs you on the followings:
1. SELECTION PROCESS INSPIRING PRINCIPLES
1.1 Guala Pack S.p.A selection policies are inspired by the principles of:
− Non-discrimination in employment on the grounds of gender, nationality and ethnicity, candidates’ age, marital status,
religious, political and sexual orientation;
− Wages’ equality for equivalent roles, skills and experiences;
− Equal opportunities in training, promotion and career development;
− Equal opportunities of vulnerable and disabled people to the right to work guaranteeing full access, equal role, treatment and career opportunities.
2. TYPE OF DATA PROCESSED
2.1 The Data Controller processes the following type of Candidates’ personaldata:
− Name, surname, gender, marital status, nationality, age and date of birth;
− Contact details (such as telephone / mobile numbers and e-mailaddress);
− Information on training courses undertaken and language skills;
− Information relating to professional experience (including the last position held and details of the last salary received);
− Curriculum Vitae (CV), including the Candidate’s photo in the CV; and
− Additional personal data that may be provided by the Candidate during the selection phase, in particular during the interview.
2.2 Personal data may be conferred to the Data Controller directly by the Candidate or by third parties for recruitment purposes.
Third parties can include recruitment agencies, job boards and publicly available websites (such as LinkedIn), as well as specialized agencies to facilitate the entry of recent graduates to the job market. The data collected may include contact details, work history and training, professional skills and qualifications, as well as records of any interactions with the Data Controller, including interviews and the Candidate’s tests.
3. NATURE OF PERSONAL DATA
3.1 Usually, the processing only concern data of a common nature and shall be limited to those strictly relevant and functional to the pursuit of the purposes referred to in art. 4 of this notice. Without prejudice to belonging to protected categories, the Candidate is invited not to send any "special categories" data to the Data Controller. Legally protected categories must not indicate any condition but only specify they do qualify as per Law 68/99.
3.2 Should the Data Controller process special categories of Candidates’ personal data, such as health data - for example, if belonging to a protected category - or to the Candidate’s religious beliefs, such information must be provided separately by the Candidate to the Data Controller, as required in order to establish a possible employment relation with the data subject, therefore strictly connected to the obligations, tasks or purposes of the Data Controller that cannot be otherwise fulfilled.
3.3 "Special categories of data", as per Art. 9 of the GDPR "are personal data suitable for revealing racial or ethnic origin, political opinions, philosophical beliefs, or trade union membership, membership to parties, associations or organizations of a religious, philosophical, political or trade union nature, as well as genetic data, biometric data intended to uniquely identify a natural person, personal data suitable for revealing the health status and sexual life ".
4 GROUNDS FOR DATA COLLECTION AND USE
4.1 Data is collected before the start or during a personnel selection through direct and spontaneous CV submission by the Candidate(s) either by: (a) a page of the website made available to the Data Controller and expressly dedicated to the purpose; (b) e-mail; (c) fax; (d) surface mail; (e) other means possibly made available by the Data Controller.
4.2 Data can also be collected as part of the consultation of specialized databases, in which the Candidate has spontaneously deposited his/her CV in order to render it available for consultation to companies potentially interested in getting in touch with the Candidate.
4.3 If personal data is received following the independent initiative of the Candidate (spontaneous Candidate’s CV submission) or collected from third parties, the information referred to in this notice is provided to the Candidate at the time of data registration, or, before their possible communication to thirdparties.
5. DATA PROCESSING PURPOSES
5.1 The collection and processing of the Candidate's personal data will be processed by Guala Pack S.p.A. for the following purposes:
• Allow the Data Controller to manage in all its phases, up to the possible signing of the contract, the personnel selections that may become necessary or appropriate in relation to a specificprofessional role;
• Allow the Data Controller to create and manage its own archive consisting of data obtained on the occasion of previous personnel selections or sent spontaneously by the Data Subjects in order to manage future needs of competent professional figures according to the activities carried out by the DataController.
5.1 The purposes referred to in artt. 4.1. and 4.2 are functionally connected to each other: the provision of data - and, consequently, any consent - cannot be made only in relation to one ofthem.
5.3 Purpose of recruiting staff aimed at the possible establishment of the contractual relationship, including assessment of the
Candidate's professional profile as well as administrative and accounting purposes in the preparatory phase for the possible stipulation of the employment relationship (hereinafter the "Contractual Purposes");
5.4 To fulfill or to require the fulfillment of specific obligations or to perform specific tasks provided for by laws, regulations or collective agreements, or by community legislation, in particular for the purposes of compliance with the legislation on social security and assistance, including supplementary, or in matters of hygiene and safety at work or of the population, as well as in fiscal matters, the protection of health, order and public safety (hereinafter the "Legal Purposes");
5.5 To assert and defend one's rights against the Candidate or third parties in a possible dispute and to carry out a potential merger, spin-off, sale of assets, sale of a company or business unit by disclosing and transferring the data of the Candidate for the third party(s) involved (hereinafter the "Purposes of LegitimateInterest").
6. LEGAL BASIS
6.1 The processing of the Candidate's data is mandatory with reference to the Contractual Purposes and the Legal Purposes, as key to: (i) determine whether the Candidate can adequately fill the position for which he/she sent in the candidature, and ( ii) allow the Data Controller to comply with any legal or regulatory obligation. Therefore, if the Candidate does not wish for his/her data to be processed for such purposes, the Data Controller will be unable to proceed with the evaluation of his/her profile and, consequently, with the signing of the employment or collaboration contract with the Candidate.
The processing of the Candidate's data for Legitimate Interest Purposes is carried out pursuant to Art. 6, letter f), of the GDPR for the pursuit of the legitimate interest of the Data Controller, which is equally balanced with the interest of the Candidate, as the data processing activity is limited to what is strictly necessary for the execution of economic operations requests, or other processing as per previous art. 4. The processing for the Legitimate Interest Purposes is not mandatory and the Candidate may oppose this processing in the manner referred to at the following art. 11, but if the Candidate objects to this processing, his/her personal data cannot be used for the purposes of legitimate interest indicated in art. 4, without prejudice to the case in which the Company demonstrates the presence of overriding legitimate reasons or the exercise or defense of a right pursuant to Art. 21 of the GDPR.
7. DATA PROVISION AND REFUSAL EFFECTS
7.1 The provision of personal data of a common nature by the Candidate for the purposes referred to in artt. 4.1 and 4.2. to the Data Controller is mandatory. Any refusal, in whole or in part, to confer such data, or an inaccurate or untruthful statement, will result in the impossibility for the Data Controller to proceed with the selection phase, or to contact the Candidate should it match a compatible job profiling with the one of the Candidate, being these essential for the aforementioned purposes.
7.2 In the case of personal data provision in the absence of a specific advertisement by the Data Controller, the spontaneous sending by any means of the Candidate’s data will be considered as expressed consent to the processing for the purposes referred to in artt. 4.1. and 4.2.
7.3 Should the Candidate still send data of a special nature, the spontaneous transmission by the data subject will in any case be considered as his/her valid expressed consent to the processing to be carried out by the Data Controller. In this respect, the Candidate waive right from now on to any exception in this regard.
8. DATA PROCESSING METHOD
8.1 Guala Pack S.p.A. processes Candidates’ personal data in a lawful and correct manner.
8.2 The processing of personal data may concern all the operations indicated in Art. 4, point 2) of the GDPR. The processing of common data will be carried out both manually and with the aid of IT means in a manner strictly related to the purposes for which the data were processed and in any case in compliance with the provisions of Art. 32 of the GDPR. The data will be stored in hard and electronic archives, also in order to allow their identification and selection in aggregated form.
Personal data is stored separately for each Candidate.
8.3 Regardless, data will be processed strictly according to the listed purposes following procedures that guarantee both their security and confidentiality, through the adoption of appropriate measures to prevent the alteration, cancellation, destruction, unauthorized access or processing not allowed or not adherent to the purposes of the collection.
9. DATA SHARING AND INTERNATIONAL DATA TRANSFER
9.1 Personal data collected will not be disclosed, yet it may be shared with the followings:
- Companies within the Guala Pack’s group;
- Subjects that provide instrumental or support services to the activities carried out by Guala Pack S.p.A., for example those that deliver services for the management of the information system and telecommunications networks, including email, newsletters and websites’ management, or subjects that provide assistance or consultancy services to the Data Controller for the purposes referred to in this statement;
- Competent authorities and other subjects to whom the right of access to such documents is recognized by virtue of regulatory provisions, for the fulfillment of legal obligations and/or provisions of public entities;
- Transferees of a company or company branch, companies resulting from possible mergers, divisions or other transformations of the Data Controller, as independent data controllers.
The subjects belonging to the aforementioned categories perform data processing management or operate in total autonomy as separate data controllers.
9.2 Guala Pack S.p.A. is part of an international group of companies and, therefore, the data processing could entail the transferring abroad, even outside the EU with or without the aid of electronic or automated means, to fulfill the purposes referred to in art 4. Any transfer of the Candidate's personal data to non-EU countries for the fulfillment of the purposes
indicated in art. 5 of this notice, will occur in compliance with the provisions of GDPR Chapter V within the limits and principles of correctness, lawfulness, purpose, quality, relevance, non-excess and transparency established in Art. 5 of the GDPR.
9.3 Candidates’ common personal data may be communicated to:
• Private or public companies, entities or professionals who carry out consultancy and/or evaluation activities in the context of the personnel selection process and formally appointed external data processing managers;
• Private or public companies, organizations or professionals for the purpose of any preparatory training activities for establishing the relationship with the Candidate;
• Guala Pack and related parties;
9.3.4 Where required by law, the Candidate's consent is required only for the communication of personal data concerning him/her to the subjects identified at art. 7.2. and also for the processing carried out independently by the latter.
9.4 In any case, the Candidate can obtain more information about the possible transfer of his/her data outside the European Economic Area (EEA) by making a request to the Data Controller as indicated at art. 11.
10. DATA MANAGEMENT
10.1 Within the Data Controller organizational structure, the expressly appointed legal representative(s) and authorized personnel duly instructed may have access to personal data, within the limits and according to the procedures set out in their respective offices and exclusively for the pursuit of the purposes set out in art. 4 of this notice.
10.2 The legal representative(s), the Privacy Manager and the human resources personnel will access to the Candidates’ personal data.
10.3 As for the activity connected with the maintenance and assistance of hardware and software, the System Administrator may have access to the personal data covered by this notice.
11. DATA SUBJECTS’ RIGHTS
11.1 Artt. 15-21 of the GDPR grants the Candidate the opportunity to exercise specific rights in relation to the processing of his/her personal data:
• right to request the storing and access to his/her personal data (Art. 15 "Right of access")
• right to rectify/integrate inaccurate or incomplete data (Art. 16 "Right of rectification")
• the right to obtain, if there are justified reasons, the cancellation of data (Art. 17 "Right to cancellation")
• right to limit the data processing (Art. 18 "Right to limitation")
• right to receive his/her personal held in a structured format (Art. 20 "Right to portability)
• right to object to the processing and automated decision-making processes, including profiling (Artt. 21, 22)
• right to revoke a previously given consent
• right to cancellation, transformation into anonymous form or blocking of data processed in violation of the law, including those that do not need to be kept for the purposes for which the data were collected or subsequently processed
• the right to submit, in the event of non-response, a complaint to the Data Protection Authority
11.2 Requests to exercise these rights may be proposed, in accordance with the law, without particular formalities and, in cases of requests for mere access, even orally. In order to guarantee a faster and more complete feedback, as per art. 13 all requests shall be sent to the Data Controller in writing at the addresses below.
12. DATA RETENTION
12.1 Data is processed using manual, electronic and IT tools with methods strictly related to the purposes for which the data is processed and in any case in compliance with the security measure provisions of Art. 32 of the GDPR.
12.1 Data is processed using manual, electronic and IT tools with methods strictly related to the purposes for which the data is processed and in any case in compliance with the security measure provisions of Art. 32 of the GDPR.
12.2 Personal data voluntarily provided by the data subject will be processed by the Data Controller for a period of 12 months. At the end of the first 12 months, the Data Controller will send a communication to verify that the Candidate does not intend to extend the processing and update his/her data. In the absence of an explicit reply from the Candidate, the processing will be deemed terminated and all information held by the Data Controller will be definitively deleted.
12.3 The Candidate may in any case, at any time, request the Data Controller to cease the processing of his/her personal data, exercising the rights referred to in Artt. 15-21 of the GDPR.
12.4 Data processed for Legitimate Interest Purposes are kept for a period of 10 years from the time of collection, in the case of processing aimed at asserting and defending the rights of the Data Controller against the Candidate or third parties in a possible dispute. At the end of the retention period, the data will be deleted, anonymized or aggregated.
13 DATA CONTROLLER
13.1 The Data Controller referred to in this statement is Guala Pack S.p.A. with registered office in Castellazzo Bormida (Alessandria), Via Carlo Mussa 266 - Italy, in the person of its pro-tempore legal representative for the delegated purpose.
13.2 Candidates may exercise all their privacy rights within the timing and in the manner foreseen by the current legislation by sending an e-mail to: privacy@gualapack.com or by post at the above address.
14. PRIVACY POLICY CHANGES
14.1 This privacy notice is effective as of May 1, 2018, and occasionally it may be modified to adapt to organizational changes or different ways of using the information; any change shall be notified in advance to the Candidates who can access the revised policy on the company’s website. Last update: September 1, 2022.