PRIVACY NOTICE FOR CANDIDATES
pursuant to articles 13 and 14 of the Regulation (EU) N. 679/2016
This privacy notice, provided to data subjects in compliance with articles 13 and 14 of Regulation (EU) No. 679/2016 (General Data Protection Regulation, hereinafter "GDPR"), describes the processing of personal data carried out by E-work S.p.A. and E-work HR Company Poland Sp. z o.o., both belonging to the e-work group ("Group"), as joint controllers ("Joint Controllers" or "Companies").
The Joint Controllers, for the benefit of your need to achieve your job placement goal faster, share a common database, thereby increasing - within the scope of specific recruiting projects - the match between supply and demand in the labour market.
The Joint Controllers will process your personal data in accordance with the obligations and responsibilities governed in the joint controllership agreement drafted by them in accordance with article 26 of the GDPR. The essential content of the agreement is available at the following link
https://www.e-workhrcompany.pl/wp-content/uploads/2023/01/Essence-of-the-Joint-Controllership-Agreement.pdf.
It should be noted how this privacy notice only includes the processing carried out by the Companies as Joint Controllers.
Who determines how and why your personal data are processed?
The Joint Controllers of your personal data are:
• E-work S.p.A. with registered office at Via Teocrito 47, 20128, Milano (MI), Tax Code and VAT number 13063380151, e-mail:
privacy@e-workspa.it; and
• E-work HR Company Poland Sp. z o.o. with registered office at ul. Narutowicza 7/9, 90-117 Łódź, Tax Code and VAT number 7262395049, e-mail:
iod@e-workspa.pl.
What is the source of your personal data?
Your personal data are usually collected directly from you. In some cases, your personal data will also be collected from third parties (e.g. job recruiting platforms, such as InfoJobs, Indeed, Linkedin etc.).
Has a data protection officer been appointed?
E-Work S.p.A. has appointed a data protection officer (hereinafter referred to as "DPO") who can be contacted at the following e-mail address:
rpd@e-workspa.it.
Which personal data do we process?
For the purposes mentioned in this privacy notice, the Joint Controllers will process the following personal data:
• identification and contact personal data: name and last name, country, citizenship, date of birth, address, email address, mobile number;
• data contained in the curriculum vitae: data relating to previous work experience (such as positions held, date of employment, company role, remuneration and any benefits), education related data, professional qualifications, certificates, picture and other personal data included in the curriculum vitae;
• special categories of data: the Joint Controllers, where provided, may process special categories of data, such as health-related data (e.g., membership of protected categories). In this case, the data processing will only be allowed if one of the conditions set forth in article 9, paragraph 2, letter b) of the GDPR is met;
• any other personal data provided by the candidates.
What are the purposes and the legal basis of the processing?
Your personal data will be processed for the following purposes and on the basis of the following legal basis of the processing:
• research and selection, within the scope of specific recruiting projects previously agreed and shared by Joint Controllers, of candidates to be placed with Joint Controllers’ clients in order to establish a work or collaboration relationship with them. The legal basis of the processing is the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract.
The provision of personal data is necessary in order to evaluate your application; failure to provide such data entails the impossibility for the Joint Controllers to initiate the research and selection process;
• sending communications via e-mail relating to job offers available for job positions open at Joint Controllers’ clients, within the scope of specific recruiting projects previously agreed and shared by Joint Controllers. The legal basis of the processing is the legitimate interest of the Joint Controllers to keep you informed about available job offers.
The provision of personal data for this purpose is optional; however, failure to provide such data entails the impossibility for the Joint Controllers to send you the above-mentioned communications.
How long personal data are stored?
We retain personal data only for the time necessary for the purposes for which they were collected or for any other related legitimate purpose. Therefore, if personal data are processed for two different purposes, we will retain the aforementioned data until the purpose with the longer-term ends. In any case, we will no longer process personal data for that purpose for which the retention period has expired. Personal data that are no longer necessary, or for which there is not a legal basis for their retention, will be irreversibly anonymised (and thus can be retained) or deleted.
Personal data processed for the purpose of research and selection are retained for a period of 12 months from their provision or from your last access to your online account (i.e. reserved area of the website); in case of your inactivity for a period of 9 months (i.e. failure to log in to your online account) an alert system will invite you, by sending communications, to access to the reserved area of the website. In case of persistent inactivity your profile will be deleted.
Personal data processed for the purpose of sending communications regarding available job offers are retained as long as you keep your online account active or until you exercise your right to object to the processing, if previous. You will be regularly reminded about your right to object to processing carried out for such purpose.
What recipients do we share your personal data with?
Your personal data will be processed by persons authorized and instructed to the processing.
Your personal data may be communicated for research and selection purposes to autonomous data controllers, such as customers of the Joint Controllers (private and public organizations), as well as to data processors to whom specific instructions on the processing of your data have been provided, such as companies that provide IT services to us (e.g. common database management, maintenance of IT systems, hosting services, etc.).
In addition, in the light of the implementation of a common database, the data will be accessed by the Controllers for the above-mentioned purposes.
Will your personal data be transferred outside of the EU?
Due to the location of the company that manages and maintains our common database, your personal data will be transferred to Switzerland, a country for which the European Commission has issued an adequacy decision.
In any case, where the Joint Controllers, due to the location of their service providers, need to transfer data outside the European Union to countries for which the European Commission has not issued an adequacy decision, the Joint Controllers undertake to ensure adequate levels of protection and safeguards, including contractual ones, compliant with the applicable laws, including the adoption of standard contractual clauses pursuant to article 46, par. 2, letter c), of the GDPR, supplemented if necessary by additional technical, legal and organizational measures necessary to ensure that the level of protection of personal data is equivalent to the one of the European Union.
What are your rights in relation to your personal data?
In relation to the processing of your personal data you will always be able to exercise your rights provided by the GDPR (articles 15-21), such as:
• obtain confirmation of the existence of your personal data and access to their content (right of access);
• update, amend and/or correct your personal data (right to rectification);
• request the erasure or restriction of processing of personal data processed in breach of law, including those that are no longer necessary in relation to the purposes for which data were collected or otherwise processed (right to erasure and right to restriction);
• withdraw the consent given, in cases where the legal basis of the processing is the consent, without prejudice to the lawfulness of the processing based on the consent given before its withdrawal (right to withdraw consent);
• receive a copy of data in electronic format and request that such data will be transmitted to another data controller (right to data portability).
In addition, you can object to the processing at any time where the processing is based on our legitimate interest (right to object), such as in the case of processing carried out for the purpose of sending communications, via e-mail, regarding available job offers for job positions open at the Joint Controllers’ clients.
To exercise your rights, you may send a request to E-work S.p.A.:
• to the e-mail address:
privacy@e-workspa.it;
• to the DPO e-mail address:
rpd@e-workspa.it;
• by paper mail to the following address: Via Teocrito 47, 20128, Milano (MI);
or, you may send a request to E-work HR Company Poland Sp. z o.o.:
• to the e-mail address:
iod@e-workspa.pl;
• by paper mail to the following address ul. Narutowicza 7/9, 90-117 Łódź.
What other rights can you exercise in relation to your personal data?
If you consider that the processing of your personal data is in violation of the applicable data protection law, you always have the right to lodge a complaint with the Data Protection Authority of the Member State of your habitual residence, place of work or place of the alleged infringement.
Last update: January 2023
