Notice on the processing of personal data

The Data Controller, Villani S.p.A. pursuant to and for the purposes of Regulation (EU) 2016/679 on the protection  of personal data (hereinafter "GDPR"), provides data subjects with information on the processing of their  personal data. Pursuant to Article 37 of the GDPR, the Data Controller is not subject to the obligation to appoint a  Data Processor (DP).

Data subjects

Job applicants

Purpose and legal nature of processing

The personal data acquired or collected will be processed for purposes relating to the assessment and selection of candidates for the establishment of an employment relationship, or also for any training prior to employment. The legal basis of the processing pursuant to GDPR art. 6 results from the execution of pre-contractual measures at the request of the data subject who proposes the application to us, or, in the case of an interview, on the execution of agreements with the data subject and in the legitimate interest of the Data Controller. The provision of personal data is optional: failure to provide such data, or the provision of incorrect data, may make it impossible for the Data Controller to fulfil the purposes envisaged and to guarantee the appropriateness of the data processing.

Processing of special categories of personal data

During the assessment, the Data Controller may become aware of special categories of personal data as defined by art. 9 of the GDPR "health data and state of health, trade union or political affiliations, religious or philosophical opinions, biometric and genetic data": pursuant to Legislative Decree. 101/2018, the processing of such data communicated by the data subject for the purposes of assessment for job placement is allowed without the need for consent, with the exclusion of genetic data which cannot be processed even with the consent of the data subject. In compliance with art 9 of the GDPR, the processing of these data will be carried out only if necessary. Genetic and biometric data will not be processed in any case.

Processing and storage methods

The processing is carried out using manual procedures on paper archives and computer procedures and electronic tools on digital archives, by personnel authorised by the Data Controller pursuant to Art. 29 of the GDPR, by other companies that are the parent company, subsidiaries or associates pursuant to Art. 2359 of the Italian Civil Code (the "Villani Group"), or also by third parties (e.g. employment consultants) designated by us as data processors pursuant to Art. 28 of the GDPR for the processing operations for which they are responsible, in compliance with the principles set out in Articles 5, 6 of the GDPR and with the adoption of appropriate security measures. In compliance with the principles of lawfulness, purpose limitation and data minimisation, the period of storage at the Data Controller of CVs and other data of job applicants is established for the indicative time of three years from collection. After this period, the data will be deleted or destroyed.

Regulation (EU) 2016/679 - Articles 15 to 22 - Rights of the data subject

The data subject has the right to contact the Data Controller at the addresses indicated here or by writing to privacy@villanisalumi.it to exercise the rights provided for by Articles 15 to 22 of the GDPR: to be informed of the existence of your personal data, even if not registered, their communication in an intelligible form; to request the cancellation, communication, updating, rectification, integration of your personal data. You have the right to revoke at any time your consent to optional processing, but the revocation does not affect the processing already carried out. The data subject has the right to lodge a complaint with the Data Protection Authority for the protection of personal data: see www.gpdp.it for more details.