Applicant Privacy Statement

Casa di Cura Paideia S.p.a. with registered office in Via G. Fabbroni, 6 – 00191 – Rome, VAT no 01847201009 (hereinafter, the “Data Controller“), in its capacity as Data Controller, hereby informs you pursuant to Leg. Decree No 196/2003, as amended by Leg. Decree 101/2018 (hereinafter, the “Privacy Code“) and Article 13 Regulation (EU) No 2016/679 (hereinafter, the “GDPR“) that your data will be processed in accordance with the principles of fairness, lawfulness, transparency, in compliance with the purposes and methods set out below, collecting only the data necessary for the processing.

Purpose of the processing

The Data Controller collects, records, consults and, more generally, processes the data included in your CV (personal data, previous work experience, academic qualifications, family background, passport photo) for purposes relating to the selection process.

In particular, the Data Controller may use your data for:

1. pre-contractual activities relating to your declared interest in working with us and therefore pertaining to the recruitment and selection process,

2. pursuing our legitimate interest in order to ascertain, exercise or defend our rights in court.

Type of personal data processed

The personal data that the company usually uses include, but are not limited to:

• name, address, contact details, tax code, age, place and date of birth, academic qualification, previous work experience and qualifications (education, training courses and internships),
• documents proving your identity and right to work and any other data on your CV;
• if the application was made through our website/portal using your LinkedIn account or any other social media, your social network profile data;
• feedback on you from our staff and other persons;
• we may also collect data concerning your visits to our website (e.g. your IP address, browser, timestamp, location, national web traffic data, location data).

In some cases, we may also collect, where strictly necessary for selection purposes:

• your special data referred to in Art. 9 of the GDPR identifying your health status (e.g. belonging to protected categories under Law 68/99, any disability and arrangements required in the workplace).

Please do not include any other special data (religious or philosophical beliefs, political opinions, party or trade union membership, sexual orientation) in your CV, which would be deleted in any case.

Legal basis

The processing of data for the purpose referred to in point 1 a) is necessary for carrying out the selection process and in general, for executing pre-contractual measures relating to the management of your professional relationship with us, pursuant to Art. 6 par 1 l. b) of the GDPR.

The processing of data for the purpose referred to in 1 b) is necessary to pursue our legitimate interest pursuant to Article 6 par 1 l. f) of the GDPR.

With regard to special data identifying health status and strictly necessary for the purposes of the selection as indicated above, such data may be processed without your prior consent insofar as it is necessary to fulfil the obligations or perform specific tasks provided for by European Union regulations, laws, regulations or collective agreements, including company agreements, as well as to exercise the specific rights of the Data Controller or of the data subject in the field of labour law and social security and social protection, pursuant to Article 9 par. 2 b) of the GDPR.

Collection methods

Your data is collected in the following ways:

• via e-mail;
• via paper mail;
• at our offices;
• via our website/portal;
• via third-party websites or social networks.

Additional personal data may later be collected from the data subject during the interview, in a specific assessment form that will be kept together with the CVs for the same retention period.

Your data may therefore be collected:

– when your CV is received in response to a job vacancy ad published by the Data Controller. In this case, only applications that meet the requirements for an assessment interview will be evaluated.

– when your CV is sent as a result of an unsolicited application: if the application is not of interest to the Data Controller, the CV received will be destroyed immediately.

Should it instead be of interest to the Data Controller, the department in charge of evaluating applications will send the data subject a suitable privacy statement upon initial contact.

Once your application has been received, whether unsolicited or in response to an advertisement, your personal data may be entered, by personnel authorised for that purpose, into the Data Controller’s files, either in paper form or electronically.

Retention period

The Data Controller has the right to retain your personal data for a period of up to 24 months from your application, if of interest to us , or from the last activity with which you showed interest in us (e.g. registration, logging in, updating your CV on the webform). If the selection process is successful, the company will be obliged to keep your personal data for longer in order to comply with contractual and legal obligations.

Obligation to provide data and consent

The provision of data is optional and depends on the applicant’s willingness to submit their CV. With regard to the data subsequently and possibly requested by the Data Controller, failure to provide such data will prevent the assessment of the requirements for employment and/or starting work and thus the establishment of an employment relationship with the Data Controller.

Processing methods

The processing of personal data collected using the method described above will be carried out both manually and electronically and maximum security will be guaranteed in order to protect the data subject’s rights and freedoms. In particular, no automated decision-making processes shall be used to process data.

Disclosure and dissemination of personal data

The Data Controller — without requiring your consent — may disclose your personal data to different categories of recipients, such as:

• the authorised persons in charge of processing involved in the assessment and selection of applications.
• parties (by way of example, companies/natural persons who carry out staff recruitment and selection activities on behalf of the Data Controller, companies/natural persons who provide the Data Controller with services instrumental to fulfilling the aforementioned purposes, companies/natural persons who carry out data storage activities for the Data Controller). These parties may carry out these activities as autonomous data controllers, external data processors or joint data controllers.

The Data Controller may also disclose your data for the above-mentioned purposes:

• to supervisory bodies, judicial authorities, police bodies, public bodies and all parties to whom disclosure is compulsory by law for the fulfilment of the aforementioned purposes. These parties shall process the data in their capacity as autonomous data controllers.

The data collected is not subject to dissemination.

Transferring data abroad

Personal data are not stored on servers located outside the European Union. It is in any case understood that the Data Controller, if necessary, shall be entitled to move the servers even outside the EU. In this case, the Data Controller ensures that any data transfer outside the EU shall be in accordance with the guarantees as stated in the GDPR, including the European Commission’s adequacy decisions or contractual agreements for the protection of personal data (known as “EU Standard Contract Clauses”).

Your rights and how to exercise them

We hereby inform you that you can exercise your rights as follows under Art. 15 et seq. of the GDPR at any time and under the relevant conditions:

• obtain confirmation of any personal data concerning you held by us and a copy thereof in intelligible form;
• request the updating, rectification or completion of your data;
• request the deletion of your data, within the terms allowed by law;
• object, in whole or in part, to the processing of personal data concerning you;
• restrict processing, in the event of a infringement, request for rectification or objection;
• request the portability of electronically processed data provided on the basis of consent or contract;
• withdraw consent to the processing of your data, where applicable;
• in relation to fully-automated profiling, obtain human intervention by the Data Controller in order to express your opinion and oppose the decision.

If you consider it appropriate, you may lodge a complaint with the Data Protection Authority.

To exercise your rights, you may contact the Data Controller at the following e-mail: info@paideiahospital.it.

You may also contact the Data Protection Officer (DPO) at the following e-mail dpo@paideiahospital.it.