TYPES OF PERSONAL DATA PROCESSED

The personal data processed are collected directly from the data subject following the submission of a curriculum vitae (CV) for unsolicited applications or in response to recruitment notices published by the Fondazione through its various available channels, including the Villaggio’s website, on the “Work with us” page. For recruitment activities listed on the “Work with us” page, applicants may submit their CV as an attachment to the form to be filled in on the web page itself, indicating the position applied for, first name, last name, email, and phone number (mandatory fields marked with an asterisk), plus an optional short message.

For the purposes of managing recruitment and selection activities, the Fondazione processes data and information classified under the GDPR as “personal data,” including “special category” data if voluntarily provided by the candidate.

The personal data processed may be summarized as follows:

• identification and contact data (e.g., first name, last name, date of birth, tax code, residence, domicile, telephone numbers, email address, etc.); 
• data relating to education and academic background (qualifications held, skills, etc.);
• data relating to previous work experience (e.g., positions held, hiring date, company role, periodic evaluations, and other data related to work experience), professional qualifications, and professional information provided by the candidate;
• tax and income data (e.g., tax code, previous salary, benefits, etc.);
• special category data if voluntarily provided by the candidate, such as data suitable for revealing a state of health related to a disability or membership in a protected category;
• any other data provided with the CV, such as, for example, a passport-style photo included in the application, possession of a driving license, or other information the candidate deems appropriate to include in their CV.

PURPOSES OF PROCESSING

The personal data provided with the application, contained in the CV, are processed in paper-based or computerized archives and databases for the following purposes:

a) to analyze the CV, assess the consistency of the professional profile and requirements against open positions, manage contact in order to schedule introductory and evaluation interviews, and more generally to manage recruitment and selection procedures, to carry out any preliminary activities prior to signing an employment contract, and to comply with legal, contractual, or regulatory obligations (hereinafter “application management”);

b) to improve personnel selection processes and organizational efficiency by retaining CVs so that the Fondazione may contact in the future candidates who were not interviewed, as well as candidates who were interviewed with a positive assessment but not subsequently hired, in order to evaluate the CV again in the future (hereinafter “optimization of the selection process”);

c) to fulfill any legal obligations to which the Fondazione is subject (hereinafter “compliance”).

LEGAL BASIS FOR PROCESSING

Processing of personal data, in relation to the purposes stated above, is based on the following legal grounds:

a) for the “application management” purpose, processing is necessary to carry out activities related to recruitment and selection, to respond to a request from the data subject — particularly in the case of unsolicited applications — and for the performance of a contract or pre-contractual measures to which the data subject is a party in the event of a positive outcome of the selection process (Art. 6(1)(b) GDPR);

b) for the “optimization of the selection process” purpose, processing carried out after the selection is based on the Controller’s legitimate interest (Art. 6(1)(f ) GDPR) in considering profiles for other open positions compatible with the CVs received, in order to ensure the Controller’s organizational efficiency and optimize the activity carried out by the human resources management office;

c) for the “compliance” purpose, processing is necessary to fulfill legal obligations to which the Controller is subject (Art. 6(1)(c) GDPR).

CONSEQUENCES OF REFUSAL TO PROVIDE DATA

Providing personal data for the purposes stated is optional.

Please note that failure to provide, or objection to the processing of, personal data would make it impossible for the Controller to consider the application, evaluate the profile, proceed with contact activities to schedule introductory and selection interviews, or consider the CV for future positions.

Any processing of special categories of personal data (such as, for example, data concerning health, political opinions, etc.) may be carried out only with the explicit consent of the data subject pursuant to Art. 9(2)(a) GDPR. Such data is therefore not covered by the legal bases listed above, since it is not necessary for recruitment and selection activities. Candidates are therefore advised not to provide this type of information.

RECIPIENTS AND/OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Data processing is carried out by persons authorized by the Controller to process personal data for the purpose of performing the tasks assigned to them, limited to the purposes described above. Data may be disclosed to third parties who perform services on behalf of the Fondazione, in order to fulfill regulatory obligations and to manage recruitment and selection activities. Should an employment relationship be established following the selection process, data may be disclosed to categories of parties who collaborate with or provide services to the Fondazione, such as consultants, freelance professionals, or affiliated companies, for administrative, accounting, tax, and legal activities and consultancy, within the limits necessary for the performance of their duties. The recipients of the data act either as “Data Processors” pursuant to Art. 28 GDPR, or operate entirely autonomously as separate Data Controllers.

Personal data are also processed, albeit exclusively in an indirect capacity and for technical and IT-related activities, by the following parties:

• persons internal to the Controller’s organization who are authorized and who carry out technical/ IT activities on the information system;
• the provider of technical support and IT consultancy services, acting as Data Processor and System Administrator (Consulenzeit.com Srls);
• the provider responsible for the development and maintenance of the website, acting as Data Processor and System Administrator (1-618 Srl). 

The up-to-date list of data processors is available from the Villaggio’s Privacy Officer (Dr. Claudio Faloni; tel. 06 872089207; email referenteprivacy@fondazioneromasalus.it). Personal data may also be disclosed in fulfillment of an obligation provided for by national or EU laws, regulations, or other legal provisions, or as a result of orders issued by authorities so entitled, or in compliance with requests from supervisory and control authorities.

PROCESSING METHODS

Personal data are processed in a manner that ensures maximum security and confidentiality, using paper-based, IT, and telematic tools and means, adopting appropriate technical and organizational security measures to reduce the risk of loss, destruction, unauthorized access, disclosure, and tampering of data.

TRANSFER OF DATA TO THIRD COUNTRIES

The personal data provided and processed are not subject to transfer to third countries, whether within or outside the European Union.

DATA RETENTION PERIOD

Personal data will be retained for the entire duration of the selection process for the purpose of “application management.” Personal data may instead be retained for a maximum period of 12 months from the date they were provided, for the purpose of “optimization of the selection process.” The Controller reserves the right to retain, for a further 12 months, CVs deemed compatible with current or future job positions, by sending the data subject a request to update the personal data contained in the CV, in order to verify the data subject’s willingness for their CV to be kept in the Controller’s systems for an extended period: in the absence of a response to such communication, upon expiry of the 12th month the CV is deleted; if the response is positive, however, the data subject’s personal data will be retained for a further 12 months and subsequently deleted.

Personal data processed for “compliance” purposes and to fulfill applicable legal obligations will be retained for the period required by such regulations. Should your job application be accepted, your personal data will be archived and processed by the Controller in accordance with the privacy notice prepared for employees.

In general, the retention period is determined according to the principles of necessity and proportionality. Data will be retained for as long as necessary to fulfill the purposes for which they were collected, in compliance with the data minimization principle set out in Article 5(1)(c) of the Regulation.

RIGHTS OF THE DATA SUBJECT

With regard to the data processing described above, the Regulation grants data subjects the rights set out in Articles 15, 16, 17, 18, 19, 20, 21 and 22, and in particular: 

• Art. 15 – Right of access: the data subject has the right to obtain confirmation as to whether or not personal data concerning them is being processed, and, if so, to access the personal data, its origin, the purposes and methods of processing, the recipients to whom the data will be disclosed, and the logic applied in the case of processing carried out with the aid of electronic tools. 
• Art. 16 – Right to rectification: the data subject has the right to obtain, without undue delay, the rectification of inaccurate personal data concerning them. 
• Art. 17 – Right to erasure: the data subject has the right to obtain the erasure or anonymization of personal data concerning them (where the specific grounds set out in Art. 17 of the Regulation apply). 
• Art. 18 – Right to restriction of processing: the data subject has the right to restrict the processing of personal data concerning them (where the specific grounds set out in Art. 18 of the Regulation apply). 
• Art. 19 – Right to notification regarding rectification/erasure/restriction: the Controller is obliged to notify each recipient to whom personal data have been disclosed of any rectification, erasure, or restriction of processing carried out pursuant to Articles 16, 17 and 18, unless this proves impossible or involves disproportionate effort. 
• Art. 20 – Right to data portability: the data subject has the right to receive the personal data concerning them in a structured, commonly used, and machine-readable format. In exercising their rights regarding data portability, the data subject has the right to have their personal data transmitted directly from one controller to another, where technically feasible. 
• Art. 21 – Right to object: the data subject has the right to object to processing (where the specific grounds set out in Art. 21 of the Regulation apply), and the Controller must refrain from further processing the personal data in question, save for certain circumstances as provided for in that same Article. 
• Art. 22 – Right not to be subject to a decision based solely on automated processing: the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

Pursuant to Art. 7 of the Regulation, the data subject’s rights include the right to withdraw consent given. Withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal.

Data subjects also have the right to lodge a complaint (Art. 77 GDPR) or to seek judicial remedy (Art. 79 GDPR) if they believe that processing has taken place in violation of the GDPR.

The exercise of the above rights is subject to the limits, rules, and procedures set out in EU Regulation 679/2016. In accordance with Article 12(3), the Controller will provide the data subject with information on the action taken without undue delay and, in any event, no later than one month from receipt of the request. This period may be extended by two further months, where necessary, taking into account the complexity and number of requests. The Controller will inform the data subject of any such extension, and the reasons for the delay, within one month of receiving the request.

To exercise these rights, please contact the details provided below, using the appropriate forms available on the website of the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, GPDP), also accessible via the following link: https://www.garanteprivacy.it/web/guest/home/ docweb/-/docweb-display/docweb/1089924.

Controller’s contact details for exercising the rights provided for by the Regulation:

• Data Controller: Fondazione Roma – Salus 
• Address: Via Ernesto Calindri no. 40, 00138 Rome 
• Phone: 06 8720891 
• E-mail: privacy@fondazioneromasalus.it 
• Privacy Officer: Dr. Claudio Faloni 
• Privacy Officer phone: 06 872089207 
• Privacy Officer e-mail: referenteprivacy@fondazioneromasalus.it

FURTHER INFORMATION

For the processing of personal data relating to the management of the Villaggio’s website, please refer to the privacy policy and cookie policy published on the website itself.

AMENDMENTS TO THIS DOCUMENT

This document, which may be amended or updated, is always available for consultation on the Villaggio’s website, on the “Work with us” page.