INFORMATION ON THE PROCESSING OF PERSONAL DATA
CURRICULUM VITAE

Avvocati.net (hereinafter also referred to as the Data Controller) provides the Data Subject (hereinafter also referred to as the Candidate), i.e. the person to whom the personal data refer, with the following information pursuant to Article 13 of EU Regulation No. 2016/679 of 27 April 2016 (hereinafter GDPR), concerning the protection of natural persons with regard to the processing of personal data. The purpose of this policy is to describe the characteristics of the processing carried out in relation to the personal data provided by the Data Subject and the measures taken to protect their rights.

Data controller

The data controller is Avvocati.net, with registered office in Rome, Viale Liegi no. 7 – 00198 – VAT no. 18030541009 – e-mail address of the Data Controller: privacy@avvocati.net

Data subject to processing

The Data Controller essentially collects the following personal data:

  • personal details

  • education data

  • contact details

  • image accompanying the CV, if included

  • any data belonging to special categories if required by law (e.g. quotas reserved for categories protected by specific legislation), such as data revealing health status.

  • as well as, in general, information relating to the Candidate’s professional experience provided in the form of a CV and/or cover letter and/or during selection interviews.

The Data Controller will only process personal data that is relevant and strictly necessary for the establishment of a possible employment relationship.

We recommend that you include in your curriculum vitae or provide only the data necessary to evaluate your professional profile and not to indicate – unless strictly necessary in relation to legal constraints (e.g. quotas reserved for particular categories of workers) – data of a particular nature pursuant to Article 9 of the GDPR (e.g. data revealing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, trade union membership, membership of religious, philosophical, political or trade union associations or organisations, as well as personal data revealing health or sex life).

If the job position offered by the Data Controller is aimed at protected categories and/or the spontaneous application comes from a person belonging to a protected category, the Data Controller may use data belonging to particular categories of the Data Subject solely and exclusively for the purposes of establishing the employment relationship.

Therefore, if the CV contains any data of a particular nature (relating, in particular, to health, religious beliefs and political opinions), in the absence of a legal basis that legitimises its processing (e.g. legal constraints – quotas reserved for particular categories of workers), the data will be immediately deleted.

Purpose of processing

Personal data will be processed for purposes connected with or instrumental to:

  1. evaluating the application (e.g. managing all stages related to the selection of candidates and evaluating the results of interviews).

  2. initiating a working relationship.

Legal basis for processing.

The processing is lawful because it is based on the following legal basis:

  • Execution of pre-contractual measures taken at the request of the data subject.

  • Compliance with legal obligations (requirements on quotas reserved for access to the labour market)

Consent of the data subject to the processing of special categories of data

The inclusion of sensitive data in CVs is permitted exclusively in accordance with specific laws governing access to the labour market for persons entitled to do so due to particular health or other conditions, which consequently make it mandatory for the Data Controller to process sensitive data. In such cases, we inform you that the processing will be carried out in accordance with Article 9, paragraph 2 of the GDPR (b), which legitimises the processing of special categories of data necessary to fulfil the obligations and exercise the specific rights of the data controller or data subject in the field of labour law and social security and social protection, without it being necessary to obtain consent to the processing.

The processing of data revealing the state of health of candidates’ family members or cohabitants is permitted if it is aimed at recognising a specific benefit in favour of the candidates (e.g. compulsory recruitment, recognition of a title deriving from disability or infirmity). We inform you that in such cases, the processing of sensitive data relating to the family members or cohabitants of candidates, which is necessary for the latter to exercise their specific rights in the field of labour law and social security and social protection, does not require any specific consent. In cases where it is not possible to base the processing of data relating to candidates’ family members or cohabitants on labour law and social security and social protection, the Candidate will be required to obtain specific consent from the data subjects. Failing this, the Data Controller must delete the relevant information.

.

Methods of processing

Personal data is processed for the purposes indicated in this policy, both electronically and on paper.

Mandatory or optional nature of data provision

The provision of data is optional, but necessary, as failure to provide such data will make it impossible for the Data Controller to evaluate the application and therefore initiate a possible working relationship.

Data retention period

Personal data will be retained for the period strictly necessary to pursue the purposes for which it was collected.

However, the Data Controller may retain personal data even after this period if it considers that there are further purposes related to personnel recruitment and selection interests.

In any case, in the event of:

  • unsolicited applications, the personal data of the Data Subject will be retained for 12 months from receipt of the CV;

  • response to specific personnel recruitment and selection advertisements published by the Data Controller and/or on its behalf by third parties, the personal data of the data subject will be kept for as long as the offer remains valid. After that, six months after the offer has expired, the personal data will be deleted.

Categories of subjects to whom personal data may be disclosed

The processing of personal data provided to us may be carried out, in accordance with the principle of strict necessity:

  • By the Data Controller’s employees, who act and process the data under the authority and instructions of the Data Controller, in accordance with Article 29 of the GDPR, or by employees designated by the Data Controller, in accordance with Article 2 quaterdecies of Legislative Decree No. 101/2018.

  • By natural or legal persons whose right to access the personal data of the Data Subject is recognised by provisions of European Union law or Italian law, such as, for example, competent authorities and/or supervisory bodies for the fulfilment of legal obligations, and public administrations for their institutional purposes.

  • By natural or legal persons used by the Data Controller to carry out activities instrumental to the achievement of the Purposes (such as software suppliers, cloud partners, data centres, IT consultants). Third parties who access the data will do so in compliance with current legislation on the protection of personal data and the instructions given by the Data Controller and will in any case be appointed by the Data Controller as external Data Processors.

A list of Data Processors is available at the Data Controller’s headquarters.

Disclosure of data

Personal data will not be disclosed under any circumstances.

Rights of the data subject

The GDPR guarantees specific rights to the data subject. For each processing operation, the data subject may exercise the following rights:

  • Right of access: you have the right to obtain a copy of your personal data that is being processed.

  • Right to rectification: you have the right to rectify your personal data stored by the Data Controller if it is not up to date or correct.

  • Right to object to the processing of their personal data for commercial purposes: they may request that the Data Controller cease sending commercial communications at any time.

  • Right to object to decisions based on exclusively automated processes: you may request not to be the recipient of decisions made on the basis of exclusively automated processes, including profiling.

  • Right to withdraw consent: you have the right to withdraw your consent to a specific processing operation at any time.

  • Right to contact the Data Protection Authority: you have the right to contact the Data Protection Authority if you have any doubts about the processing of your personal data by the Data Controller.

The data subject may also exercise the following rights in certain circumstances:

  • Right to erasure: you may request that the Data Controller erase your personal data if the purposes of the processing have ceased to exist and there are no legitimate interests or legal provisions requiring its continuation.

  • Right to object to processing: you may request that the Data Controller cease to carry out a specific processing operation on your personal data.

  • Right to restrict processing: you have the right to request that the Data Controller restrict the processing of your personal data.

  • Right to data portability: you have the right to obtain a copy of the data in a structured, commonly used and machine-readable format from another Data Controller.

To exercise any of the above rights, the Data Subject may send an email or write to the following address, specifying the request and providing the Data Controller with the information necessary to correctly identify the sender (also attaching a copy of their identity document where necessary for identification purposes):  

  • by e-mail: privacy@avvocati.net

  • by post: Avvocati.net, Rome, via Liegi n. 7– 00198

The Data Controller will respond within one month. If for any reason the Data Controller is unable to respond, it will provide a detailed explanation of why it cannot comply with the request.