Privacy statement | Careers at Unitec S.p.A.

PRIVACY POLICY FOR JOB APPLICANTS

Standards of reference:
-Italian Legislative Decree no. 196 of June 30, 2003, Code regarding the protection of personal data (hereinafter the Privacy Code).
-EU regulation no. 679 of April 27, 2016 concerning the protection of natural persons with regard to the processing of personal data, as well as the free movement of personal data (hereinafter EU Regulation).
-Italian Law no. 300 of May 20, 1970, most recently updated with the amendments envisaged by Italian Legislative Decree no. 185 of September 24, 2016 (hereinafter the Workers' Statute).
-Italian Legislative Decree no. 81 of April 9, 2008, Consolidated Law on Health and Safety at Work (hereinafter the Consolidated Law on Health and Safety at Work).
-Provision of Authorization for the processing of sensitive data in labor relations, dated December 15, 2016, of the Personal Data Protection Authority (hereinafter the Authorization of the Personal Data Protection Authority).

We wish to inform you that upon submission of your resume, in order to verify the possibility of transforming your application into a working relationship, and in compliance with art. 13 of Italian Legislative Decree no. 196 of June 30, 2003 (the "Privacy Code") and art. 13 of European Regulation no. 679 of 2016 (the "Privacy Regulation"), as a potential employer/customer Unitec S.p.A. collects and processes your personal data (as "Data Subject") and possibly personal data relevant to your family members.

Please note that with regard to the recruiting activity, with your specific consent Unitec S.p.A. may process personal data that the Privacy Code defines as "sensitive" and the Privacy Regulation as "special" as they are necessary to identify, for example, general health status or specific conditions (e.g., physical problems, allergies, belonging to sheltered groups, and degree of disability) necessary to assess your fitness or otherwise to perform certain tasks or the possibility of the data subject to be hired as belonging to sheltered groups.

Subject to your specific consent and always with regard to the recruiting activity, as part of your personal data the Data Controller may also acquire and manage one or more photographic images to be included with the information acquired during the job interview.

1. Data Controller, Data Processors, and Data Protection Officer.
The data controller of personal data is Unitec S.p.A. (hereinafter the "Data Controller"), with registered office in Via Prov.le Cotignola 20/9, 48022 Lugo RA, Italy, VAT no. 01090820398 email: unitec@unitec-group.com.
The updated list of Data Processors, where designated, can be provided upon request by the Data Subject.
In the event that a Data Protection Officer is appointed (pursuant to art. 37 of the Privacy Regulation), his or her identity will be disclosed by publishing such information in an integration to this policy.

2. Processing purposes and methods.
Personal data relevant to the Data Subject are processed as part of the Data Controller's normal recruiting activity, to verify the possibility of transforming your application into an effective employment/working relationship.
With regard to this purpose, personal data are processed by specially appointed officers, who are authorized, and instructed to process data pursuant to art. 30 of the Privacy Code and articles 28 and 29 of the Privacy Regulation. Such personal data can also be processed by external parties (for example, recruitment companies, external consultants for the processing of remuneration and social security data, etc.), which can be qualified as independent Data Controllers or designated as Data Processors in writing. In any case, the processing will be carried out using manual, computerized and online tools, according to methods strictly related to the purposes and in any case in such a way as to guarantee the confidentiality and security of personal data and in full and absolute compliance with current legislation.
Your data will be retained by the Data Controller for the period of time strictly necessary for the aforementioned purpose, unless it is necessary to keep the data for a longer period in compliance with current regulations, including those regarding accounting. Your data will be processed in Italy, and, in any case, within the EU.

3. Mandatory or optional nature for data provision, consequences of any refusal, and legal basis for the processing.
With regard to the aforementioned purposes, personal data provision is mandatory, as without them we cannot verify the possibility of establishing a working relationship with the Data Subject. The legal basis for processing is therefore to verify if it is possible to establish a working relationship involving the data subject and at his or her request (pursuant to art. 6, paragraph 1, letter b) of the Privacy Policy).
With regard to the processing of personal data that the Privacy Code defines as "sensitive" and the Privacy Regulation as "special" as they are necessary to identify, for example, general health status or specific conditions (e.g., physical problems, allergies, belonging to sheltered groups, and degree of disability) necessary to assess your fitness or otherwise to perform certain tasks or the possibility of the data subject to be hired as belonging to protected categories, their provision is optional, however failure to provide them and the corresponding consent renders it impossible for the Data Subject to be hired for the aforesaid specific jobs or identification of belonging to any protected categories.

4. To whom and where can we can disclose Data Subject's personal data?
With respect to the processing purposes specified above, and within the limits strictly relevant thereto, your personal data will be or may be disclosed to:
(i) All parties involved in the recruiting activity for the purpose of entering into a work contract; such parties are appointed and instructed in writing pursuant to the law by the Data Controller in accordance with the procedures established by the company's job descriptions.
(ii) External consultants appointed to carry out the aforementioned activity, unless designated in writing as Data Processors.
(iii) Companies belonging to the Unitec Group for their recruiting purposes, the Group acting as a centralized recruiter for its member companies.
The parties specified above to whom your personal data may be disclosed (as not designated in writing as Data Processors), will process personal data as
Data Controllers in accordance with current legislation, in full autonomy, being unrelated to the processing performed by Unitec S.p.A. A detailed and constantly updated list of these parties with details of their respective locations is always available at the Unitec S.p.A. headquarters. Your personal data will not be disseminated.

5. The rights of the Data Subject.
Art. 7 of the Privacy Code and art. 15 and following of the Privacy Regulation give the Data Subject the right to obtain, in the modalities established by art. 8 and 9 of the Privacy Code and art. 12 of the EU Regulation 2016/679:

I. Confirmation of the existence or otherwise of his or her personal data, even if not yet recorded, and their communication in an intelligible form.
II. An explanation of the origin of the personal data, of the processing purposes and methods, of the logic applied in the event of processing performed with the aid of electronic tools, of the identity of the Data Controller.
III. The updating, rectification, completion, erasure, transformation into anonymous form or blocking of data processed in violation of the law - including those that do not need to be kept for the purposes for which the data were collected or subsequently processed - the confirmation that these operations and their contents have been brought to the attention of those to whom the data have been disclosed or disseminated, except in the case where this obligation proves impossible or involves a use of meanst hat are manifestly disproportionate to the protected right.

The Data Subject also has the right:

To withdraw consent (where given) for the processing of personal data at any time (without prejudice to the lawfulness of the processing based on the consent given prior to the withdrawal).
To wholly or partially object to the processing of his or her personal data for legitimate reasons even if pertinent to the purpose of their collection.
To wholly or partially object to the processing of his or her personal data for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communications.
To lodge a complaint with the Personal Data Protection Authority in the cases provided for by the Privacy Regulation, directly contacting the Personal Data Protection Authority, website www.gpdp.it - www.garanteprivacy.it email: garante@gpdp.it Fax: (+39) 06.69677.3785 Telephone: (+39) 06.69677.1
To the portability of personal data within the limits referred to in art. 20 of the Privacy Regulation.
To know the detailed and constantly updated list of parties to whom the personal data of the Data Subject may be disclosed and to exercise the rights referred to in art. 7 of the Privacy Code and art. 15 and following of the Privacy Regulation, the Data Subject can contact Unitec S.p.A. in its capacity as Data Controller.

6. Security measures.
All processing is carried out in compliance with the methods set out in art. 11 and following and 31 and following of the Code and through the adoption of the minimum security measures envisaged by the technical specification (Annex B to the Privacy Code) until May 24, 2018, and from May 25, 2018 also through the adoption of technical and organizational measures to guarantee a level of security adequate to the risk in compliance with the methods set out in art. 5 and following and 32 and following of the Regulation, as well as the relative provisions of the Privacy Authority.
In this regard, we confirm, among other things, the adoption of appropriate security measures to prevent unauthorized access, theft, disclosure, modification or unauthorized destruction of the Data Subject's data.

7. Duration of the processing
In accordance with art. 11, lett. e) of the Code and art. 5, let. e) of the Regulation, the personal data being processed will be kept for the time strictly necessary for the aforementioned purposes, and, in any case, for a period not exceeding 12 months (extendable to 36 months).

Previous versions

Data controller

Valid from

Valid to

Current version

Unitec S.p.A.

01 March 2021

Yes

Unitec S.p.A.

28 May 2018

01 March 2021