INFORMATION ON THE PROCESSING OF PERSONAL DATA

Gi Group S.p.A. (hereinafter also “GI” or the “Company“) wishes to provide, pursuant to and for the purposes of Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data (hereinafter “GDPR“), certain information on the purposes, methods and scope of communication and dissemination of personal data provided by candidates aged 18 and over through:

– registration to the myGiGroup reserved area carried out from GI website (hereinafter the “Site“) or through the App;

– websites of any third-party companies and social networks;

– e-mail;

– during an interview at one of the agencies.

 

1. PURPOSE OF PROCESSING FOR MYGIGROUP REGISTRATION, CANDIDATE SEARCH AND SELECTION, AND LEGAL BASIS

1.1. Your data are collected in the following ways:

– upon your registration in the myGiGroup reserved area;

– via e-mail;

– at our agencies;

– via third-party websites or social networks.

1.2. Your data are processed for the purpose of registration in the myGiGroup reserved area to be carried out both in case of application in response to a specific advertisement published on the Site and in case of voluntary application through the Site.

1.3. The legal basis applicable to the processing of your personal data for the purpose referred to in Section 1.2. is the performance of a contract pursuant to Article 6(1)(b) of the GDPR.

1.4. Your data are processed both in the case of an application in response to a specific advertisement and in the case of a voluntary application for the pursuit of the purpose of search and selection of candidates, in particular:

a. for placement on a temporary basis at our client user company

b. for direct placement at our third-party customer company

c. for direct placement at GI

d. for the implementation of active labour policy pathways or measures or in the framework of collaborations and/or partnerships with public and private market operators.

Your data are also processed to send you service communications strictly related to the purpose of search and selection of candidates by traditional or automated contact methods, including communications relating to training initiatives strictly linked to a specific position, financed by our client company or by interprofessional funds.

In our capacity as employment agency and in order to guarantee you a job placement, your data may be processed for all personnel searches and selections in line with your profile, if you do not object to such processing at the time of providing the data or subsequently. Should you object to such processing, your data are processed exclusively in the context of the specific selections for which you have applied.

1.5. The legal basis applicable to the processing of your personal data for the purposes referred to in Section 1.4 is the execution of pre-contractual measures taken at your request pursuant to Article 6(1)(b) of the GDPR.

1.6. Your data may also be processed to ascertain, exercise or defend a right of ours in court.

1.7. The legal basis applicable to the processing of your personal data for the purpose referred to in Section 1.6. is the legitimate interest of the Company (exercise or defence of a right in court) pursuant to Article 6(1)(f) of the GDPR.

The legal basis applicable to the processing of special categories of personal data concerning you for the same purposes is the establishment, exercise or defence of a legal claim pursuant to Article 9(2)(f) of the GDPR.

 

2. FURTHER PROCESSING PURPOSES AND LEGAL BASES

2.1. Your data may also be processed, if you give your consent, for the following additional purposes:

a. sending information and promotional communications relating to the services offered by the GI (in particular, training initiatives, career development, coaching), or the performance of studies and statistical and/or market research relating to employment services, using both traditional contact methods (paper mail, operator calls) and automated contact methods (e-mail, sms, mms, instant messaging systems);

b. sending information and promotional communications relating to the services offered by other Group companies – located in the EU and non-EU countries – (in particular, training, career development, coaching, outplacement support, personnel search and selection and executive search initiatives), or carrying out studies and statistical and/or market research relating to employment services, both by traditional contact methods (paper mail, operator calls) and by automated contact methods (e-mail, sms, mms, instant messaging systems).

2.2. The legal basis applicable to the processing of personal data concerning you for the purposes set out in Section 2.1. is your consent pursuant to Article 6(1)(a) of the GDPR.

2.3. It is understood that consent to the processing of data for these purposes is purely optional; therefore, in the event of a refusal to process data for the aforementioned purposes, your data will only be processed for the purposes indicated in point 1 above.

 

3. CATEGORIES OF DATA PROCESSED, SOURCE OF DATA AND PROCESSING OF SPECIAL CATEGORIES OF DATA

3.1. The GI, by way of example but not limited to, will collect the following categories of common personal data: first name, surname, password, date of birth, residence, e-mail address and telephone contact details, educational qualification, work experience and any additional data you provide in your curriculum vitae and/or provided during an interview at one of the branches.

3.2. GI will collect the aforementioned data from you and/or from websites managed by third parties or social networks through which GI publishes advertisements (on behalf of client companies or on its own behalf) or through which it can consult candidate profiles.

3.3. Should you respond to an advertisement or apply voluntarily, you will be given the opportunity to declare whether you belong to a protected category in the data collection forms on the Site or during a telephone interview or at one of the branches. This information is likely to reveal your state of health and falls within the special categories of data referred to in Article 9(1) of the GDPR and will be processed in accordance with the relevant regulations in force (including Legislative Decree no. 276/2003).

3.4. The legal basis applicable to the processing of special categories of personal data concerning you for the purposes described in Section 1.2 is your explicit consent pursuant to Article 9(2)(a) of the GDPR.

Should you fail to give your consent, it will not be possible to process data relating to your membership of a protected category.

3.5. On the other hand, please do not indicate any special categories of data in your curriculum vitae (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data intended to uniquely identify a natural person, data concerning a person’s health or sex life or sexual orientation).

 

4. DATA RETENTION PERIOD

4.1. In the case of data processing for the purposes of registering to the myGiGroup reserved area and of search and selection as per paragraph 1, the data are entered in the company database and kept for 30 months from their entry, i.e. from your last interaction with the Site (accessing, updating your data, or uploading your curriculum vitae), unless you wish to have your data kept for a further period, which you will be asked to express before the expiry of the aforementioned term.

4.2. In the event of data processing for the purposes of establishing, exercising or defending a right in a court of law as referred to in paragraph 1, the data shall be entered in a historical file and kept for the duration of the litigation, until the time limit for bringing an appeal has been exhausted.

4.3. In the case of data processing for the further purposes set out in Section 2.1, the data is entered into the company database and stored for the duration indicated in Section 4.1 or until you revoke your consent.

4.4. After the above-mentioned retention periods have expired, the data are destroyed or anonymised.

 

5. NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL

5.1. The provision of the data marked with an asterisk in the registration form for the myGiGroup reserved area is necessary to enable the GI to complete its registration, as set out in paragraph 1 above; therefore, any refusal to provide the requested data shall prevent the GI from completing its registration with myGiGroup.

5.2. The provision of the data marked with an asterisk in the data collection form on the website or requested from the agencies is necessary to enable the GI to pursue the search and selection purposes referred to in paragraph 1 above; therefore, any refusal to provide the requested data shall prevent the GI from carrying out its search and selection activities and shall not allow your application to be taken into consideration.

5.3. The provision of data for the purposes set out in point 2 above is optional. Any refusal to provide data or failure to provide consent shall have no consequences on your registration with myGiGroup and shall not prevent GI from carrying out its search and selection activities.

 

6. METHODS OF PROCESSING

Data processing shall be based on the principles of correctness, lawfulness and transparency and data minimisation (privacy by design); It may be carried out either manually or by automated means for the storage, processing and transmission of the data and shall take place by means of technical and organisational measures that are appropriate, insofar as reasonably necessary and in accordance with the state of the art, to ensure, inter alia, the security, confidentiality, integrity, availability and resilience of the systems and services, avoiding the risk of loss, destruction, unauthorised access or disclosure or, in any event, unlawful use, as well as by means of reasonable measures to delete or rectify in a timely manner any data that are inaccurate in relation to the purposes for which they are processed.

 

7. RECIPIENTS OF DATA

7.1. Your data may only be processed by employees of the company departments authorised to process them as they are assigned to the pursuit of the aforementioned purposes. These employees have received appropriate operating instructions in this regard.

7.2. Your personal data may be communicated by the GI, for the pursuit of the purposes set out in paragraph 1 above, to the following entities:

– Client companies or entities;

– Ministry of Labour;

– Public bodies in the framework of the implementation of active labour policy paths or measures;

– Other market players in the case of partnerships;

– Legal advisers;

– Training organisations

– Group companies in Italy or abroad.

Your personal data may be communicated by the GI, in pursuance of the purposes set out in paragraph 1.4 above, to the Group Companies, in Italy or abroad.

7.3. Your personal data may also be processed by external parties, expressly appointed as data processors, who provide GI:

– Site operation and maintenance services;

– Candidate database management and maintenance services

– Archiving services;

– Communication mailing services;

– Market research services.

7.4. The updated list of addressees is available at our registered office or by sending an e-mail to it.privacy@gigroup.com.

7.5. Personal data provided by candidates will not be disseminated.

 

8. DATA TRANSFER OUTSIDE THE EU

8.1. Your data may be transferred abroad to countries outside the European Union, and in particular to:

a. Argentina, Switzerland and UK, whose level of data protection was deemed adequate by the European Commission under Article 45 of the GDPR

b. Brazil, China, Colombia, Hong Kong, India, Montenegro, Russia, Serbia, Turkey subject to the GI’s signature with the data importer of the Standard Contractual Clauses adopted/approved by the European Commission pursuant to Article 46(2)(c) and (d) of the GDPR;

8.2. Any transfers to non-EU countries or international organisations are permitted, in the absence of the aforementioned adequate guarantees, on the basis of the exceptions provided for in Article 49(1)(b) and (c). The data subject will be specifically notified of such transfers.

8.3. The adequacy decisions can be consulted at the following links: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
A copy of the standard contractual clauses signed by the GI can be obtained by sending an e-mail to: it.privacy@gigroup.com

 

9. RIGHTS OF THE DATA SUBJECT

9.1. Data subjects are granted the rights set out in Articles 15 to 22 of the GDPR, where applicable.

9.2. In particular, data subjects may ask data controllers for access to data, their deletion, the rectification of inaccurate data, the integration of incomplete data, and the restriction of processing in the cases provided for in Article 18 of the GDPR[1] .

9.3. Data subjects have the right to object, at any time, in whole or in part, to the processing of data necessary for the legitimate pursuit of the data controller’s interest.

9.4. Data subjects also have the right to receive the data provided to data controllers in a structured, commonly used and machine-readable format, and, if technically feasible, to pass them on to another data controller without hindrance, if the conditions for exercising the right to portability set out in Article 20 of the GDPR[2] are met.

9.5. Data subjects have the right to lodge a complaint with the competent supervisory authority (in particular in the Member State where they habitually reside or work or in the State where the alleged infringement occurred).

9.6. These rights may be exercised by writing to the address below or by e-mail to the following e-mail address: it. privacy@gigroup.com. It is understood that, where the request is made by electronic means, the information will be provided in a commonly used electronic format.

 

10. WITHDRAWAL OF CONSENT

10.1. Interested parties have the right to revoke their consent at any time via their account in the myGiGroup reserved area or by sending an e-mail to it.privacy@gigroup.com.

10.2. Revocation of consent does not affect the lawfulness of processing based on the consent you gave before revocation.

 

11. CONTACT DETAILS OF THE DATA CONTROLLER

The data controller is GI GROUP S.p.A., with registered office in Milan, Piazza IV Novembre 5, in the person of its Legal Representative.

 

12. CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)

The Data Protection Officer [DPO] can be contacted at the following address Piazza IV Novembre n. 5, 20124 Milan to the attention of the Data Protection Officer e-mail dpo@gigroup.com

 

THE DATA CONTROLLER

[1] That is, if:

a) the data subject contests the accuracy of the personal data, for the period necessary for the controller to verify the accuracy of such personal data;

b) the processing is unlawful and the data subject objects to the deletion of the personal data and requests instead that their use be restricted;

c) although the data controller no longer needs them for the purposes of processing, the personal data are necessary for the establishment, exercise or defence of a legal claim;

d) the data subject has objected to the processing pursuant to Article 21(1), pending verification as to whether the data controller’s legitimate reasons prevail over those of the data subject.

[2] That is, whether the processing is based on consent within the meaning of Art. 6.1(a) or Art. 9.2(a) or on contract within the meaning of Art. 6.1(b) of the GDPR and is carried out by automated means.