Privacy Policy for Job Candidates

Privacy Policy for “Job Candidates” pursuant to art. 13 et seq. of EU Reg. 2016/679 (“GDPR”)

Introduction	The purpose of this Privacy Policy is to illustrate the ways in which Blue Data Insight S.r.l. collects, processes and stores personal data relating to Data Subjects as Job Candidates for employment with the company.
Data Controller	The Data Controller is Blue Data Insight S.r.l., with legal seat in Milano (MI), via Broletto no. 37, VAT no. 14586310964‬.‬‬‬‬‬‬‬ Blue Data Insight S.r.l. can be contacted: by writing an e-mail to info@bluedatainsight.it by ordinary mail, to the address of the registered office as indicated above.
Categories of data processed	For the pursuit of the purposes indicated, Blue Data Insight S.r.l. will process the following categories of personal data: personal identification and contact details of the Job Candidate () personal data relating to work skills and professional qualifications () further personal data qualifying the Job Candidate’s skills or job position common or sensitive data shared by the Job Candidate on the basis of consent.
Sources of processed data	The main source of personal data is the Data Subject via the company website. Other sources include: agencies and/or professionals who carry out the function of personnel search.
Consequences of not submitting your data	The provision of personal data marked with an asterisk (*) is mandatory: without them, it is impossible for Blue Data Insight S.r.l. to carry out the related processing activities, as provided for by the purposes listed below. The provision of all other personal data is optional: failing this, Blue Data Insight S.r.l. may not be able to perform all or part of the processing actvitiess.
Purpose, legal basis and data retention	Purpose	Legal bases	Storage time
	(1) Evaluating the possible establishment of an employment or collaboration relationship and arrange an interview	6 (1) (b), for the fulfilment of needs related to pre-contractual activities	Until the end of the Job Candidates’ selection activities, and for a maximum of 12 months thereafter
	(2) Assess the Job Candidate’s classification with respect to occupational health and safety legislation	Common data: 6 (1) (c), for compliance with a legal obligation to which the Data Controller is subject Sensitive data: 9 (2) (b), in order to fulfil the obligations of the Data Controller in the field of labour law and social security and social protection	Until the end of the Job Candidates’ selection activities, and for a maximum of 12 months thereafter, except for medical documentation that will be deleted at the end of the selection
	(3) Assess the correct classification of the Job Candidate, also through the acquisition of additional information provided voluntarily by the same	Common data: 6 (1) (b), for the fulfilment of needs related to pre-contractual activities Special data: 9 (2) (e), on the basis of personal data manifestly disclosed by the Data Subject	Until the end of the Job Candidates’ selection activities, and for a maximum of 12 months thereafter
	(4) Analysis of Data Subject data from curriculum vitae or collected by other means	6 (1) (f), for the pursuit of the legitimate interest of the Data Controller consisting in proposing to the Job Candidate positions suitable for their skills and knowledge	Until the end of the Job Candidates’ selection activities, and in any case without prejudice to the opposition to the processing expressed by the Job Candidate
	(5) Retention of the CV beyond the deadline of the selection	6 (1) (a), on the basis of the consent given by the Job Candidate	For 2 years from the end of the Job Candidates’ selection
Categories of subjects who may process personal data	Within the limits of the obligations, tasks and purposes indicated above, personal data will be processed exclusively by personnel (employees and/or external collaborators) of Blue Data Insight S.r.l., as well as by third parties appointed as Data Processors pursuant to Article 28 of the GDPR. The list of Data Processors can be requested from Blue Data Insight S.r.l. by writing to the references indicated above.
Scope of communication and dissemination of personal data	Personal data may only be disseminated with the express consent given by the Data Subject. Blue Data Insight S.r.l. may also communicate personal data to third parties (independent data controllers), in order to comply with legal obligations, including: public and private bodies, including following inspections or audits; subjects who can access the data by law; subjects who collaborate with the Data Controller.
International transfers	In relation to the technological tools used by Blue Data Insight S.r.l. and/or by its Data Processors, personal data may be transferred outside the European Economic Area (“EEA“): in such cases Blue Data Insight S.r.l. guarantees that the transfer will only take place to countries (i) considered adequate by the European Commission, (ii) that have entered into Standard Contractual Clauses or (iii) that have entered into other mechanisms for eligibility for transfer outside the EEA. You can always contact Blue Data Insight S.r.l. to the references indicated for more information on the transfer of your personal data outside the EEA.
Rights of the Data Subject	The Data Subject may exercise the rights provided for by the GDPR, and in particular the right to: access to their personal data, as well as to obtain its rectification or deletion obtain the limitation of processing concerning them object to the processing, in the event that Blue Data Insight S.r.l. exercises its legitimate interest obtain data portability, where provided revoke consent, where applicable: the revocation does not affect the lawfulness of the processing already carried out and based on the consent previously given lodge a complaint with the supervisory authority: for Italy, with the Italian Data Protection Authority (www.gpdp.it). The exercise of the rights referred to above can be done by sending a request to the Data Controller’s references indicated above.