Privacy Notice for Job Applicants

1. Who we are and how we process your personal data

Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter referred to as ‘GDPR’), Doucal’s S.r.l., with its registered office in Via Lombardia 19, Montegranaro (FM) (hereinafter referred to as ‘Doucal’s’ or the ‘Controller’) undertakes to process the personal data of candidates in compliance with the aforementioned law and to adopt measures to protect them from any risks.

The internal procedures and personal data processing policies are updated on a regular basis, especially in case of regulatory or organisational amendments which may have an impact on the processing methods.

For any requests or further information regarding the protection of your personal data, please contact: info@doucals.live.

2. The data we collect and why we process it

As part of any recruitment process, Doucal’s may collect and process the following personal data categories:

• personal details (first name, last name, tax identification number, place and date of birth);

• contact details (email address, phone number, address);

• information included in your CV (e.g. data regarding education and employment history);

• technical data (e.g. logs and IP addresses used to access the application platform);

• any special categories of data pursuant to Article 9 of the GDPR, including data concerning health, only if strictly necessary to verify belonging to protected categories or to comply with obligations under applicable law, and in any event, only to the extent that such data has been voluntarily provided by the candidate and is relevant to the recruitment process.

2.1. Management of the recruitment process

Purposes and methods of processing

The collection and processing of your personal data are carried out for the following purposes:

1. searching for and identifying suitable candidates and/or managing unsolicited applications or professional profile evaluations;

2. collecting and reviewing CVs, including through recruitment agencies, universities, or professional platforms;

3. scheduling and carrying out interviews;

4. onboarding the selected candidate into the company;

5. entering into a potential employment or engagement relationship.

Legal basis for processing and consequences of failure to provide personal data:

Pursuant to Articles 6 and 9 of the GDPR, consent to the processing of such data for the aforementioned purposes is not required, as the processing itself concerns data contained in CVs or unsolicited applications spontaneously submitted by the data subjects for the purpose of entering into a potential employment or engagement relationship or to obtain information from the Controller.

On the other hand, regarding any data that may be subsequently requested by the Controller, failure to provide such information may result in the inability to initiate a potential recruitment process or to verify the conditions for entering into an employment or engagement relationship.

2.2 Sharing data with third parties

In the course of carrying out the activities for the purposes set out above, personal data may be shared with third parties.

In particular, personal data may be accessible to service providers acting on behalf of Doucal’s and involved in the pursuit of all or part of the purposes set out in this notice (e.g. companies managing the online recruitment platform or IT service providers).

Consent is not required when disclosure is necessary to comply with obligations arising from the recruitment process, or when another legal basis provided for by law applies, including the Controller’s legitimate interest.

Data may also be shared through third parties appointed as Data Processors.

Where data revealing health status is processed, Doucal’s will implement appropriate protective measures, such as pseudonymisation, aggregation, or encryption.

Doucal’s does not transfer personal data outside the EEA, nor does it disclose it to unspecified third parties.

3. How, where and how long we keep your data for

Data processing methods

Data is processed using IT systems and/or in paper format by personnel authorised pursuant to Article 29 of the GDPR, only to the extent necessary to carry out activities related to the recruitment process.

Data may also be collected from third parties, such as employment centres, IT service providers, recruitment agencies, training institutions, and universities. In such cases, Doucal’s will promptly inform the candidate pursuant to Article 14 of the GDPR.

Doucal’s periodically reviews the adequacy of the security measures and the relevance of the data processed, ensuring that no excessive or unnecessary information is retained.

Data storage location

Personal data is stored in paper records and IT systems located within the European Economic Area (EEA), with appropriate security measures in place.

Data retention period

Personal data is retained for as long as is necessary to manage the recruitment process and, in any event, no longer than the periods prescribed by applicable law and/or the Guidelines (Raccomandazioni) issued by the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali). Once the purposes of processing have been fulfilled, Doucal’s will delete or anonymise the data.

Regarding personal data contained in unsolicited CVs, it will be retained for a maximum of 12 months and subsequently deleted, unless otherwise indicated by the candidate.

4. Your rights

Pursuant to the GDPR, the candidate, as a data subject, has the following rights which may be exercised against the Controller:

- right of access: obtaining confirmation as to whether or not personal data concerning the candidate is being processed and, where this is the case, receiving information regarding the purposes of the processing, the categories of personal data concerned, the retention period, and the recipients to whom the data has been or will be disclosed (Article 15 of the GDPR);

- right of rectification: obtaining, without undue delay, the rectification of inaccurate personal data concerning the candidate and the completion of incomplete personal data (Article 16 of the GDPR);

- right to erasure: obtaining, without undue delay, the erasure of personal data concerning the candidate where any of the grounds set out in Article 17 apply (Article 17 of the GDPR);

- right to restriction of processing: obtaining from the Controller the restriction of processing in the cases prescribed by the GDPR (Article 18 of the GDPR);

- right to data portability: receiving the personal data concerning the candidate provided to the Controller in a structured, commonly used and machine-readable format, as well as requesting its transfer to another controller, in the cases provided for by the GDPR (Article 20 of the GDPR);

- right to object: objecting to the processing of personal data concerning the candidate, unless there are legitimate grounds for the Controller to continue processing (Article 21 GDPR);

- right to lodge a complaint with a supervisory authority: lodging a complaint with the Italian Data Protection Authority, Piazza Venezia 11, 00187 - Rome (RM).

Please note that withdrawing consent does not affect the lawfulness of any processing carried out on the basis of that consent prior to its withdrawal.

The abovementioned rights may be exercised by sending a request by registered mail with return receipt or by email to the address indicated above, using the dedicated form available on the Italian Data Protection Authority’s website: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924