SOA Privacy Policy

In accordance with Article 13 of Legislative Decree 196/2003 (hereinafter “Privacy Code”) and Article 13 of Regulation 2016/679/UE (hereinafter “Regulation”) Soa Risorse Umane S.r.l. based in Via Isonzo 61, 40033 Casalecchio di Reno (BO), C.F. and P.IVA 02254081207, in its capacity as Data Controller (hereinafter “The Controller”) informs you of the following:

PURPOSE OF THE PROCESSING

Personal data will be processed lawfully and in accordance with fairness for the purposes of carrying out, by the Controller, personnel search, selection and evaluation activities, in the interest of Client Entities, Organizations and Companies or for its own organizational structure.

The data will be processed in accordance with the provisions of the Privacy Code and the Regulations and will be carried out both manually and with the aid of computer and telematic means.

The data will be stored in paper and electronic files, so that aggregate or specific data can be identified and selected.

MODE OF PROCESSING

Data collection is done by sending to the Data Controller (by mail, fax, e-mail or hand letter) from the data subjects information about their professional experience in the form of Curriculum Vitae (hereinafter ’C.V.’).

The data will be collected, in accordance with the necessary security and confidentiality, through the following methods:

- from the data subject;

- with psycho-aptitude tests;

- with forms and/or coupons and/or questionnaires;

- in Databases through the use of electronic means;

Submission of one's C.V. by the data subject to the Data Controller, may represent:

1. a) a spontaneous application;
2. b) a response to specific recruitment and selection advertisements for third parties published by the Controller in any media.

The collection concerns only the common data that will be processed within the limits strictly relevant to the obligations, tasks and purposes indicated above.

The interested party, therefore, should not provide data that can reveal health status, racial and ethnic origin, religious beliefs, political opinions, sexual life and all information that qualifies as sensitive data under the Privacy Code.

JURIDICAL BASIS AND NATURE OF THE TRANSFER

Both in the case where personal data are provided for spontaneous applications, i.e. not in response to a specific advertisement, and in the case where personal data are provided by the data subject by indicating a reference to a specific advertisement, the processing of such data will be implemented by the Data Controller only on the basis of and as a result of the written (and not oral) consent explicitly and freely given by the data subject.

The optional and non-compulsory nature of the data subject's consent to data processing entails - in the event of its absence - the impossibility for the Data Controller to consider the data subject's candidacy in the context of a personnel selection and evaluation procedure.

COMMUNICATION AND DISCLOSURE OF DATA

For the pursuit of the purposes indicated above, the personal data transmitted by the data subject may be communicated to client, public or private entities that have mandated the Data Controller to carry out personnel search, selection and evaluation activities on their behalf.

The communication will be made only in the case of prior consent of the interested party, which will be formalized:

• for the C.V.“s uploaded on the Holder's website in the manner described within the same site;
• for C.V.”s sent by electronic or paper mail by signing the appropriate declaration at the bottom of the form filled out at the interview.
.

For the purposes indicated above and as strictly required in connection with the procedure of selection or in-depth evaluation of personnel, the personal data of the interested party may also be communicated and/or disseminated to:

• subjects, external to the Data Controller, i.e. persons in charge of the management and maintenance of the electronic tools, as external data processors.

DATA STORAGE

The storage of data will be carried out by the organization of the Data Controller for the time strictly necessary for the purposes indicated above and may not exceed the term of ten years starting from the day they were received.

The processing will be carried out with logics strictly related to the purposes indicated and in a manner that guarantees the security and confidentiality of the data.

RIGHTS OF THE INTERESTED PARTY

The interested party has the right to:

• obtain from the Data Controller confirmation of the existence or non-existence of personal data concerning him/her and the provision of the same in intelligible form;
• to know the origin of the data, the logic and purposes on which their processing is based;
• obtain from the Data Controller the cancellation, transformation into anonymous form or blocking of data processed in violation of the law, as well as the updating, rectification or, if the interested party has an interest, the integration of such data;
• oppose in whole or in part, for legitimate reasons, the processing of their personal data even if pertinent to the purpose of collection;
• oppose in whole or in part to the processing envisaged for the purposes of commercial information or sending advertising material;
• revoke consent at any time without affecting the lawfulness of the processing based on the consent given previously;
• to lodge a complaint with a supervisory authority;
• to know about the existence of an automated decision-making process, information about the logic used and the expected consequences in case of processing.