Abacus Service S.r.l. (hereinafter also referred to as the “Company” or “Abacus Service”) acts as Data Controller and processes the personal data of job applicants (hereinafter also referred to as the “Data Subjects”) in compliance with their rights, in a lawful, fair and transparent manner, pursuant to Regulation (EU) 2016/679 (“GDPR”).
1. Legal basis (Article 6 GDPR), purposes and nature of the processing
The Data Subject is informed that the Company processes his/her personal data for the following purposes:
- Pre-contractual measures (staff selection) instrumental to the establishment of the employment relationship (publication of a job vacancy notice, selection interviews, collection of the CV also through IT platforms and social networks such as LinkedIn, etc.);
- Compliance with legal obligations (in the field of labour law and social security and social protection) or obligations laid down by a regulation or by European Union law.
- Legal basis: the provision of personal data for the purposes referred to in points (1) and (2) constitutes a requirement for entering into the contract and a legal obligation. Any refusal to provide such data entails the impossibility for the Company to carry out the activities required for the conclusion and performance of the contract, as well as a breach of the statutory provisions imposing an obligation on the Data Controller.
- Ensuring your safety and physical integrity within the Data Controller’s premises (where the interview takes place on site).
- Legal basis: protection of the Data Subject’s vital interests. The Data Controller may process your data where the Data Subject is physically incapable of providing consent (e.g. where urgent medical intervention is required in order to assist the Data Subject).
- General secretarial management activities of the Company (receipt and exchange of communications and correspondence via e-mail, telephone, fax, etc.).
- Legal basis: consent of the data subject (optional). However, if consent is not provided, the data subject will not receive communications addressed to them.
2. Categories of personal data processed
a) identification and contact data (e.g. e-mail address, tax code, telephone number, name and surname, place and date of birth, etc.);
b) CV-related data (including personal images);
c) special categories of personal data (e.g. health status, political or religious beliefs, trade union membership, etc.) are not requested; however, where they are included in the CV or are voluntarily provided (such as, for example, data revealing membership of protected categories), the Company processes only the data relevant for assessing professional suitability, within the limits in which the acquisition of such information is strictly indispensable for the establishment of the employment relationship.
3. Retention period and processing methods
Your data will be processed for 12 months after non-selection, or for 10 years after the termination of any employment relationship (reference is made in this respect to the staff privacy notice).
The collection of the CV, and therefore of the information entered therein by the Applicant, may also take place through IT platforms and social networks, such as the LinkedIn page section in which the Company, through its profile, publishes job offers.
In any case, all data will be processed fairly and transparently through electronic and IT tools; they will be stored in dedicated IT records/archives or in any other suitable medium, and kept under constant control by means of operational procedures and appropriate protection measures designed to ensure the security and confidentiality of personal data, in order to prevent their loss, unlawful or improper use, and unauthorised access.
4. Communication and disclosure of data
The Company undertakes not to transfer the personal data provided by the Data Subject to anyone. However, such data may be communicated to third parties (either appointed as External Data Processors for this purpose or acting as independent Data Controllers) solely in order to comply with legal obligations, or, for example, upon request by the Judicial Authority, or where strictly necessary for the establishment of the employment relationship (in particular, prior to any hiring, to the Occupational Physician for the assessment of fitness for the job role, etc.).
5. Rights of the Data Subject
The Data Subject has all rights provided for under Articles 15 et seq. of the GDPR. In particular, the Data Subject has the right to obtain access, rectification, erasure, data portability, as well as the right to restriction of processing, the right to withdraw consent (without prejudice to the lawfulness of processing carried out prior to withdrawal), to object to processing, and to lodge a complaint with a supervisory authority. Such rights may be exercised by the Data Subject by submitting a request, without formalities, to the Data Controller, which shall provide an appropriate response without undue delay and in any event within 1 month of receipt of the request, extendable by a further 2 months in the event of complex or numerous requests, by post or fax to the contact details indicated below, stating on the envelope or on the document the wording “Privacy-related”, or by sending an e-mail to: privacy@abacusgroup.io
Group Privacy Manager: Mirko Giolito
Data Controller: Abacus Service S.r.l.
Registered office: Assago (MI), Centro Direzionale Milanofiori, Strada 1, Palazzo F1
VAT No.: 13958250964
Certified e-mail (PEC): abacusservice@pec.it