Articles 13 and 14 of the Regulation (EU) 2016/679 (“GDPR”)
| Categories of data subjects | Candidates for all open job positions at the Controller (hereinafter referred to as “Candidates”) |
| Data controller | “Bologna University Business School” (hereinafter “BBS” or “Data Controller”) Villa Guastavillani, Via degli Scalini 18, Bologna (BO) – Italy Entry in Reg. Legal Persons at the Prefecture of Bologna No. 729, p.118 vol. 5 VAT No. 02095311201 |
| Data Protection Officer | BBS designated its Data Protection Officer, who can be contacted at the following e-mail address: dpo@bbs.unibo.it |
1. INFORMATION ON THE PROCESSING OPERATIONS PERFORMED
SECT. A
Purposes
Purposes related to or instrumental in carrying out the search and selection of candidates for all open job positions at BBS, including for future selections.
Legal basis
- Execution of pre-contractual measures taken at your request – Art. 6.1 (b) GDPR.
- The need to fulfill the obligations and exercise the specific rights of the data controller or the data subject in the field of labor and social security law and social protection, insofar as it is authorized by the Union or Member States’ law or by a collective agreement under the law of the Member States, where there are appropriate safeguards for the fundamental rights and interests of the data subject – Art. 9.2 (b) GDPR.
| Personal data collected | Data retention period |
| First name, last name, place and date of birth, fiscal code, residence, gender, telephone contacts, educational qualification, work experience and any additional data you have entered in your CV. Any personal data you provide that fall under special categories of data pursuant to Art. 9 GDPR will be processed, only where necessary and relevant, to evaluate your application for job positions falling within the scope of targeted employment. |
In the event that the hiring or otherwise the establishment of the employment or collaboration relationship takes place, the personal data collected will be processed on the basis of the corresponding privacy notice. In the event that the establishment of the employment or collaboration relationship does not take place, the personal data collected will be retained for a maximum period of 2 years from the date of your request, without prejudice to your right to request its deletion at any time. |
SECT. B
Purposes
Purpose to acquire information regarding your professional references at previous employers necessary for the evaluation of your profile.
In the absence of your consent BBS will not acquire such information and your profile will be evaluated solely on the basis of the information you have entered in your CV.
Legal basis
Consent – Art. 6.1 (a) GDPR. Consent is revocable at any time.
| Personal data collected | Data retention period |
| First name, last name, place and date of birth, fiscal code, residence, gender, telephone contact information, educational qualification, work experience, and any additional information you entered in your CV. | In the event that the hiring or otherwise the establishment of the employment or collaboration relationship takes place, the personal data collected will be processed on the basis of the corresponding privacy notice. In the event that the establishment of the employment or collaboration relationship does not take place, the personal data collected will be retained for a maximum period of 2 years from the date of your request, without prejudice to your right to request its deletion at any time. |
SECT. C1
Purposes
Purpose of verifying that the data you have provided correspond to what you have stated, limited only to information of a professional nature, necessary for the sole purpose of assessing the specific risks related to the type of activity to be carried out according to the profile sought, taking all necessary measures to ensure the proper balancing of your interests, fundamental rights and freedoms with our legitimate interest.
Legal basis
Legitimate interest – art. 6.1 (f) GDPR.
| Personal data collected | Data retention period |
| Public information pertaining to your professional profile featured on your social media profile. | In the event that the hiring or otherwise the establishment of the employment or collaboration relationship takes place, the personal data collected will be processed on the basis of the corresponding privacy notice. In the event that the establishment of the employment or collaboration relationship does not take place, the personal data collected will be retained for a maximum period of 2 years from the date of your request, without prejudice to your right to request its deletion at any time. |
SECT. C2
Purposes
Ascertaining, exercising or defending the Controller’s rights in court.
Legal basis
Legitimate interest – art. 6.1 (f) GDPR.
| Personal data collected | Data retention period |
| Personal data collected under the other purposes above. | The data used to ascertain, exercise or defend the Controller’s rights in judicial proceedings shall be retained for the period of admissibility of the judicial action and, in case of initiation of litigation, for the duration of the litigation itself and in any case until the period of admissibility of the appeal actions is exhausted. |
2. PROCESSING METHOD
The processing of personal data is carried out by BBS using paper and computerized methods.
3. AUTOMATED DECISION-MAKING ACTIVITIES
BBS excludes the use of any decision-making activity based on automated processing that produces legal effects or similarly significantly affects you in accordance with Article 22 of European Regulation 679/2016.
4. FATE OF DATA AT THE END OF THE RETENTION PERIOD
After the above retention periods have elapsed, the Data will be destroyed, deleted, or anonymized, consistently with the technical procedures for deletion and backup.
5. DATA PROCESSORS. THIRD PARTY DATA RECIPIENTS
Those entities or categories of entities designated as data processors pursuant to Article 28 of the aforementioned European Regulation No. 679/2016, that may therefore process and become aware of the data you have provided, are the entities or categories of entities designated as data processors that BBS uses:
a) for the management of relationships with Candidates and in particular for the search and selection of Candidates (by way of example, LinkedIn and Indeed), including legal defense;
b) for the management, including the computerized management, of its archives.
The full list of designated data processors is available upon request by sending a communication to the following e-mail address gdpr@bbs.unibo.it
The data may also be transmitted to the judicial authority and other public entities entitled to request them, in cases provided for by law or as a result of the order of a judicial authority.
6. PLACE OF PROCESSING AND DATA TRANSFER TO NON-EU COUNTRIES
BBS carries out the processing of your data in Italy.
Some of the designated Data Processors are based, or process your personal data, also in countries other than Italy both in and outside of Europe and, in such a case, the transfer of personal data outside the EU will take place in accordance with legal provisions and, in particular, personal data will be transferred to third countries in compliance with the conditions set forth in Article 45 et seq. of the GDPR.
7. YOUR RIGHTS
You may request from the Data Controller: access to the data concerning you; their rectification or deletion, the integration of incomplete data, the restriction of processing in the cases provided for in Art. 18 GDPR; to receive the data in a structured, commonly used and machine-readable format, as well as, if technically feasible, to transmit them to another data controller without hindrance in case the conditions for the exercise of the right to portability under Art. 20 of the GDPR (processing is based on consent pursuant to Art. 6.1(a) or Art. 9.2(a) of the GDPR or on the contract pursuant to Art. 6.1(b) of the GDPR are present and is carried out by automated means).
You have the right to object to the processing, for reasons related to your particular situation, in pursuit of the purposes based on the legitimate interest of the Data Controller, in particular You have the right to object to the further processing of your data collected online.
In addition, you have the right to revoke at any time any consent you have given without affecting the lawfulness of the processing carried out on this legal basis prior to revocation.
8. DATA PROTECTION OFFICER
BBS designated its Data Protection Officer, who can be contacted at the following address: dpo@bbs.unibo.it
You may contact the Data Protection Officer for all matters relating to the processing of your personal data and the exercise of your rights under European Regulation No. 679/2016 and the Privacy Code.
9. CONTACTS AND COMPLAINTS. COMPLAINT TO THE SUPERVISORY AUTHORITY
If you have any questions or complaints, regarding this Privacy Notice or BBS’s data processing practices or for requests regarding the updating/rectification/deletion of personal data or the exercise of your privacy rights you may contact the Data Controller or the Data Protection Officer.
For this purpose you may send a communication to the e-mail address gdpr@bbs.unibo.it, from which you will be answered by the person appointed by BBS to provide feedback to the data subject, that is the Privacy coordinator, or to the Data Protection Officer e-mail address dpo@bbs.unibo.it
Data subjects who believe that the processing of personal data relating to them carried out by the Data Controller occurs in violation of the provisions of the GDPR also have the right to lodge a complaint with the competent Supervisory Authority (Art. 77 GDPR), which in Italy is the Garante per la protezione dei dati personali [Privacy Guarantor] (Piazza Venezia, 11 – 00187 Roma – PEC [registered e-mail]: protocollo@pec.gpdp.it) or to take appropriate legal action (art. 79 GDPR).
