The company DUCKMA SRL, with registered office in (25122) Brescia, Via Vittorio Emanuele II, no. 1, registered in the Brescia Register of Companies R.E.A. no. BS - 543381, C.F. and VAT no. 03547240980, in the person of its legal representative pro tempore, Matteo Gazzurelli, as data controller (hereinafter, the Data Controller), informs, pursuant to art. 13 EU Regulation no. 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter, the GDPR) that the data will be processed as follows.

***

1. Object of Treatment

1.1 The Data Controller processes personal and identification data (name, surname, address, telephone, email, curriculum vitae) (hereinafter, Personal Data) communicated in the context of selections for job positions.

2. Purpose of the processing

2.1 The processing of Personal Data is carried out for purposes connected with or instrumental to the performance of the Owner's activity of search and selection of candidates for open job positions.

2.2 The provision of Personal Data is compulsory for the pursuit of the purposes set forth in article 2.1 above. Therefore, refusal to provide Personal Data may prevent the Owner from carrying out the search and selection activity and not allow the application to be taken into consideration.

2.3 The processing of special categories of Personal Data (e.g. health status, belonging to protected categories) requires the written consent of the data subject. Failure to provide written consent will make it impossible to evaluate the application. The Data Controller asks candidates who have personal data belonging to special categories to send their curriculum vitae by mail to the address indicated in article 8, with an explicit declaration of their consent to the processing by the Data Controller. Personal data belonging to special categories will not be kept by the Data Controller but deleted.

3. Treatment modalities

3.1 Processing of Personal Data means any operation or set of operations, carried out with or without the aid of automated processes, referred to in Article 4, n. 2) GDPR, namely the collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction. Personal Data is subject to processing, whether on paper or electronically and/or automatically.

3.2 The Data Controller shall process Personal Data for the time necessary to fulfil the purposes set out in article 2 of the information notice and, in any case, for 20 (twenty) years. Once this retention period has expired, the Personal Data will be destroyed or made anonymous.

4. Access to data

4.1 Personal Data may be made accessible to

  1. to employees and collaborators of the Data Controller, in their capacity as persons in charge and/or internal data processors and/or system administrators;
  2. to third party companies or other subjects (e.g. credit institutions, professional firms, consultants) who carry out activities on behalf of the Data Controller. These subjects will operate as autonomous owners or will be designated external managers of the treatment.

5. Communication of data

5.1 Without the need for express consent pursuant to article 6, lett. b) and c) GDPR), the Data Controller may communicate Personal Data to those subjects to whom communication is mandatory by law (for example, Judicial Authorities). These subjects will process the Personal Data in their capacity as autonomous data controllers. Apart from the aforementioned obligations, Personal Data will not be communicated to third parties other than the Data Controller or the subjects to whom access is granted pursuant to article 4 of the information notice.

6. Data Transfer

6.1 Personal Data are stored on servers located within the European Union. It is in any case understood that the Owner, if necessary, will have the right to move the servers also outside the European Union. In this case, the Data Controller will verify that the server provider transfers the data outside the European Union and processes them in compliance with the GDPR.

7. Rights of the interested party

7.1 The interested party is guaranteed the rights, namely,

  1. the right to obtain confirmation of the existence or not of Personal Data concerning him, even if not yet recorded, and their communication in intelligible form;
  2. the right to obtain information on the origin of the Personal Data, on the purposes and methods of processing, on the logic applied in case of processing carried out with the aid of electronic instruments, on the identification details of the Data Controller, of the data processors and of the representative designated pursuant to article 3, paragraph 2, GDPR, of the subjects or categories of subjects to whom the Personal Data may be communicated or who may become aware of them as designated representatives in the territory of the State, of data processors or persons in charge;
  3. the right to obtain 1) the updating, rectification or, when interested, integration of data, 2) the cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed, 3) certification to the effect that the operations as per numbers 1) and 2) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected;
  4. the right to object, in whole or in part, 1) for legitimate reasons to the processing of personal data concerning him/her, even if pertinent to the purpose of collection, 2) to the processing of Personal Data concerning him/her for the purpose of sending advertising material.

7.2 Where applicable, the interested party also has the right to be forgotten, to the limitation of processing, to the portability of data and the right to complain to the Guarantor Authority.

8. Methods of exercising rights

8.1 The interested party may at any time exercise its rights by means of a communication sent by registered mail to DUCKMA SRL, Via Vittorio Emanuele II, n. 1, (25122) Brescia or by PEC at duckma@pec.it .

9. Owner, manager and appointees

9.1 The Owner is DUCKMA SRL. The updated list of data processors and persons in charge of processing is kept at the registered office of the Owner.