Sofidel Germany privacy notice

Recruitment Portal Privacy Policy in accordance with Art. 13 of Regulation (EU) 2016/679

Data Controller and Data Protection Officer

We hereby inform you that, pursuant to Art. 13 of Regulation (EU) 2016/679 (hereinafter "GDPR"), Sofidel Germany GmbH with registered office at Schönfelder Str. 1, D-39596 Arneburg, Germany - as the data controller (hereinafter "Data Controller") - who can be contacted at the e-mail address: [email protected] - will process your personal data collected through the Success Factor Recruitment Portal in connection with your application to a position with Sofidel Germany GmbH (hereinafter "Portal").

The Data Controller has appointed a Data Protection Officer (hereinafter "DPO"), who can be contacted at the address: [email protected]

Categories of data processed

The data processed by the Data Controller may include:

1) Common data, such as, by way of example, personal details (e.g. first name, surname, date of birth, address, image, sex, tax code, etc.), contact details (e.g. landline and/or mobile telephone number, e-mail address, etc.), work and professional details, and any other information contained in the curriculum vitae you have submitted;

2) Where appropriate, and in any case within the limits of the requirements of the applicable legislation, data belonging to the 'special categories' referred to in Art. 9(1) of the GDPR (i.e. data revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, membership of political parties, membership of trade unions, associations or organisations of a religious or philosophical nature, biometric or genetic data, and health status (for example, belonging to “protected categories”) or data concerning the sexual life or orientation of the person).

The personal data indicated above will be jointly defined below, for brevity, as "personal data".

We hereby inform you that, if you decide to provide data belonging to the special categories referred to in Art. 9(1) of the GDPR which the Data Controller is not required to process in compliance with the regulatory obligations to which it is subject or personal data not relevant to the purposes pursued, the Data Controller will refrain from processing such data. For this reason, we ask you not to provide this type of information unless it is strictly necessary to do so.

It is also possible that you may voluntarily provide the Data Controller - within the framework of the above procedure - with data relating to third parties. We would like to inform you that, in relation to such cases, you are the independent data controller with all the obligations and responsibilities under the law. Should you provide or otherwise process the personal data of third parties, it is your responsibility to ensure that this particular case of processing is based on an appropriate lawful basis legitimising the processing of the information in question.

Purpose and legal basis of the processing of personal data

Your personal data will be collected and processed, without the requirement for your specific consent, to assess the suitability of your profile for open positions for which you have submitted an application and, in general, to manage staff selection procedures and to contact you in order to schedule any interviews that may be necessary (“purpose of managing your application”) pursuant to Art. 6(1) (b) and (f) and 9(2)(b) of the GDPR. For applications submitted to specific national positions outside of Italy respective national provisions such as § 26 of the German Data Protection Act (Bundesdatenschutzgesetz) may apply.

The provision of your personal data for the purpose indicated above is optional but, if not provided, it may not be possible to assess your profile in order to schedule interviews.

To the extent you voluntarily provide your personal data that we do not request for the recruitment process purposes and are not required to consider under applicable law, you consent to the processing of such data pursuant to Art. 6(1) (a) of the GDPR.

Once provided, your personal data may also be processed for the following purposes:

a) to contact you in order to propose open positions you have not applied for but which match your profile (“purpose of managing open positions”) in accordance with Art. 6(1) (f) of the GDPR, i.e. based on the legitimate interest of the Data Controller;

b) to fulfil any legal obligations to which the Data Controller is subject pursuant to Art. 6(1)(c) and 9(2)(b) of the GDPR (“compliance purpose”);

c) to defend against any legal claims on the basis of Art. 6(1)(f) and 9(2)(f) of the GDPR (“purpose of defence in court”).

We would also like to inform you that, based on the legitimate interest that the Data Controller has found to exist as a result of the balancing of interests carried out in accordance with Art. 6(1)(f) and recital 48 of the GDPR, your personal data will be shared, for internal administrative purposes, with Sofidel Spa, in its capacity as Parent Company and independent data controller ("purpose of data sharing with the Parent Company for internal administrative purposes").

Retention of personal data

Your personal data will be kept only for the time necessary for the purposes for which it was collected, in line with the principles of data minimisation and storage limitation referred to in Art. 5(1)(c) and (e) of the GDPR.

Specifically, your data will be kept for as long as the position for which you have applied is open and, in any case, no longer than 6 months after the position was closed. At the end of this period, your data will be permanently deleted. The Data Controller, however, reserves the right to retain your data for as long as necessary to comply with the regulatory obligations to which it is subject or to meet any defence requirements.

After expiration of the storage period, the data will be deleted in accordance with data protection regulations.

Recipients

Your data may be shared with:

1. Subjects who typically act as data processors pursuant to Art. 28 of the GDPR (e.g. Portal supplier);

2. Personnel appointed to process data in accordance with Art. 29 of the GDPR;

3. Subjects, entities or authorities, independent data controllers, to whom it is compulsory to communicate your personal data pursuant to the provisions of law or orders by the authorities;

4. Service providers such as lawyers, tax consultants or banking institutions;

5. Sofidel Spa, in its capacity as Parent Company and independent data controller, for the purpose of sharing data for internal administrative purposes.

The updated and complete list of data processors is available from the Data Controller and can be requested at the addresses specified above.

Transfer of data outside the EU

Personal data will not be transferred outside the territory of the European Union.

Your privacy rights

You have the right to access your data at any time in accordance with Articles 15-22 of the GDPR. In particular, you may request the rectification, erasure or restriction of the processing of such data in the cases set out in Art. 18 of the GDPR, withdraw your consent, or obtain the portability of data relating to you in the cases laid down in Art. 20 of the GDPR.

You can object to the processing of your data under Art. 21 of the GDPR, giving evidence of the reasons for your objection. The Data Controller reserves the right to evaluate your request, which will not be accepted if there are legitimate grounds for the processing which override your interests, rights and freedoms.

Requests must be made in writing and sent to the Data Controller or to the DPO at the above addresses.

If you believe that the processing of your personal data performed by the Data Controller is in violation of the provisions of the GDPR, you have the right to lodge a complaint with the competent Data Protection Authority, as set out in Art. 77 of the GDPR, or to take appropriate legal action (Art. 79 of the GDPR).

Please note that you can remove any sensitive data from your CV, as you are not obliged to communicate it to us. However, if you believe this information is necessary for your application, you must consent to data processing, otherwise we will not be able to process your data.

The Data Controller