Sofidel Sweden privacy notice

Recruitment Portal Privacy Policy in accordance with Art. 13 of Regulation (EU) 2016/679

Data Controller and Data Protection Officer

We hereby inform you that, pursuant to Art. 13 of Regulation (EU) 2016/679 (hereinafter "GDPR"), Sofidel Sweden AB, with registered office in Kisa in Sweden - as the data controller (hereinafter "Data Controller") - who can be contacted at the e-mail address: [email protected] - will process your personal data collected through the Success Factor Recruitment Portal (hereinafter "Portal").

Categories of data processed

The data processed by the Data Controller may include:

1) Common personal data like first name, surname, date of birth, address, image, tax code, contact details telephone number, e-mail address, work and professional details, and any other information contained in the curriculum vitae (CV) you have submitted.

2) Where appropriate, and in any case within the limits of the requirements of the applicable legislation, data belonging to the 'special categories' referred to in Art. 9(1) of the GDPR (i.e. data revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, membership of political parties, membership of trade unions, associations or organisations of a religious or philosophical nature, biometric or genetic data, and health status or data concerning the sexual life or orientation of the person).

The personal data indicated above will be jointly defined below, for brevity, as "personal data".

We hereby inform you that, if you decide to provide data belonging to the special categories referred to in Art. 9(1) of the GDPR which the Data Controller is not required to process in compliance with the regulatory obligations to which it is subject or personal data not relevant to the purposes pursued, the Data Controller will refrain from processing such data. For this reason, we ask you not to provide this type of information unless it is strictly necessary to do so.

Purpose and legal basis of the processing of personal data

Your personal data will be collected and processed, without the requirement for your specific consent, to assess the suitability of your profile for open positions for which you have submitted an application and, in general, to manage staff selection procedures and to contact the references provided by you, and to contact you in order to schedule any interviews that may be necessary (“purpose of managing your application”) pursuant to Art. 6(1)(f) and 9(2)(b) of the GDPR and on the basis of the Data Controller’s legitimate interest.

The provision of your personal data for the purpose indicated above is optional but, if not provided, it may not be possible to assess your profile in order to schedule interviews.

Once provided, your personal data may also be processed for the following purposes:

a) to contact you in order to propose open positions you have not applied for but which match your profile (“purpose of managing open positions”) in accordance with Art. 6(1) (f) of the GDPR, i.e. based on the legitimate interest of the Data Controller;

b) to fulfil any legal obligations to which the Data Controller is subject pursuant to Art. 6(1)(c) and 9(2)(b) of the GDPR (“compliance purpose”);

c) to defend against any legal claims on the basis of Art. 6(1)(f) and 9(2)(f) of the GDPR (“purpose of defence in court”).

We would also like to inform you that, based on the legitimate interest that the Data Controller has found to exist as a result of the balancing of interests carried out in accordance with Art. 6(1)(f) and recital 48 of the GDPR, your personal data will be shared, for internal administrative purposes, with Sofidel Spa, in its capacity as Parent Company and independent data controller ("purpose of data sharing with the Parent Company for internal administrative purposes").

Retention of personal data

Your personal data will be kept only for the time necessary for the purposes for which it was collected, in line with the principles of data minimisation and storage limitation referred to in Art. 5(1)(c) and (e) of the GDPR.

Specifically, your data will be kept for as long as the position for which you have applied is open and, in any case, no longer than 2 years after your application was submitted. At the end of this period, your data will be permanently deleted. The Data Controller, however, reserves the right to retain your data for as long as necessary to comply with the regulatory obligations to which it is subject or to meet any defence requirements.

Recipients

Your data may be shared with:

1. Subjects who typically act as data processors pursuant to Art. 28 of the GDPR (e.g. Portal supplier);

2. Personnel appointed to process data in accordance with Art. 29 of the GDPR.

3. Subjects, entities or authorities, independent data controllers, to whom it is compulsory to communicate your personal data pursuant to the provisions of law or orders by the authorities;

4. Sofidel Spa, in its capacity as Parent Company and independent data controller, for the purpose of sharing data for internal administrative purposes.

The updated and complete list of processors is available from the Data Controller and can be requested at the addresses specified above.

Transfer of data outside the EU

Personal data will not be transferred outside the territory of the European Union.

How we collect your personal data

We only process personal data that is provided by you or from your references (if applicable).

Your privacy rights

You have the right to access your data at any time in accordance with Articles 15-22 of the GDPR. In particular, you may request the rectification, erasure or restriction of the processing of such data in the cases set out in Art. 18 of the GDPR, withdraw your consent, or obtain the portability of data relating to you in the cases laid down in Art. 20 of the GDPR.

You can object to the processing of your data under Art. 21 of the GDPR, giving evidence of the reasons for your objection. The Data Controller reserves the right to evaluate your request, which will not be accepted if there are legitimate grounds for the processing which override your interests, rights and freedoms.

Requests must be made in writing and sent to the Data Controller at the above addresses.

If you believe that the processing of your personal data performed by the Data Controller is in violation of the provisions of the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority, as set out in Art. 77 of the GDPR, or to take appropriate legal action (Art. 79 of the GDPR).

Please note that you can remove any sensitive data from your CV, as you are not obliged to communicate it to us. However, if you believe this information is necessary for your application, you must consent to data processing, otherwise we will not be able to process your data.

The Data Controller