Privacy Policy for Applicants

Pursuant to Articles 13 and 14 of Regulation (EU) 2017/679 (from here on, the “GDPR”), FPZ S.p.A. legally headquartered in Via F.lli Cervi 16 – 20863 Concorezzo, Monza Brianza, Italy – email address: info@fpz.com in its role as the Data Controller (from here on, “FPZ” or the “Controller”), hereby informs you on the processing of your personal information carried out within the procedure of research, selection and assessment of professional profiles being compatible with the working needs and opportunities of our company (from here on, the “Selection”). From here on, we shall refer to you using the term “Applicant”.

1. Source and type of the personal information being processed

The personal information being processed is the information having been voluntarily disclosed by the Applicant when he or she sent his or her curriculum vitae (and his or her cover letter, if present) concerning spontaneous applications or as a response to specific job vacancies posted by FPZ, be it directly (on the company website or on company social networks) or indirectly (on websites /platforms belonging to employment intermediaries/employment agencies) or during job interviews.

Therefore, the Data Controller may process the following categories of personal information and data:

1. generic personal information, such as, but not limited to, the following: personal details, fiscal code, contact information, wage information (e.g. bonuses, insurance policies, commissions and the like), the information concerning training, career and company role (such as academic qualifications, previous work experiences, promotions, performance levels and the like), the portrait photo (if present on the cv), as well as family-related personal information (such as the marital status, the composition of the family and the like)
   1. special categories of personal data, pursuant to Art. 9 of the GDPR such as, but not limited to, the following: personal data concerning health (such as, for example, the belonging to protected categories and the condition of disability), the participation to political or union associations, and the like. On this, it should be noted that, in case of spontaneous disclosure of special categories of personal data being neither inherent nor essential to the context of the Selection and for the purposes detailed in Par.2, therefore towards creating an employment relationship, such data shall in no way be considered towards the application.

(from here on, considered overall, the “Personal Information and Data”).

2. Purpose of the treatment and legal basis

The Personal Information and Data shall be processed exclusively for the purposes and pursuant to the legal basis detailed below:

	Purposes	Legal Basis
A.	Management of the Selection and the possible creation of the employment relationship, and in particular: The fulfilment of administrative and organizational duties (scheduling of job interviews, communications concerning the service and the selection, feedback and the like.);An objective assessment of the Applicant’s professional and personal requirements concerning the possibility of joining FPZ’s organizational area concerning a job vacancy, if present, or also to offer the Applicant other kinds of job vacancies being coherent with the Applicant’s educational and professional profile.	Concerning generic personal information alone: Execution of the pre-contractual measures having been adopted as requested by the data subject.   Concerning special categories of data alone: Authorization by the Italian Data Protection Authority no. 1/2016 (issued on  December 15, 2016) on the processing of sensitive data (i.e. special categories of data) within employment  (please see, in particular, Par. 1.4.1., titled “Data processing during pre-employment) declared compatible with the GDPR by the Provision of the Italian Data Protection Authority issued on December 13, 2018. (no. 497 of the Provisions’ Register).
B.	Asserting and defending one’s rights, also through extrajudicial initiatives and by the means of third parties, as well as preventing crimes (such as, for example, frauds, identity thefts and the like).	Legitimate interest of the Data Controller.
C.	Fulfilling a legal obligation connected with civil, fiscal and administrative law provision, as well as with EU law provisions, norms, codices and procedures approved by Authorities and other competent institutions, as well as following up requests by the competent administrative or judicial authority and, more generally, by public subjects, in full compliance with legal formalities.	Fulfilment of a legal obligation the Data Controller is subject to.

3. Disclosure of personal information and data and consequences of the failure to provide all the information required

The failure to provide Personal Information or their incomplete or incorrect provision may prevent FPZ from considering the application for the Selection.

4. Data recipients and possible categories thereof

In full compliance with the specific purposes they have been collected for and with the principles of necessity, pertinence and data minimization, the Personal Information and Data may be known by the persons having being authorized for processing by the Data Controller (be they employees or contractors).

Furthermore, the data controller may disclose them to the following categories of recipients:

• To the third parties FPZ relies on as suppliers – that may be appointed as data processors as needed – (such as employment agencies, employment consultants, as well as companies or subjects carrying out legal services, accounting services and the like);
  • To the other companies of the FPZ Group (also to the ones being legally headquartered abroad) being directly connected to FPZ S.p.A. or controlled by the latter;
  • To companies and professionals in their role as third parties appointed to assert rights, interests and demands by the Data Controller rising from the relationship with the Applicant;
  • To State Administrations, Judicial and Administrative Authorities, Public and Private Bodies, also following inspections and checks;
  • To the subjects being able to access the data due to legislative provisions, including secondary or EU legislation.

Only the category of recipients shall be stated, as it is constantly updated. In order to learn about  the updated list of recipients, the Applicant may contact the Data Controller directly, by means of the contact information detailed in point 9, below.

5. Data Transfers Abroad

Concerning the aforementioned purposes, and especially in order to assess your profile,  (even through other companies of the FPZ Group), it could be possible for your data to be transferred to extra-EU countries. In such cases, the transfer shall happen in full compliance with the provisions and requirements of law and in the presence of adequate safeguards, about which the Data controller reserves the right to provide further information on the specific transfer, if need be.

6. Methods of processing

Personal Information and Data shall be temporarily stored within the database belonging to the Data Controller and shall be processed, both through manual and ICT-based tools, exclusively by subjects being authorized and expressly trained for that.

7. Storage period for Personal Information and data

7.1 I The personal information and data shall be stored by the Data Controller for the period of time being  strictly necessary to the purpose they have been collected for; more precisely, the data Controller shall store the following:

• The Personal Information and Data, at least for the whole duration of the Selection and, after its end, for a further 12 months, but in no case for more than 24 months since the reception of the Personal Information and Data by the Data Controller;
• The Personal Information and Data whose processing is needed pursuant to the law, for the period provided for in the law;

at any rate, concerning the purposes detailed in Paragraph 2, letter B., said data shall be stored for a period equivalent to the duration of the statute of limitations, increased by a further six months as a cautionary period, in order to ensure FPZ the right to legal defence concerning possible future disputes, be they judicial or administrative in nature.

7.2 At any rate, once the relevant terms have expired, all the personal information shall be erased and anonymized, except in the case when an employment relationship is established following the Selection. In every case, the aforementioned terms may be postponed, should the need arise, when pursuing specific purposes (such as for example the ones connected with labour law, administrative law or bookkeeping) or when particular circumstances exist (such as, for example, outstanding judicial or administrative disputes or outstanding disputes concerning the termination of the employment relationship), or whenever the storage of said information and data for a further period is required by the competent authorities or by the law in force.

8. Rights of the Data Subjects

8.1 The Candidate shall be entitled:

• To object,anytime, to the processing of his or her personal data for the purposes detailed in Paragraph 2B;
• And, whenever he or she deems that the processing of his or her personal data are processed in infringement to the provisions of the discipline concerning the protection of personal data and information, he or she shall be entitled to lodge a complaint, pursuant to Art. 77 of the GDPR, before the national data supervisory authority based in the EU Member State of which he or she is an habitual resident or has his or her habitual workplace, or where the alleged breach of his or her rights has happened (should such State be Italy, the body for the lodging of the complaint is the Italian Data Protection Authority)  or to apply before a suitable court of law (pursuant to Art. 79 of the GDPR).

8.2 Furthermore, the Applicant can, anytime and free of charge, should the circumstances allow, exercise the following rights before the Data Controller:

1. Right of access giving the data subject the right to obtain from the data controller confirmation as to whether or not personal information and data concerning him or her are being processed, and, where that is the case, access to the Personal Information and Data;
2. Right to rectification allowing the data subject to obtain from the data controller the rectification of inaccurate personal information and data concerning him or her;
3. Right to erasure allowing the data subject to obtain from the data controller, in the cases provided for within the law in force, the erasure of the personal information and data concerning him or her;
4. Right to restriction of processing allowing the data subject to have the right to obtain, in the cases provided for within the law in force, the restriction of the processing (i.e., the marking of stored personal data with the aim of limiting their processing in the future) of his or her personal information and data from the data controller;
5. Right to data portability: Should the conditions provided for in Art. 20, Paragraph 1a) and b) of the GDPR, under which the processing of the personal information and data for which the portability can be asked shall be based on consent or on a contract and carried out by automated means and concerning only the personal information and data provided by the data subject to the Data Controller. The right herein allows the data subject to receive the personal data and information in a structured, commonly used and machine-readable format and  to have the right to transmit those data and to another data controller.

9. Contact information

In order to exercise all the rights available to them and to request information, Users may contact the Data Controller by e-mail, at the following address: info@fpz.com or by ordinary mail at FPZ S.p.A. at the following address: Via F.lli Cervi 16 – 20863 Concorezzo, Monza e Brianza, Italy  or they may contact the DPO at the following e-mail address:dpo@fpz.com.