Employment Applicant Information

Who are we and what do we do with your personal data?

HVB Living S.r.l., headquartered in (37053) Cerea (VR), via Crosaron snc (hereinafter also The Data Controller), as the data controller, is concerned with the confidentiality of your personal data and with ensuring that they are afforded the necessary protection from any event that might put them at risk of being breached. The Controller implements to this end policies and practices having regard to the collection and use of your personal data and the exercise of your rights under applicable law. The Controller takes care to update the policies and practices adopted for the protection of personal data whenever necessary and in any case in case of regulatory and organizational changes that may affect the processing of your personal data.   The Controller has appointed a data protection officer (DPO) whom you can contact if you have questions about its policies and practices. You can contact the DPO at the addresses and contact information below: <a href=”mailto:dpo.hvb@midigroup.it”>dpo.hvb@midigroup.it</a>

How and why does The Controller collect and process your personal data?

The Controller collects and/or receives information about you, such as: <ul> <li style=”font-weight: 400;” aria-level=”1″>name, surname</li> <li style=”font-weight: 400;” aria-level=”1″>Tax ID (Tax Identification Numbers)</li> <li style=”font-weight: 400;” aria-level=”1″>email</li> <li style=”font-weight: 400;” aria-level=”1″>phone number</li> <li style=”font-weight: 400;” aria-level=”1″>address</li> <li style=”font-weight: 400;” aria-level=”1″>curricular data</li> <li style=”font-weight: 400;” aria-level=”1″> data capable of revealing health status, if also disclosed by you through your curriculum vitae or if the position for which you are applying is reserved for protected categories under specific legal obligations;</li> <li style=”font-weight: 400;” aria-level=”1″>Computer data (logs and IP addresses)</li> </ul> Personal data about you will be processed for the following purposes: 1) The selection of personnel and/or initiation of collaboration <table> <tbody> <tr> <td>Purposes</td> <td>Legal basis</td> </tr> <tr> <td>- the search for candidates for open positions - the collection of applications and curricula, which may take place through: recruitment ads conveyed through recruitment agencies, temporary agencies, universities, advertisement in newspapers, magazines, specialized periodicals, institutional website - the review of the resumes received - the organization of selective interviews - the inclusion of the successful candidate in the Holder’s organizational environment - the establishment of the employment/collaboration relationship </td> <td> Conducting pre-contractual activities Fulfillment of specific obligations. Performance of specific duties arising from laws, regulations or collective agreements, including company agreements, in particular for the purpose of establishing the employment relationship and/or collaboration relationship</td> </tr> </tbody> </table>

Your data (such as: first name, last name, social security number, email, phone number, address, curriculum data, computer data) may also be collected from third parties such as, but not limited to:

<ul>

<li style=”font-weight: 400;” aria-level=”1″> private entities engaged in labor administration, intermediation, personnel search and selection, training, and outplacement support activities;</li>

<li style=”font-weight: 400;” aria-level=”1″> universities and schools.</li>

</ul>

Where provided, this is without prejudice to the right to rectification of data processed or collected.

The data collected or otherwise obtained by the Controller as a result of the establishment of the selection procedure for positions available within its organization, except for those relating to health status, voluntarily released by you, must be understood to be necessary and failure to provide such data will make it impossible for The Controller to follow up on the activities aimed at:

- Evaluate your application in the personnel selection process that the Controller also follows up through its suppliers (third parties/recipients);

- manage the candidate selection process in all its phases and the resulting fulfillments.

2) for information security activities

<table>

<tbody>

<tr>

<td>Purposes </td>

<td>Legal Basis</td>

</tr>

<tr>

<td>- control and monitoring of the services displayed online and on platforms pertaining to the Owner and made available to you for sending resumes and/or accessing open job/collaboration positions (e.g., the forms posted on the “Work with Us” page)

- implementation of data breach detection and notification procedures (data breach)</td>

<td>

Fulfilling legal obligations (detection and notification of data breach events)</td>

</tr>

</tbody>

</table>

3) For communication to third parties and for dissemination

<table>

<tbody>

<tr>

<td>Recipients</td>

<td>Legal basis</td>

</tr>

<tr>

<td>

<ul>

<li style=”font-weight: 400;” aria-level=”1″> Information and computer support society</li>

<li style=”font-weight: 400;” aria-level=”1″> Recruitment and training and recruitment companies/agencies </li>

<li style=”font-weight: 400;” aria-level=”1″>Public bodies</li>

<li style=”font-weight: 400;” aria-level=”1″>Group companies to which the Controller belongs </li>

</ul>

</td>

<td>conduct of pre-contractual activities

Fulfilment of legal and/or regulatory obligations dependent on the activities put in place by the selective procedure</td>

</tr>

</tbody>

</table>

Where the communication involves data capable of revealing health status, the relevant processing operations will take place with all appropriate safeguards including those that, if required based on the risks detected, result in the application of pseudonymization solutions, and/or aggregation and/or encryption of data.

How, where and how long is your data stored?

How

Data processing is carried out by means of paper media or computer procedures by specially authorized internal persons. They are allowed access to your personal data to the extent and to the limits that it is necessary for the performance of the processing activities concerning you.

The Data Controller periodically verifies the means by which your data are processed and the security measures provided for them, the constant updating of which it provides for; verifies, also through the persons authorized to process them, that no personal data are collected, processed, archived or stored whose processing is not necessary or whose purposes are in the case exhausted; verifies that the data are stored with the guarantee of integrity and authenticity and their use for the purposes of the processing actually carried out, also due to the particular nature of the same. The checks allow the Data Controller to assess the strict relevance, non-excessiveness and indispensability of data belonging to special categories with respect to the selection procedure activities as well as to the relationship to be established, also with reference to the data you provide on your own initiative.

The Holder guarantees that, even after verification, data are found to be surplus or irrelevant will not be used except for the possible preservation, in accordance with the law, of the act or document containing them.

Where

Data are stored in paper, computer and electronic files located within the European Economic Area, and specific security measures are ensured.

How long

The personal data processed by the Data Controller are kept for the time necessary to carry out the activities related to the selection of the candidate and in any case no longer than 2 years from their collection except for the possible establishment of the employment and/or collaboration relationship. This is without prejudice to cases in which rights dependent on the processing in place should be asserted in court, in which case your data, only those necessary for such purposes, will be processed for the time essential to their pursuit.

However, it is without prejudice to your right to object at any time to processing based on legitimate interest for reasons related to your particular situation.

What are your rights?

Your rights allow you to be in control of your data at all times. Your rights are those of:

<ul>

<li style=”font-weight: 400;” aria-level=”1″>access;</li>

<li style=”font-weight: 400;” aria-level=”1″>rectification;</li>

<li style=”font-weight: 400;” aria-level=”1″> revocation of consent;</li>

<li style=”font-weight: 400;” aria-level=”1″>deletion;</li>

<li style=”font-weight: 400;” aria-level=”1″> limitation of treatment;</li>

<li style=”font-weight: 400;” aria-level=”1″> objection to processing;</li>

<li style=”font-weight: 400;” aria-level=”1″>portability. </li>

</ul>

Basically you, in essence you, at any time and without special charges and formalities for your request, can:

<ul>

<ul>

<li style=”font-weight: 400;” aria-level=”1″>obtain confirmation of the processing operated by the Controller </li>

</ul>

</li>

</ul>

<ul>

<li aria-level=”1″> access to your personal data and know their origin (when the data are not obtained from you directly), the purposes and purposes of the processing, the data of the persons to whom they are communicated, the period of retention of your data or the useful criteria for determining it;</li>

</ul>

<ul>

<li aria-level=”1″> aggiornare o rettificare i tuoi dati personali in modo che siano sempre esatti e accurati;</li>

</ul>

<ul>

<ul>

<li style=”font-weight: 400;” aria-level=”1″>revoke consent at any time, in the event that it forms the basis of the processing. However, revocation of consent does not affect the lawfulness of the processing based on the consent carried out prior to the revocation;</li>

</ul>

</li>

</ul>

<ul>

<li aria-level=”1″> delete your personal data from the databases and/or archives, including backup archives, in the case, among others, in which they are no longer necessary for the purposes of the processing or if the processing is assumed to be unlawful, and always if the conditions provided for by law are met; and in any case if the processing is not justified by another equally legitimate reason;</li>

</ul>

<ul>

<li aria-level=”1″> limit the processing of your personal data in certain circumstances, such as where you have disputed its accuracy, for the period necessary for the Data Controller to verify its accuracy. You must also be informed, in a reasonable time, when the period of suspension has expired or the cause for restricting processing has ceased to exist, and thus the restriction itself lifted;</li>

</ul>

<ul>

<li aria-level=”1″> obtain your personal data, if they are processed on the basis of a contract and by automated means, in electronic format, including for the purpose of transmitting them to another data controller.</li>

</ul>

The Controller shall do so without delay and, in any case, no later than one month after receipt of your request. The deadline may be extended by two months if necessary, taking into account the complexity and number of requests received. In such cases, the Controller will, within one month of receipt of your request, inform you and make you aware of the reasons for the extension.

For any further information and in any case to send your request please write to at <a href=”mailto:info@hotelvillabartolomea.it”>info@hotelvillabartolomea.it</a>.

How and when can you object to the processing of your personal data?

For reasons related to your particular situation, you can object at any time to the processing of your personal data if it is based on legitimate interest by sending your request to at <a href=”mailto:info@hotelvillabartolomea.it”>info@hotelvillabartolomea.it</a> You have the right to have your personal information deleted unless there is a legitimate reason overriding the reason that gave rise to your request.

Who can you complain to?

Without prejudice to any other action in administrative or judicial proceedings, you may file a complaint with the data protection authority, unless you reside or conduct your business in another member state. In the latter case, or in the case where the violation of personal data protection legislation occurs in another EU country, the competence to receive and hear the complaint will be of the supervisory authorities established there.   Any updates to this notice will be communicated to you promptly and by appropriate means, and you will be similarly notified, prior to proceeding with them and in time to give your consent if necessary.