Privacy Notice

pursuant to Article 13 of Regulation (EU) 2016/679 concerning the protection of natural persons with regard to the processing of personal data, and the national legislation governing such processing
Data Subjects: Potential Job Applicants

We hereby inform you that European Regulation No. 679 of 27 April 2016 concerning the processing of personal data provides for the protection of natural persons with regard to the processing of their personal data.

Pursuant to Article 13 of Regulation (EU) 2016/679, we therefore invite you to read this Privacy Notice and provide your consent to the processing of your personal data by signing and returning the attached form.

1. Identification details of the Data Controller
Pursuant to Article 4, point 7, of Regulation (EU) 2016/679, the Data Controller of the personal data is AENDUO, with registered office at Via Properzio 5, 00193 Rome, Italy, certified email (PEC): [email protected], represented by its legal representative pro tempore.

The Data Protection Officer (DPO) appointed by the Data Controller pursuant to Article 37 of the GDPR is Renato Carafa, who may be contacted at the following address: E-mail: [email protected].

2. Purposes of the processing
A. To identify candidates who may be contacted for an interview (legal basis: consent of the data subject);
B. To assess your suitability for employment in the role for which you are applying, as well as for future roles that may become available (legal basis: legitimate interest of the Data Controller);
C. To create candidate profiles, including analysing candidate data to assess compatibility with a particular position and to develop estimates of future performance. Candidate selection and recruitment decisions are reviewed and carried out by a member of AENDUO's recruitment staff, and no automated decision concerning an application is made without review by a member of AENDUO's recruitment staff (legal basis: legitimate interest of the Data Controller).

3. Methods of processing
Personal data will be processed in paper and electronic form and entered into the relevant databases, which may be accessed exclusively by persons authorised to process personal data and who have received appropriate training.

Processing may also be carried out by third parties who, having been appointed as Data Processors, provide specific services necessary for the fulfilment of legal and/or contractual obligations undertaken by the Data Controller in connection with the provision of the services/products offered.

All data processing operations are carried out in such a way as to ensure the integrity, confidentiality, accuracy and availability of personal data.

4. Data retention period
The data provided will be retained for no longer than is necessary to achieve the purposes for which they are collected and processed and, in any event, for no longer than 24 months.

5. Scope of data communication and disclosure
In relation to the purposes specified in Section 2, personal data may be disclosed to the following parties:

Parties performing administrative and IT support functions;
Authorised personnel of our service providers.

6. Rights pursuant to Articles 15, 16, 17, 18, 20, 21 and 22 of Regulation (EU) 2016/679
We hereby inform you that, as a data subject, in addition to the right to lodge a complaint with the competent supervisory authority, you have the rights listed below, which may be exercised by submitting a specific request to the Data Controller and/or Data Processor, as identified in Section 1.

Article 15 – Right of access
The data subject has the right to obtain from the Data Controller confirmation as to whether or not personal data concerning them are being processed and, where this is the case, to obtain access to the personal data and information concerning the processing.

Article 16 – Right to rectification
The data subject has the right to obtain from the Data Controller the rectification of inaccurate personal data concerning them without undue delay. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Article 17 – Right to erasure (right to be forgotten)
The data subject has the right to obtain from the Data Controller the erasure of personal data concerning them without undue delay, and the Data Controller shall have the obligation to erase personal data without undue delay.

Article 18 – Right to restriction of processing
The data subject has the right to obtain from the Data Controller restriction of processing where one of the following applies:

a) the accuracy of the personal data is contested by the data subject, for the period necessary for the Data Controller to verify the accuracy of the personal data;

b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

c) although the Data Controller no longer needs the personal data for the purposes of the processing, the data are required by the data subject for the establishment, exercise or defence of legal claims;

d) the data subject has objected to processing pursuant to Article 21(1), pending verification as to whether the legitimate grounds of the Data Controller override those of the data subject.

Article 20 – Right to data portability
The data subject has the right to receive the personal data concerning them, which they have provided to a Data Controller, in a structured, commonly used and machine-readable format and has the right to transmit those data to another Data Controller without hindrance from the Data Controller to which the personal data were provided.

In exercising their right to data portability pursuant to paragraph 1, the data subject has the right to have the personal data transmitted directly from one Data Controller to another, where technically feasible.

Article 21 – Right to object
The data subject has the right to object, at any time, on grounds relating to their particular situation, to the processing of personal data concerning them pursuant to Article 6(1)(e) or (f), including profiling based on those provisions.

Article 22 – Right not to be subject to automated decision-making, including profiling
The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.