Privacy Policy Careers

Identity and Contact Information of the Data Controller This privacy policy governs the processing of personal data in compliance with current data protection regulations, particularly EU Regulation 2016/679 (hereafter referred to as “GDPR”), carried out by De Castelli Srl, located at Via delle Industrie 10, Crocetta del Montello (TV), Italy, phone +39 0423 638218, email info@decastelli.com, fax +39 0423 83467 (hereafter also “the Controller”). No representative has been appointed as the Controller is based in Italy.

Data Protection Officer Contact Details The Controller has not appointed a Data Protection Officer.

Purposes of Processing and Legal Basis a) For CVs sent voluntarily by the data subject, personal data processing is carried out to enable the review and evaluation of the CV. The legal basis for this processing is the Controller’s legitimate interest. If consent for processing is denied, the CV cannot be reviewed or included in any recruitment phase.

b) For CVs sent by the data subject following a verbal or written request from the Controller, personal data processing is conducted to enable review and evaluation. In this case, the legal basis is the necessity of processing to execute a contract and/or manage pre-contractual relations. Refusal to consent to processing will prevent the review and progression through any recruitment phase.

Processing Methods and Logic Personal data processed and retained for the purposes listed in section 3 will be handled using paper records, automated processes, and CRM software, as well as email systems.

Consent Expression No explicit consent is required for the processing of the data subject’s personal information.

Source of Personal Data Only data provided directly by the data subject in their CV and/or relevant form will be processed. Publicly accessible data will not be processed unless specified and/or included by the data subject within the CV or form.

Recipients and Potential Categories of Data Recipients Personal data may be shared with:

Companies providing information society services, including, in particular, hosting services.
Companies involved in personnel recruitment.
Categories of Data Only personal data will be processed, and the data subject should exclude any sensitive data in their CV. Sensitive data includes information on racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, as well as health or sexual orientation. Any CV containing such information will be deleted immediately by the Controller.

Data Transfer The Controller intends to transfer personal data to a third country or international organization. These entities may include, for example:

Communication companies working on behalf of the Controller.
Information society service providers, especially hosting service providers. If these entities are located in a third country or international organization, the transfer will occur only with an adequacy decision from the European Commission ensuring adequate protection of rights. The Controller also reserves the right to establish specific agreements requiring these entities to adopt security measures that guarantee appropriate protections. Google Inc., in particular, has contractually committed to ensuring adequate protection of data subject rights. Data may be transferred to the following country: United States of America. To obtain a copy of this data or information on where it is available, a request can be sent to info@decastelli.com.
Data Retention Period Personal data processed for the purposes specified in points 3a and 3b will be retained for no longer than five years from the date of CV submission.

Data Subject’s Rights 11.1 Right to Object The data subject has the right to object, at any time, to the processing of their personal data for reasons related to their particular situation, under Article 6, paragraph 1, letters e) or f) of the GDPR, including profiling based on these provisions. The Controller will cease processing the data unless there are compelling legitimate grounds that override the data subject’s interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.

11.2 Other Rights The Controller also informs the data subject of the following rights:

Right of Access: The data subject has the right to obtain confirmation from the Controller on whether their data is being processed and, if so, access to the personal data and certain information, in accordance with Article 15 of the GDPR.
Right to Rectification: The data subject has the right to have inaccurate personal data corrected by the Controller without undue delay. Considering the purposes of processing, they also have the right to complete any incomplete personal data, in accordance with Article 16 of the GDPR.
Right to Data Erasure, Including Withdrawal of Consent: The data subject has the right to request the deletion of their personal data without undue delay, and the Controller is required to delete such data. The data subject also has the right to withdraw consent at any time if justified under Article 17 of the GDPR; this right can be exercised without affecting the lawfulness of processing based on consent prior to withdrawal.
Right to Restrict Processing: The data subject has the right to restrict processing in cases defined by Article 18 of the GDPR.
Right to Data Portability: The data subject has the right to receive personal data in a structured, commonly used, and machine-readable format and to transmit such data to another controller, as specified in Article 20 of the GDPR.
Exercising Rights Requests for the exercise of rights outlined in this notice, including, in particular, the right to data deletion and consent withdrawal, should be sent directly to the Controller at info@decastelli.com. Alternatively, requests can be sent via registered mail to De Castelli srl, Via delle Industrie 10, Crocetta del Montello (TV), Italy.

Policy Availability This policy is available at https://www.decastelli.com/en/privacy-policy/ and at the Controller’s premises. If explicitly requested by the data subject, information may also be provided orally, provided the data subject’s identity is verified through a phone request to the Controller’s contact details.