Privacy policy

Disclosure on the processing of personal data pursuant to art. 13 of regulation (EU) 2016/679

Dear Applicant,
Pursuant to Art. 13 of Regulation (EU) 2016/679 (hereinafter the “GDPR”), Ecospray Technologies S.r.l. (hereinafter “Ecospray” or the “Controller”) hereby informs you that your personal data (hereinafter the “Data”), conferred by you or, on an occasional basis, collected from third parties (such as, merely by way of example, companies operating in staff searches and recruitment), will be processed in compliance with the provisions of the GDPR, of Italian Legislative Decree no. 196/2003 as subsequently amended and supplemented (hereinafter the “Privacy Legislation”), of Italian Law no. 300/1970 and in accordance with the following disclosure, as well as with all provisions issued by the Data Protection Authority, as applicable over time.

Data controller. Data processors

The Data Controller is Ecospray Technologies S.r.l., with registered office at Via Ricotti, 5 – 27058 Voghera (PV), tel. +39 0131 854611, e-mail: privacy@ecospray.eu. The updated list of any data processors is available at the office of the Data Controller.

Data categories

The Data processed as per this disclosure comes under the following categories of personal data:

• personal data that cannot be classified under any of the specific categories of personal data listed below (e.g. personal details, contact data, data relating to training completed, data relating to previous work experience, data relating to salary, etc.);
  • data that reveals political opinions, religious or philosophical beliefs;
  • data the reveals racial or ethnic origin or in connection with a person’s sex life.

If the Curriculum Vitae (hereinafter the “CV”) obtained by the Controller should in any case contain data coming under these categories or other types of data (e.g. the applicant’s photograph), where it is impossible to separate the data in order to assess professional aptitude, the Controller will process such but only if the applicant has given due consent to such.

Purpose and legal basis of the processing. Legitimate interests pursued

Data will be processed to verify the basis for hiring and/or starting a collaboration, to manage the selection procedures of collaborators and employees and to contact you using the contact data you supplied in order to schedule any interviews as may be necessary.

The data you supplied is collected and processed in connection with the specific search and selection process for which it was transmitted, as well as to assure future employment opportunities. Data processing for this purpose does not require your consent in accordance with Art. 6, letter b) of the GDPR insofar as it is necessary to execute the pre-contractual measures adopted on the request of the data subject and in connection with the data contained in the CV submitted spontaneously to potentially establish a contract of employment/collaboration.

This processing is also supported by the legal basis envisaged by Art. 6, paragraph 1, letter f) of the GDPR, in accordance with which, over time, the Controller may have a legitimate interest in performing such processing, even without your consent.

Processing methods

Your Data is processed using both paper and computerized means through the collection, recording, organization, storage, consultation, elaboration, modification, selection, extraction, comparison, use, interconnection, blocking, communication erasure and destruction of the Data.

Conferral of data and consequences of non-conferral

The conferral of the Data for the purposes of this disclosure may take place following the receipt, by post, e-mail, direct delivery, web form or any other means of communication, of information about work experience and education of the applicant, given on the CV.

CVs may be received following spontaneous submission or in response to a staff search and selection notice. Additional personal data may be collected subsequently from the data subject during the personal interview as part of the selection process.

Conferral of the Data for the purpose of this disclosure is optional. However, failure to confer such would make it impossible to verify the basis for hiring and/or starting a collaboration and, therefore, to establish a contract of employment with the Controller.

Addressees or categories of addressees

Data may be made accessible, disclosed or communicated to the following subjects, who will be appointed by the Controller, as applicable, as processors, in charge of processing or system administrators:

• companies of the group of which the Controller is a member (parent companies, subsidiaries and associates), employees and/or collaborators in any form of the Controller and/or of companies of the group of which the Controller is a member;

• public or private natural persons or legal entities used by the Controller to carry out the activities instrumental to achieving the above purpose or to which the Controller is obliged to disclose the Data under legal or contractual obligations.

The Data collected will not be disseminated.

Data transfers to third countries

The Data will be circulated within EU Member States. Data may also be disclosed to subsidiaries of the group of which the Controller is a member, or to companies with which the Controller entertains commercial relations, situated in countries outside the European Union. To ensure a suitable level of protection of the Personal Data, transfers will take place following adequacy decisions approved by the European Commission or the adoption of Standard Contractual Clauses prepared by the European Commission.

In the absence of an adequacy decision or appropriate safeguards pursuant to Art. 46 of the GDPR, the transfer will only be made if it is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject’s request; (Art. 49, paragraph 1, letter b).

Storage period

Data will be stored in the management systems used by the Controller for three years following collection. Once this deadline has passed, your data will be erased.

If the selection process should be successful, your Data will be processed by the Controller in the manner indicated in the privacy disclosure prepared for employees and collaborators.

Rights of the data subject

Data subjects have the rights set out in Articles 15 to 20 of the GDPR. In accordance with these provisions, each data subject has the right:

1. to obtain confirmation as to whether or not personal data concerning him/her exists, regardless of whether or not it has been recorded, and to communication of such data in intelligible form;
2. to obtain indication and, if applicable, a copy: a) of the source and category of the personal data; b) of the logic applied in the event of processing using electronic tools; c) of the purpose and manner of processing; d) of details identifying the controller and processors; e) of the subjects or categories of subjects to whom personal data may be disclosed or that may become aware of such, particularly if the recipients are in third countries or are international organizations; f) where possible, of the data storage period or of the criteria used to determine such period; g) of the existence of any automated decision-making processes, including profiling and, in this case, the logic applied, the importance and consequences envisaged for the data subject; and h) of the existence of appropriate safeguards in the case of data transfer to a non-EU country or international organization;
3. to obtain, without undue delay, the updating and rectification of inexact data or, where interested therein, the integration of incomplete data;
4. to obtain the erasure, anonymization or blocking of data: a) processed unlawfully; b) no longer necessary in connection with the purposes for which it was collected or subsequently processed; c) in the event of revocation of the consent on which processing was based and if there is no other legal basis; d) if you should object to processing and there is no legitimate prevalent reason to continue with the processing; e) in the event of fulfillment of a legal obligation; and f) in the case of data relating to children. The Controller may refuse erasure only in the event of: a) exercise of the right of freedom of expression and information; b) fulfillment of a legal obligation, execution of a task carried out in the public interests or exercise of public powers; c) reasons of public health interest; d) archiving in the public interests, scientific or historical research or statistical purposes; and e) exercise of a right in a court of law;
5. to obtain the restriction of processing in the case of: a) dispute of the exactness of the personal data; b) unlawful processing of the Controller to prevent its erasure; c) exercise of your right in a court of law; and d) verification of any prevalence of the legitimate reasons of the Controller with respect to those of the data subject;
6. to receive, if processing is carried out using automatic means, without impediment and in a structured, commonly used and readable format, the personal data regarding you, to send it to another controller, or – if technically feasible – to obtain the direct transmission thereof by the Controller to another controller;
7. to object entirely or partially: a) on legitimate grounds, to the processing of personal data concerning him/herself, even if relevant to the purpose of the collection; b) to the processing of his/her personal data where it is carried out for the purpose of sending advertising materials or direct selling or else for the performance of market or commercial communication surveys, by means of the use of automated calling systems without the intervention of an operator by e-mail and/or using traditional marketing methods by telephone and/or post.
8. to make a complaint to the Data Protection Authority.

In the above cases, where necessary, the Controller will notify the third parties to whom your personal data is disclosed or any exercise of rights by you, with the exception of specific cases (e.g. when such fulfillment proves to be impossible or entails a manifestly disproportionate use of means with respect to the right protected).

How to exercise rights

You can exercise the above rights at any time:

• by sending a request via registered mail to the Controller’s address;
• by e-mailing privacy@ecospray.eu.