Privacy Policy
Privacy Policy statement on the processing of personal data concerning the receipt of Curriculum Vitae through the www.nutkao.com website, pursuant to Article 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR).
The Nutkao SRL company, with registered office in Canove di Govone in Via A. De Gasperi 2/RSTU 12040 (CN), Italy, which the user can contact to exercise the rights of Data Subjects, in its capacity as Data Controller, intends, with this Privacy Policy made pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, concerning the protection of natural persons with regard to the processing of personal data and the free circulation of such data, to provide information on the processing of personal data acquired from Data Subjects by sending spontaneous applications, as well as by filling out and submitting the form in the “Work with us” section of the www.nutkao.com website.
The processing of data, freely given by the user, is carried out in compliance with the criteria set out by current legislation on the protection of personal data and is based on the principles of correctness, lawfulness and transparency and protection of the privacy and rights of the data subjects.
1. Purpose of the data processing.
Personal data spontaneously communicated by the user, shall be processed by Nutkao SRL for the following purposes:
– management of search, personnel selection and business contacts;
– to exercise the Data Controller’s rights (for example the right to representation in court).
In cases where the Data Controller intends to process the data provided by the user for purposes other than those described above, they shall be required to inform the aspiring candidate of such additional purposes before carrying out the aforementioned data processing.
2. Data collection
The data shall be collected as a result of candidates sending their CVs to the www.nutkao.com website, as well as by filling out and submitting the appropriate form. The data collection only concerns common personal data, including the candidate’s photograph, accompanied by their professional profile, which shall be processed
within the limits strictly relevant to the obligations, duties and purposes referred to in point 1 above.
In the event that the CV, which the Nutkao SRL company comes into possession of, contains sensitive data, such data shall be processed only if it is considered relevant for the purposes of evaluating professional aptitude, to the extent that the acquisition of such information is strictly essential to the establishment of the collaboration.
3. Legal basis of the data processing.
The legal basis can be found in Article 6 paragraph 1 letters b and f of Regulation (EU) 2016/679: “the processing is necessary for the performance of a contract to which the Data Subject is party or for the execution of pre-contractual measures adopted at the request of the same” and “the processing is necessary for the pursuit of a legitimate interest of the data controller”. The nature of the provision of the personal data is optional. However, in case the candidate fails to send the data in question to the Data Controller, the latter shall not be able to proceed with the evaluation of the candidate’s profile.
The consent of the Data Subject is expressed by the completely voluntary provision of their CV in the dedicated section on the www.nutkao.com website.
In cases where the candidate sends his/her CV via the website, the Privacy Policy is immediately available on the Privacy Policy page and must be read and acknowledged before the CV is sent.
4. Data processing methods.
The personal data collected shall be stored and processed using electronic tools and shall be stored both on computer and paper supports, organised in a database, as well as on any other type of suitable support. Specific and adequate security measures are observed by the Data Controller, guaranteeing the confidentiality, availability and integrity of personal data in order to prevent loss, illicit or incorrect use and unauthorised access of the same data.
5. Duration of the data processing.
The personal data provided shall be stored in paper and computer archives, including in order to allow the identification and selection of the same data in aggregate form. For the purposes of managing these archives, compliance with all security measures and precautions that current legislation on privacy provides shall be guaranteed.
The Data Controller shall process the personal data for the time strictly necessary to fulfil the purposes for which the same data was collected and, in any case, for no more than 24 months from the collection for the purposes indicated, after which the CVs shall be deleted. The data processing shall, in any case, cease following the request for deletion by the Data Subject.
6. Dissemination of data.
The personal data collected shall not be disclosed. Indeterminate subjects shall, therefore, not be made aware of the data in any form, including by making it available or for consulting purposes.
The user’s personal data may be disclosed to the following categories of recipients:
– internal staff in charge of personnel selection;
– companies, associations or professional firms that provide services and activities on behalf of the Data Controller as Data Processors for the fulfilment of legal obligations, as well as for any organisational and administrative need necessary to provide the requested services;
– third-party companies or other subjects who carry out outsourcing activities on behalf of the Data Controller and which can also process the data through authorised subjects (e.g. recruiting companies). These subjects shall receive specific instructions and authorisations for the processing of the same data through a special agreement drawn up pursuant to Article 28 of the GDPR.
7.Transfer of data abroad or to international organisations.
The personal data of the Data Subjects, collected through the www.nutkao.com website shall not be transferred overseas or to international organisations.
8. Rights of the Data Subject.
In relation to the aforementioned processing of personal data, the Data Subject is entitled to exercise the rights referred to in Article 7 (Right of access to personal data and other rights) of Legislative Decree no. 196/2003 and those provided for by Regulation (EU) 2016/679, including, for example, to obtain information concerning:
– the source of the personal data;
– the purposes of and procedures involved in the processing of personal data;
– the logic applied in the event of data processing carried out with the aid of electronic or automated tools;
– the identifying details of the Data Controller, Data Processors and of the Representative designated pursuant to Article 5, paragraph 2 of Legislative Decree no. 196/2003.
The Data Subject shall have the right to obtain:
– the access, the updating, the rectification or, where he/she has an interest in this, addition of the data;
– the deletion, the transformation into anonymous form or the blocking of personal data processed unlawfully;
– the limitation of processing of the Data Subject’s personal data;
– the Data Subject may also request a copy of their personal data in standard format (Right to data portability).
– The Data Subject may oppose, for legitimate reasons, the processing of his/her personal data, even if pertinent to the aforementioned collection purposes;
– the processing of personal data for sending advertising material or for direct selling or for carrying out market research or commercial communications;
– the Data Subject has the right to withdraw their consent to the processing of their personal data, when this is based on the hypothesis provided for by Article 6, paragraph 1, letter a (when “the Data Subject has given consent to the processing of their personal data for one or more specific purposes”), or by article 9, paragraph 2, letter a (when “the data processing is necessary for the execution of a contract to which the Data Subject is party or for the execution of pre-contractual measures adopted at the request of the same”) of Regulation (EU) 2016/679, at any time and without prejudice to the lawfulness of the data processing, based on consent provided prior to the withdrawal thereof;
– in the event that the user considers that the processing concerning him/her violates current legislation in force, the Data Subject has the right to lodge a complaint with a Supervisory Authority, in particular in the Member State in which he/she habitually resides, works or in the place where the alleged violation took place.
9. Data Controller.
The Data Controller is Nutkao SRL, in the person of its legal representative. The Company can be contacted via email at privacy@nutkao.com.