Privacy notice on the processing of job applicants’ personal data – recruitment
Informativa/CAND.Rev. 00 of 07/04/26

Privacy notice for job applicants

pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

Pursuant to Article 13 of Regulation (EU) 2016/679 and in order to protect your right to the protection of personal data, GIFRAB Italia SpA wishes to provide you with the following information.

Data Controller

GIFRAB Italia SpA, with registered office at Via Marco D’Agrate 41, 20139 Milan (MI), Italy, VAT No. 04836890824, is the Data Controller.

Email: info@gifrab.it – Certified email (PEC): gifrabitalia@legalmail.it

Data Protection Officer: rpd@gifrab.it

Purposes of processing

Personal data is processed as part of the recruitment process aimed at identifying people to join the Controller’s workforce; the data contained in your curriculum vitae and in any subsequent communications will therefore be processed solely for the purpose of assessing your application.

Legal basis for processing

For ordinary personal data, the legal basis for processing is Article 6(1)(b) of the GDPR (processing is necessary to take pre-contractual steps at the Data Subject’s request), Article 6(1)(c) (processing is necessary for compliance with a legal obligation to which the Controller is subject) and Article 6(1)(f) (the legitimate interest of GIFRAB Italia SpA in recruiting and selecting staff).

For special categories of data, the legal basis is Article 9(2)(b) of the GDPR (processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the Controller or of the Data Subject in the field of employment and social security and social protection law, in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject), Article 9(2)(h) (processing is necessary for the purposes of preventive or occupational medicine) and Article 9(2)(f) (processing is necessary for the establishment, exercise or defence of legal claims).

Types of data processed

In order to recruit staff and assess candidates’ requirements, GIFRAB Italia SpA may process the following categories of data:

  • first name, surname, gender, tax code, photograph where included in the curriculum vitae, home address and telephone number, place and date of birth, email address and other contact details, educational qualifications and/or professional certifications where required for the role, residence permit where applicable, and other personal identification details;
  • data contained in the curriculum vitae submitted or provided directly during the assessment interview.

The following special categories of data will also be processed (meaning, pursuant to Article 9(1) of the GDPR, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation):

  • data concerning health, such as health data strictly necessary for recruitment (including, where necessary, the results of the pre-employment medical examination carried out by the company doctor) or data relating to membership of certain protected categories;
  • other special categories of data whose processing is necessary for performing the role.

Whether provision of data is mandatory and consent

Providing the requested data is optional; however, failure to provide it will make it impossible for the Data Subject to take part in the recruitment process carried out by the Controller.

Processing methods

Your personal data will be processed manually and by computer, including with the aid of electronic or otherwise automated means, in the manner and to the extent necessary to pursue the above purposes, and with the technical measures required by Article 32 of the GDPR (Regulation (EU) 2016/679).

Processing will be carried out directly by the Controller’s organisation, with the assistance of staff specifically authorised for this purpose and of any external processors appointed, where necessary, for specific operations.

Your personal data is protected by security measures designed to limit access to authorised professionals and the Controller’s authorised staff only, and only for the functions within their remit. Further security measures are applied to all your personal data to ensure data integrity, daily backups and recovery in the event of incidents or failures of the processing systems.

Recipients of personal data

Without prejudice to disclosures made in fulfilment of legal and contractual obligations, all data collected and processed may be disclosed, solely for the purposes specified above, to external consultants working for the Controller in the staff assessment and recruitment process.

Your personal data will not be disseminated.

Place of processing and data transfers

Processing takes place at the Controller’s registered office stated above and at the premises of the third parties identified.

Personal data is not transferred outside the European Union. In any case, should it become necessary, the Controller may also transfer personal data to non-EU countries, and undertakes that any such transfer will take place in compliance with the law and in particular with the provisions of Article 46 of the GDPR.

Retention period

The data will be kept by the Controller for a maximum of 12 months from collection, unless an employment and/or collaboration relationship is established. After that period, the data will be permanently deleted.

In the event of legal disputes, where it is necessary to defend, bring or assert claims against you or third parties, the Controller may keep the personal data it reasonably considers necessary for those purposes, for as long as such a claim may be pursued and in any event within any maximum periods laid down by law.

What are your rights?

As a Data Subject, you have the rights provided for by Articles 15 to 22 of Regulation (EU) 2016/679. In particular, you have the right to obtain at any time:

  • access and confirmation: confirmation as to whether or not personal data concerning you exists and its communication in an intelligible form, together with information on its source, the purposes and methods of processing and the logic applied where electronic means are used;
  • identity of the Controller: the identification details of the Controller, the Processors and the persons or categories of persons to whom the data may be disclosed;
  • rectification and completion: the updating, rectification or, where you have an interest, completion of your data;
  • erasure and right to be forgotten: the erasure (right to be forgotten), anonymisation or blocking of data processed unlawfully or no longer necessary for the purposes for which it was collected;
  • restriction of processing: the right to restrict the processing of data in the event of a dispute or in the cases provided for by Article 18 of Regulation (EU) 2016/679;
  • data portability: the right to receive your data in a structured, commonly used and machine-readable format in order to transmit it to another Controller;
  • objection: the right to object, in whole or in part, on legitimate grounds to the processing of data concerning you;
  • complaint: the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) if you believe that the processing infringes the legislation in force.