CANDIDATE PRIVACY POLICY PURSUANT TO THE FEDERAL ACT ON DATA PROTECTION OF 25 SEPTEMBER 2020 ("FADP"), ITS EXECUTING ORDINANCE OF 31 AUGUST 2022 ("SDPO") AND REGULATION (EU) 2016/679 (“GDPR”)
DATA CONTROLLER
CSC costruzioni S.A.
- Via Pioda 5, CP 5400 – CH6900 Lugano
Email address: hr.privacy@csc-sa.ch
PERSONAL DATA PROCESSED
The Data Controller processes the personal data (hereinafter “Personal Data” or “Data”) communicated by the Candidate or collected by the Data Controller on submission of his or her Curriculum Vitae (“CV”)/cover letter; following registration of his or her application within the Data Controller’s systems in the appropriate section of the Company’s website; and following data acquisition in the initial selection interview, through completion of the “Information Questionnaire” and the “Statements during the selection process”, required by the Data Controller’s selection procedures and, where lawful, provided by third parties. This is Personal Data referring to the Candidate or his/her family, in the cases provided for by law, which may consist of:
Common Data:
- identification data such as: personal details and gender, contact details (email address, phone/mobile number, residential/domicile address), and valid identification document (identity card, passport, driving license) etc.;
- data contained in the Candidate's CV/cover letter, relating to previous work experience (qualifications/certifications held, language skills, roles held, position, type of contract, educational/professional training, professional assessments/observations, etc.);
- assessment information collected during interviews and/or provided by third parties;
- salary and grading information relating to previous work experience;
- information on the receipt of income support benefits in the event of unemployment (unemployment benefit, income support, etc.).
Judicial Data:
- information referred to in the criminal record certificate, when required/permitted by the applicable legislation;
- data, when required and permitted by the law, arising from inclusion on Reference Lists (Lists of persons, groups or entities subject to financial sanctions or restrictive measures or Lists of persons related to international terrorism, compiled by the OFAC – Office of Foreign Assets Controls, the UN and the European Union).
Special Data:
- health information (medical certificates, requests for verification of fitness for certain work activities, belonging to any protected categories, etc.).
Other Data:
- data relating to conflicts of interest, concerning the Candidate and/or family members, as a result of family relationships and/or previous roles in Public Authorities or in the Company or in the Group of the Data Controller.
Any Special Data, not necessary for the purposes of the selection process, contained in the Candidate's CV or provided to the Company by the Candidate, including through the forms required by the selection procedures or by Third Parties, will be immediately deleted and will not be processed.
It is expressly understood that, with respect to the personal data provided by the Candidate concerning family members, the Data Controller assumes that this privacy policy has been brought to the attention of these Data Subjects by the Candidate.
The category in which the Personal Data falls will determine the processing of the Data by the Company in accordance with the Regulation.
Nevertheless, the Data Controller shall ensure that the processing of the Data will be based on the principles of fairness, lawfulness and transparency, as well as the protection of the Candidate's privacy and rights.
DETAILS OF DATA TREATMENT (3 SECTIONS)
1ST TREATMENT – PURPOSE OF PROCESSING
Performance of the agreement and/or fulfilment of pre-contractual commitments, in particular:
- for the smooth running of the selection process (e.g. application management);
- to allow application for a specific job post;
- to use the Candidate profile for job posts other than those for which the Candidate applied where the job post is suitable and compatible with the job search;
- for the establishment of the employment relationship.
1ST TREATMENT – LEGAL BASIS OF PROCESSING
The FADP and SDPO do not require a legal basis for processing of Personal Data. In general, prospective or existing employers can process Personal Data based on article 328b of the Swiss Code of Obligations.
To the extent the GDPR is applicable, the following takes effect:
In the selection stage, for speculative applications or for a specific job offer (Art. 6, par. 1(b) of the GDPR).
During the performance of an agreement to which the Data Subject is party (Art. 6, par. 1(b) of the GDPR); compliance with employment, social security and social protection legislation (Art. 9.2(b) of the GDPR).
1ST TREATMENT – DATA RETENTION PERIOD
Retention for the time necessary to carry out the selection procedures and, if successful, for the duration of the employment relationship.
In particular: during the selection stage, and only if the retention of data is required to complete the selection process or to protect the rights of the Data Controller, for a maximum period of 2 years from the date of sending of the documents/data relating to: CVs, interviews, information gathered during interviews, selection results, judicial records, pending charges; in the case of the establishment of an employment relationship, to the extent and as required by law, for the protection of the employees or the employer's rights, for 10 years after its termination with regard to documents/data relating to: employment contracts, personal files, attendance/absence records, travel, career management, emergency/contact information, etc.
2ND TREATMENT – PURPOSE OF PROCESSING
Pursuit of a legitimate interest of the Data Controller and/or Third Parties, in particular: for the prevention and suppression of unlawful acts, as well as for the protection of the rights of the Data Controller.
2ND TREATMENT – LEGAL BASIS OF PROCESSING
The FADP and SDPO do not require a legal basis for processing of Personal Data. In general, prospective or existing employers can process Personal Data based on article 328b of the Swiss Code of Obligations.
To the extent the GDPR is applicable, the following takes effect:
The legitimate interest of CSC to not suffer damage as a result of the unlawful conduct of others and the need to ensure full compliance with the Data Controller’s obligations regarding the protection of persons and property on and off its premises (Art. 6, par. 1(f) of the GDPR).
2ND TREATMENT – DATA RETENTION PERIOD
Retention for the time necessary to carry out the selection procedures and, if successful, for the duration of the employment relationship.
In particular: during the selection stage, and only if the retention of data is required to complete the selection process or to protect the rights of the Data Controller, for a maximum period of 2 years from the date of sending of the documents/data relating to: CVs, interviews, information gathered during interviews, selection results, judicial records, pending charges; in the case of the establishment of an employment relationship, to the extent and as required by law, for the protection of the employees or the employer's rights, for 10 years after its termination with regard to documents/data relating to: employment contracts, personal files, attendance/absence records, travel, career management, emergency/contact information, etc.
3RD TREATMENT – PURPOSE OF PROCESSING
Pursuit of the legitimate interest of the Data Controller and/or Third Parties, in particular: in court, where it is recognised that the interests of the Data Controller override the interests of the individual Data Subject.
3RD TREATMENT – LEGAL BASIS OF PROCESSING
The FADP and SDPO do not require a legal basis for processing of Personal Data. In general, prospective or existing employers can process Personal Data based on article 328b of the Swiss Code of Obligations.
To the extent the GDPR is applicable, the following takes effect:
Legitimate interest of the Data Controller corresponding to the constitutionally guaranteed right of action pursuant to Art. 24 of the Constitution and Art. 6, par. 1(f) of the GDPR.
3RD TREATMENT – DATA RETENTION PERIOD
For the entire duration of the court proceedings, through to expiry of the time limits within which any appeal may be lodged.
The Data is processed electronically and in hard copy by means of data collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, collation, use, interconnection, blocking, communication, deletion and destruction operations.
COMPULSORY NATURE OF THE PROVISION OF DATA
The provision of Candidate Data for the purposes indicated above:
a) is necessary and mandatory: for the performance of the agreement and/or the fulfilment of pre-contractual obligations; for the pursuit of a legitimate interest of the Data Controller;
b) is subject to the consent of the Candidate, albeit on an optional basis: to verify the information provided for selection purposes (e.g. contact persons, previous Employers, family members, declared academic and professional qualifications, references from previous/current Employers, etc.).
For the purposes referred to in point a), it shall be understood that refusal of consent by the Candidate will result in the Data Controller being unable to proceed with the selection process.
For the purposes referred to in point b), it shall be understood that:
- the Candidate will be responsible for getting prior consent from the contact persons indicated by them to communicate their contact details to the Data Controller;
- if the Candidate does not provide consent (“refusal”), the Data Controller will not be able to ask for references.
DATA PROCESSORS
Candidate Data may be processed by employees and/or contractors of the Data Controller (e.g. personnel of the HR Department and other departments from time to time involved in the selection process), who are appointed to pursue the above-mentioned purposes, in their capacity as Appointed Data Processors and/or In-House Processors and/or System Administrators, who have received appropriate operating instructions pursuant to Art. 29 GDPR and as required by the FADP.
DATA RECIPIENTS
The Data provided may also be processed by:
- Group Companies and Third Parties (e.g. payroll and employment consultants, healthcare bodies, comprehensive healthcare and pension funds, including company funds, banking institutions, intermediary agencies and administrative practices, website management providers, etc.) who perform outsourced activities on behalf of the Data Controller and will process the Data in their capacity as External Data Processors;
- Partners and/or customers of the Data Controller, where appropriate, for the purposes of the selection process.
Personal Data may be disclosed, without the prior consent of the Candidate, for the purposes set out above to: Public Authorities, the Ministry of Finance, the Revenue Agency, Ministerial Bodies and Competent Authorities, Local Authorities, Provincial and Regional Tax Commissions, Pension and Welfare Funds, Local Health Authorities, Trade Union Associations and Representatives, Universities/Promoters participating in placements and Credit Institutions, Selection Companies and/or Employment Agencies, and Law Firms that will, at their request, process the Data as independent Data Controllers.
TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN UNION
The Data will not be disseminated but may be transferred, for the above purposes, to non-EU countries worldwide. In order to ensure an adequate level of protection of Personal Data, the transfer will take place in accordance with the approved adequacy decisions of the Federal Council pursuant to article 16 para 1 FADP or the adoption by the Data Controller of the Standard Contractual Clauses prepared by the European Commission and provided for in Art. 46, par. 2(c) of the GDPR, including relevant local law amendments for their applicability in Switzerland, or where there are other appropriate safeguards, in Articles 46 and 49 of the GDPR and Article 16 of the FADP. The list of third countries to which the Data is transferred and more information on the safeguards taken to protect Personal Data are available at the offices of the Data Controller or on request using the contact details indicated below.
DATA SUBJECT RIGHTS - COMPLAINTS TO THE SUPERVISORY AUTHORITY
If there is a failure to comply with the statutory restrictions at any time, the Data Subject can assert his/her rights by contacting the Privacy Office in the following ways:
- by sending an email to hr.privacy@cscsa.ch;
- by sending a recorded delivery letter with advice of delivery to the address of the Data Controller;
Data Subjects can ask CSC for:
- access to personal data concerning them;
- updating, the correction of inaccurate data, and the supplementation of any incomplete data, including by providing a supplementary statement;
- the deletion, conversion or blocking of the data;
- the restriction of processing in the cases provided for in Art. 18 of the GDPR as applicable or as provided for under the FADP;
- objection to the processing of the Data, for reasons connected to their specific situation, in cases of legitimate interest of the Data Controller.
In addition, the Data Subject may obtain information on and, where appropriate, copies of: a) the origin and category of the Personal Data; b) the logic applied in the case of processing by electronic means; c) the purposes and methods of processing; d) the identification details of the Data Controller and the Data Processors; e) the persons or categories of persons to whom personal data may be disclosed or who may become aware of the data, in particular if they are recipients in third countries or international organisations; f) where possible, the data retention period or the criteria used to determine that period; g) the existence of an automated decision-making process, and in that case the approach used, the importance and the expected consequences for the Data Subject; and h) the existence of adequate safeguards in the event of Data being transferred to a non-EU country or to an international organisation.
Furthermore, if the processing is based on consent or on the contract and is performed by automated means, Data Subjects have the right to receive the Data in a structured, commonly used machine-readable format, as well as, if technically feasible, have them transmitted to another Data Controller without hindrance. ("Data Portability").
Data Subjects are entitled to submit a complaint to the competent Supervisory Authority (Data Protection Authority), which is in Switzerland the Federal Data Protection and Information Commissioner (FDPIC) and to the extent the GDPR is applicable in the Member State in which they normally live or work or the country in which the alleged infringement took place.
In the above cases, the Data Controller will inform the third parties to whom the Candidate's Personal Data is disclosed of any exercise of the Candidate's rights, except in specific cases (e.g. where this is found to be impossible or involves a disproportionate amount of effort to the protected right).
An up-to-date list of Data Processors and system administrators is held at the offices of the Data Controller.
