Information on the processing of personal data – Candidates (Recruiting)
Pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”), Dallara provides candidates who submit their applications with the following information on the processing of personal data.
For the purposes of recruiting and selecting resources, Dallara Group Srl also operates on behalf of the Dallara Group companies mentioned above. Therefore, in the case of applications for open positions at a specific Group company, the data controllers will be Dallara Group Srl and the Group company concerned by the application. This privacy policy informs you about the categories of personal data we collect, the purposes for which we use them and how we process your data when you apply for a job with us.
Joint Controllers
The Joint Controllers are:
- Dallara Group Srl, with registered office in Varano de' Melegari (PR), Via Provinciale, no. 33, Italy
- Dallara Automobili Spa, with registered office in Varano de' Melegari (PR), Via Provinciale, no. 33, Italy
- Fabbrica Dallara Srl, with registered office in Varano de' Melegari (PR), Via Marconi, no. 18, Italy
- Dallara Compositi Srl, with registered office in Stradella di Collecchio (PR), Via Primo Levi, no. 6, Italy.
They can also be contacted by sending an email to privacy@dallara.it (together referred to as the “Joint Controllers” or “Dallara”).
In fact, for the purposes of recruiting and selecting resources, Dallara Group Srl operates not only for its own open positions, but also for open positions at companies within the Dallara Group, including Dallara Automobili Spa, Fabbrica Dallara Srl and Dallara Compositi Srl. Therefore, in these cases, the data controllers will be both Dallara Group Srl and the Dallara Group company for which the application is submitted/evaluated.
Type of data processed
As part of its personnel selection activities, Dallara processes the personal data provided by candidates through:
- the completion of application forms available on company websites or dedicated portals;
- the submission of a curriculum vitae;
- any communications sent by the candidate;
- the registration and creation of a personal account on the application management portal.
In particular, the following categories of data may be processed:
- identification data (name, surname);
- contact details (e-mail, telephone number);
- data relating to educational and professional background;
- information contained in the curriculum vitae or attachments sent by the candidate;
- data relating to the management of the candidate's account on the recruitment portal.
Curriculum vitae and information entered by candidates are managed through the Ncore application management platform, which allows candidates to create their own personal account.
Candidates are advised not to include specific data in their CVs pursuant to Article 9 of the GDPR (for example data relating to health, religious or political beliefs), unless this is strictly necessary for the application.
Purpose and legal basis
Candidates' personal data is processed for the following purposes:
1. Management of applications and selection activities
- evaluation of applications received;
- management of the recruitment process;
- contact with candidates;
- organization of interviews and selection activities.
Legal basis: Article 6, paragraph 1, point b) GDPR – implementation of pre-contractual measures taken at the request of the data subject.
2. Management of candidate accounts
A personal account is only created if the candidate selects the “Remember me” option during the application process. In this case, the system allows the login details to be stored and the applications submitted to be viewed, modified and updated later.
The creation of an account is optional and is intended to simplify the management of applications by the data subject.
The data may be processed to allow candidates to:
- register on the recruitment portal;
- create and manage their personal account;
- update their data and submitted applications.
Legal basis: Article 6, paragraph 1, point b) GDPR.
3. Improvement of selection processes and statistical analysis
Data may also be processed for internal statistical analysis and sector analysis relating to recruitment processes and labor market trends.
During the analysis phase, such analyses are carried out exclusively on aggregated data and do not allow for the identification of candidates.
Legal basis: Article 6, paragraph 1, point f) GDPR – legitimate interest of the data controller in improving organizational and selection processes.
Nature of data provision
Any data subsequently requested by Dallara is used to assess suitability for recruitment and/or to start working with the company and it is provided on a voluntary basis. The provision of data is optional but necessary to allow the application to be assessed; failure to provide data will make it impossible to proceed with the selection process.
Automated decision-making processes
Dallara does not use decision-making processes based solely on automated processing, including profiling, which produce legal effects on candidates.
Methods
The processing of personal data sent will be based on principles of correctness, lawfulness and transparency, protecting the confidentiality and rights of the data subject. The data is processed using IT tools and, where necessary, paper forms, by authorized and suitably trained personnel.
Data Communication
Any communication to third parties is only intended for the purpose of carrying out selection and evaluation activities related to job offers and the possible establishment of an employment relationship. Where necessary, these parties operate as Data Processors pursuant to Article 28 of the GDPR.
Please note that Dallara Group Srl also operates on behalf of companies in the Dallara Group, including Dallara Automobili Spa, Fabbrica Dallara Srl and Dallara Compositi Srl; therefore, data may also be shared with these companies in the Dallara Group. The data collected will not be disclosed.
Retention periods
Candidates' personal data will be retained for the time necessary to manage the application and, in any case, for a maximum period of 36 months from the date of collection, unless further retention is required by applicable law or the data subject updates their application.
Rights of the data subject
Pursuant to Articles 15-22 of Regulation (EU) 2016/679 (“GDPR”), data subjects may exercise their rights under personal data protection legislation at any time. In particular, they have the right to obtain confirmation of the existence or otherwise of personal data concerning them and, if so, to access their data and receive information on its processing. Data subjects may also request the rectification of inaccurate data or the integration of incomplete data, the erasure of data in the cases provided for by law, and the restriction of processing where the conditions are met.
In the cases provided by the GDPR, data subjects also have the right to receive personal data concerning them in a structured, commonly used and machine-readable format and to transmit it to another data controller (right to data portability), as well as to object to the processing of personal data concerning them.
To exercise their rights or to receive further information on the processing of personal data, data subjects may contact the Joint Controllers by writing to the e-mail address privacy@dallara.it.
Furthermore, the data subject retains the right to lodge a complaint with the Data Protection Authority, pursuant to Article 77 of the GDPR, if they believe that the processing of their personal data violates applicable legislation.
Changes to this policy
Dallara may change this privacy policy at any time. Any material changes to this privacy policy will be posted on the official channels used to collect applications and, where appropriate, communicated through other channels.