Data Processing Notice for Employment Relationships

INFORMATION ON PERSONAL DATA PROCESSING

Dear Sir/Madam,

We need to process information concerning you, your personal data, for the purposes set forth below; therefore, as required by European data protection law (European Regulation 679/2016), we provide you with the following information.

  1. Data Controller and Data Protection Officer.

The Data Controller, i.e. the entity responsible for decisions regarding the purposes, methods and security of personal data, is Ciancaleoni S.r.l. VAT IT 261620546, headquartered at via della Meccanica 2/4, – 06038 Spello (PG) – Tel. 0742/301626 emailinfo@ciancaleoni.com, represented by its current legal representative.

  1. Purposes, Legal Bases and Exemptions for Processing.

The personal data you provide and that will be collected as part of our employment relationship will be processed in compliance with the lawfulness requirements indicated below:

Purposes

(Why we process your data)

Legal Basis

(On which legal provision we process them)

Consequences in case of refusal to process

(What happens if you refuse to provide your personal data and/or to authorize processing)

For the fulfillment of obligations related to the initiation, management and termination of the employment relationship, including the payment of salaries, allowances, bonuses, other remuneration, perks or additional benefits.

Art. 6, Paragraph 1, Letter b) GDPR

(Processing is necessary for the performance of a contract to which the data subject is a party).

Consent is not required, in case of refusal to provide the data it will not be possible to proceed with the employment relationship.

For the application of the legislation on social security and assistance, including supplementary assistance, on hygiene and safety at work, as well as on tax, trade union and health protection matters. For the recognition of benefits or the provision of contributions.

Art. 6, Par. 1, Lett. c) GDPR

(the processing is necessary to fulfill a legal obligation to which the data controller is subject).

As regards specific data

Art. 9, Par. 2, Lett. b) GDPR.

Provision no. 146/2019

(processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject).

To ensure the safety of buildings and those who work there, such as access and exit data.

To fulfill obligations arising from insurance contracts aimed at covering risks connected to the employer’s liability in matters of health and safety at work and occupational diseases or for damages caused to third parties in the exercise of work or professional activity.

To pursue the legitimate interests of the owner in ensuring the functioning of the information system, limited to:

network traffic data;

data contained in electronic instruments when maintenance is required.

Art. 6, Par. 1, Lett. f) GDPR

(processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data).

Consent is not required. In the event of your refusal to provide the data, it will not be possible to proceed with the employment relationship to the extent that your duties require the use of electronic tools or presence in video-surveillance areas..

For the promotion of the institution in information materials regarding images taken during events and/or demonstrations and/or promotional installations.

Art. 6, Par. 1, Lett. a) GDPR

(the interested party has expressed consent to the processing of his/her personal data for one or more specific purposes).

In the absence of your consent, the data will not be processed.

To respond to requests from Judicial Authorities (for example, statements made to the magistrate regarding seizures of one fifth of the salary).

Art. 6, Par. 1, Lett. c) GDPR

(the processing is necessary to fulfill a legal obligation to which the data controller is subject).

Consent is not required, in case of refusal to provide the data it will not be possible to proceed with the employment relationship.

  1. Recipients and Categories of Processed Data.

The personal data you provide or acquire during the performance of services will be processed exclusively by duly authorized personnel or by designated data processors.

Your data may be disclosed to the following recipients:

Recipients

Data Category

Purposes

For the application of the legislation on social security and assistance, including supplementary assistance, on hygiene and safety at work, as well as on tax, trade union and health protection matters.

Identification data, economic data, data relating to the employment relationship, data relating to health.

INPS, INAIL

For payroll processing.

Identification data, data relating to the employment relationship, economic data, presence and absences.

Payroll processing office (in the role of data controller).

  1. International Data Transfer

Your personal data are not transferred outside the European Union.

  1. Retention Period of Personal Data and Criteria Used

Except in cases of interruption or suspension (e.g. in case of litigation), contracts and related documentation will be retained for ten years from the termination of the contract; payroll data will be kept for six months from the date of issuance of the pay slip.

  1. Data Subject Rights

You have the right to obtain from the Data Controller, where applicable, access to your personal data and the rectification or erasure of such data or the restriction of processing concerning you, or to object to processing (Articles 15 et seq. of the Regulation). The appropriate request, accompanied by a copy of an identification document, should be submitted to the Data Controller using the contact details provided above.

  1. Right to Lodge a Complaint

If you believe that the processing of your personal data by the Data Controller violates the Regulation, you have the right to lodge a complaint with the Supervisory Authority (Art. 77 of the Regulation) or to take legal action (Art. 79 of the Regulation).

  1. Collaboration

The protection of your data and compliance with legal principles, particularly the principle of transparency, are of utmost importance to us; we would appreciate it if you could inform us of any misunderstandings in this document or suggest improvements by contacting the Data Controller as indicated.

CONSENT TO DATA PROCESSING

Having read the notice above, I hereby freely express my consent by checking the corresponding box below. In the absence of any selection, or if contradictory options are provided, consent is deemed to be denied.

To promote the company in informational materials regarding images taken during events, exhibitions and/or promotional setups.

  I CONSENT

  I DO NOT CONSENT

For fulfilling specific requests, such as union deductions.

  I CONSENT

  I DO NOT CONSENT

PLACE the……       Signature