Information on the processing of personal data
for the selection and hiring of personnel
This information is provided by Veritas spa, in accordance with the provisions of Art. 13 and Art. 14 of EU Regulation No. 679/2016 (General Data Protection Regulation, hereinafter GDPR).
1. Identity and contact details
- data controller of personal data
Veritas spa, with registered office in Santa Croce, 489 – 30135 Venice (VE) - data protection officer (DPO)
contactable at the registered office in Santa Croce 489, 30135 Venice (VE)
e-mail rpd@gruppoveritas.it
pec rpd@cert.gruppoveritas.it
2. Types of personal data collected
The Personal Data collected refers to the information contained in the Curriculum Vitae.
Information may also be collected from a reference check (if conducted) of the candidate, such as membership in any institution, academic background, work history, and other information relevant to determine the candidate's suitability.
Information and images of the candidate may be collected from professional social networks, databases, web registers or publicly accessible multimedia archives, from notes taken during interviews, and from comments from other subjects such as referees.
Personal Data may be updated based on publicly available information and/or collected from third parties and/or directly from the candidate.
The Personal Data to be acquired will not concern racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, or information relating to health, sexual life, or sexual orientation (hereinafter “Special Categories of Data”), unless these are characteristics affecting the methods of performing the work activity, or constitute an essential and determining requirement for performing it. In such case, Veritas will process the Special Categories of Data within the limits provided by applicable laws and by measures issued by the Authority (Art. 9, paragraph 2, letters b) and f) GDPR).
Personal Data and Special Categories of personal data are hereinafter jointly referred to as “Data”.
3. Purposes of Processing and Legal Basis
- The collection and processing of Data are necessary for the performance of pre-contractual measures and are carried out for purposes connected and/or instrumental to the personnel search and selection activity.
Processing basis: execution of pre-contractual measures adopted at the candidate's request pursuant to Art. 6, first paragraph, letter b) of the GDPR.
Providing the Data for this purpose is mandatory because otherwise Veritas will be unable to carry out the personnel search and selection process and consequently unable to establish the potential employment relationship.
- Veritas will process the Data to verify that the information provided by the candidate is truthful. For this activity, Veritas may also process public information contained in professional social network profiles, databases, web registers, or publicly accessible multimedia archives.
It is specified that this processing will be limited to information related to professional aptitude for work and, in any case, limited to what is strictly necessary for the activity the candidate will have to perform.
Processing basis: the legitimate interest of the Company pursuant to Art. 6, first paragraph, letter f) of the GDPR to ensure the proper conduct of the personnel search and selection process.
- Data will be processed for purposes related to obligations provided by laws, regulations, or European legislation, by provisions/requests of authorities legally entitled to do so and/or supervisory and control bodies.
Processing basis: compliance with a legal obligation to which the Company is subject pursuant to Art. 6, first paragraph, letter c) of the GDPR. Providing the aforementioned data for this purpose is mandatory because otherwise Veritas will be unable to comply with specific legal obligations and consequently unable to carry out the personnel search and selection process and establish the potential employment relationship with you.
- Finally, Data may be processed for purposes related to the defense of rights in judicial, administrative, or out-of-court proceedings, and in disputes arising in relation to the personnel search and selection process.
In addition, Data may be processed by Veritas to take legal action or to make claims against the candidate or third parties.
Processing basis: the legitimate interest of Veritas pursuant to Art. 6, first paragraph, letter f) of the GDPR to protect its rights. In this case, no new and specific provision is required, as Veritas will pursue this additional purpose, if necessary, by processing the Data collected for the above purposes, considered compatible with this one.
4. Possible recipients or categories of recipients of personal data
Data may be accessed by Veritas personnel and duly authorized Group company staff, as well as external providers, appointed, if necessary, as data processors, who provide support for service delivery.
Veritas can be contacted using the methods provided in point 1 of this information “Identity and contact details” if you wish to request the list of data processors and other subjects to whom the data are communicated.
5. Methods of data processing and retention period
Data processing will be based on the principles of fairness, lawfulness, and transparency and may also be carried out through automated methods suitable to store, manage, and transmit them. Processing will be carried out using tools suitable to ensure security and confidentiality, also through procedures designed to prevent the risk of loss, unauthorized access, unlawful use, and dissemination.
Data will be kept only for the period necessary for the personnel selection purposes (for a specific position or also for future positions of potential interest). Veritas provides for periodic verification of Data and the possibility to delete it if no longer necessary for the intended purposes.
In any case, Data will be stored in company databases for a period not exceeding 3 years from the acquisition date. If a list of suitable candidates is prepared after the selection, the data retention period will coincide with the validity period of the list; the validity period of the list will be indicated in the selection notices. After this retention period, Data will be deleted or anonymized.
With particular reference to authority requests or legal obligations, or in case of defending Veritas’ rights in court, as per letters C) and D) of point 3, Data will be kept for the time necessary to fulfill the request or to pursue the protection of its rights.
6. Rights of the data subject
Please note that the data subject has the right to exercise the following rights: (i) request access to personal data from the data controller and the correction or deletion of such data or the restriction of processing concerning them, or to object to their processing; (ii) request data portability from the controller, as provided by Art. 20 of the GDPR; (iii) lodge a complaint with the competent supervisory authority (e.g., in the Member State where the data subject usually resides, works, or where the alleged violation occurred), as provided by Art. 77 of the GDPR, without prejudice to any other administrative or judicial remedy.
7. Possible existence of automated decision-making, including profiling
There is no automated decision-making process and no profiling activities are planned.
8. Data transfer to a non-EU country
Data will be processed mainly within the European Economic Area (EEA). However, the use of certain tools by the Company may entail, even if only marginally, a transfer of Data to subjects established in countries that do not belong to the European Union (EU) or the EEA (hereinafter, the “Third Countries”). Such transfer, in any case, is carried out in compliance with the provisions of Chapter V of the GDPR.