Privacy Policy for candidates

ex Art. 13 and 14 Regulation (EU) 2016/679 (‘GDPR’)

This notice contains important information on the methods and purposes of the processing of your personal data by KeyPartners Italy S.r.l. (the “Controller”, “KeyPartners” or the “Company”) in its capacity as Data Controller.

Please read this document and make any requests for clarification and information about it via the contacts listed below.

 

1. The data controller and its contact details

KeyPartners is the Data Controller of the personal data referred to in this information notice:

Name: KeyPartners Italy S.r.l.

Registered office: Milan, Piazzale Biancamano n. 8, cap 20121.

VAT and tax code: 12115590965.

Email: italy@key-partners.com

Email of KeyPartners’ data protection officer: dpo@key-partners.com

 

2. Categories of data processed and source of data

The data processed may include, depending on what is necessary to achieve the purpose of the processing (see Section 3) and on the information you voluntarily provide, your name, surname, place and date of birth, tax code, residence, sex, telephone contact details, educational qualification, work experience and any further data you have included in your CV and/or otherwise communicated to the Controller.

We also inform you that the Data Controller may process “special categories of data” pursuant to Article 9 of the GDPR. This concerns, in particular, data that may reveal a state of health, such as belonging to protected categories, which may be contained in your CV or otherwise provided to the Company. Such data may be processed in order to assess the candidature for job positions falling within the scope of targeted employment. In the absence of such cases, as well as in the absence of the conditions set forth in Article 9 of the GDPR, such data will not be taken into consideration and will be immediately deleted.

The data processed is collected directly from you as a data subject and/or from third parties in connection with your previous work experience (only with your consent) and/or from publicly accessible sources, e.g. your professional social network profile (within the limits set out in this notice).

 

3. Purposes and legal bases of processing

3.1 These data are processed for purposes connected with or instrumental to the performance of the activity of search and selection of candidates in relation to all the positions managed by the Controller, as well as to take advantage of the services offered by the Controller such as, by way of example, consultancy, assessment & development, coaching and training.

Any personal data you provide that fall under special categories of data pursuant to Art. 9 GDPR will be processed, only where necessary and relevant, to assess your application for job positions falling within the scope of targeted employment.

With regard to common data, the legal basis for such processing is the execution of pre-contractual measures taken at your request (Art. 6.1(b) GDPR).

With regard to special data, the legal bases are the need to fulfil the obligations and exercise the specific rights of the Data Controller or the data subject in the field of labour and social security law and social protection, insofar as the Company is authorised by Union or Member State law or by a collective agreement under Member State law, where there are appropriate safeguards for the fundamental rights and interests of the data subject (Art. 9.2 lett. b GDPR).

 

3.2 Only with your consent, your personal data may be processed for the purpose of acquiring information on your professional references from previous employers and – if applicable – to communicate them to the perspective employer for which the job search is being conducted.

The legal basis for such processing is the consent of the data subject (Art. 6.1. lit. a) GDPR).

 

3.3 The Data Controller may also process public information relating to your profile on social networks (e.g. LinkedIn) or other internet sites of a strictly professional nature both to pursue the purposes set out in point 3.1 and to verify that the data provided by you correspond to what you have declared, limited only to information of a professional nature, which is necessary for the sole purpose of assessing the specific risks associated with the type of activity to be carried out on the basis of the profile sought, taking all necessary measures to ensure the correct balancing of your interests, fundamental rights and freedoms with our legitimate interests.

The legal basis for such processing is the legitimate interest of the Company (Art. 6.1 lett. f GDPR).

 

3.4 Where necessary, your data may be processed to ascertain, exercise or defend the Controller’s rights in extrajudicial and/or judicial proceedings. The legal basis for such processing is the legitimate interest of the Company (Art. 6.1(f) GDPR).

 

4. Free or compulsory nature of providing data

The provision of data is compulsory for personnel search and selection activities as well as for the use of the services offered by the Controller. Refusal to provide the data will prevent the Company from carrying out these activities and will not allow your application to be considered by potential employers.

An exception to this is the provision of data as set out in section 3.2 above, which is optional and possible.

 

5. How long we keep your personal data

Without prejudice to the storage obligations provided for by law, KeyPartners will only store the personal data in question for the time necessary to fulfil the purpose of the processing.

In particular:

• the data processed for the purposes set out in points 3.1 and 3.2, will be processed for 36 months after the last activity, unless you can request deletion at any time;
• the data processed for the purposes referred to in Section 3.3 will be processed for 36 months from the last activity performed, without prejudice to the possibility for you to object to the processing at any time;
• the data processed for the purposes set out in Section 3.4 will be processed for the entire duration of the litigation, until the time limits for appeal proceedings are exhausted.

 

6. Your rights

We would like to inform you that, in accordance with current legislation, you have the following rights expressly recognised by the GDPR:

• the right to ask the data controller for access to personal data (Art. 15);
• the right to have one’s personal data corrected or deleted (Articles 16 and 17);
• the limitation of processing in the cases provided for in Article 18 GDPR (Art. 18);
• the right to data portability (Art. 20);
• the right to object to their processing (Art. 21),
• the right not to be subject to a decision based solely on automated processing, including profiling (Article 22);
• the right to lodge a complaint with the Garante per la protezione dei dati personali to complain about a violation of data protection rules.

Such requests, as well as any requests for clarification or further information, may be addressed to the Data Controller, also through the Data Protection Officer (DPO) appointed by the latter, using the contact details indicated above.

 

7. Disclosure of personal information to third parties and persons authorised to process it

The data may be communicated to subjects acting as autonomous data controllers (including the Company’s client companies, professionals, public bodies, auditing or supervisory bodies), also in performance of legal obligations, or processed on behalf of the Company by subjects designated as Data Processors to whom appropriate operating instructions are given (including, for example, service providers, consultants and external collaborators), always within the limits of the purposes mentioned above.

 

8. International transfers of personal information

The personal information we collect may be stored, retained and/or processed where we or our partners, affiliates and third-party providers have facilities for this purpose (e.g., in the case of cloud-based storage, at the location of the relevant servers). These locations may be different from the country where you initially provided your data and may include countries that are not members of the European Union (such as the United States or Switzerland). Any transfer of your data to other countries is carried out in compliance with the requirements of the GDPR and, in particular, takes place on the basis of an adequacy decision of the European Commission or through the use of standard contractual clauses drawn up by the latter.

 

9. Amendments to this policy

At our discretion, we may change our privacy policy to reflect updates to our business processes, current acceptable practices, or changes in laws or regulations. If we decide to change this privacy policy, we will post the changes here, at the same link by which you access this privacy policy.

 

 

Last updated: 26 February 2025.