By means of this information notice (“Notice”), the Data Controller, as defined below, wish to inform You on the purposes and methods of the processing of Your personal data and on the rights that Regulation (UE) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) entrust You.

1. Who is the Data Controller

The data controller is Stiga S.p.A. (“Stiga” or the “Data Controller”), with registered office in 31033 Castelfranco Veneto (TV), Italy, via del Lavoro 6.

The Data Controller appointed a data protection officer (“Data Protection Officer” or “DPO”), that You may contact for the exercise of Your rights as listed in article 8 below, as well as for asking any further information, at the following addresses: STIGA S.p.A, DPO office, via del Lavoro 6, 31033 Castelfranco Veneto, Italy; e-mail: dpo@stiga.com.

2. Which personal data we process

For the purposes set forth in this Notice, the Data Controller processes the following personal data:

• common data and contact details, such as name, surname, place and date of birth, tax code, address, phone number, e-mail address and other addresses;
• data regarding Your health state (e.g. Your possible belonging to a protected category);
• financial data (e.g. Your income).

3. Purposes of processing and legal basis

The processing of Your personal data is necessary for the recruitment process, including, but not limited to, the review of Your CV and the set-up of interviews, aimed to the possible establishment of a work relationship.

The legal basis for the processing of Your data is, therefore, taking steps at the request of the data subject prior to entering into a contract, pursuant to Article 6, first paragraph, letter b), of the GDPR; therefore, Your consent is not necessary to allow the processing.

As far as Your health data are concerned, the legal basis for their processing is Your consent.

4. Nature of the personal data processing and consequences of a refusal

The processing of Your personal data, also regarding Your health, is a mandatory requirement for the recruitment process, and therefore Your refusal to provide such personal data will result in the impossibility for the Data Controller to manage the same.

5. Data Retention

The Data Controller will process your personal data, for the purposes indicated above, for so long as it is necessary for the management of the recruitment process. In particular, Your CV will be stored from Stiga for three years following our receipt of the same, and it will be deleted thereafter.

6. Methods by which your personal data will be processed

Your personal data will be processed, pursuant to the provisions of the GDPR, by means of paper, computerized and telematics tools, for the purposes indicated above and with adequate methods to guarantee their security and confidentiality in accordance to Article 32 of the GDPR.

7. To which subjects your personal data may be communicated and who may get to know them

For the purposes described in paragraph 3 above, Your personal data will be disclosed to employees, external consultants and, in general, Stiga’s personnel, who will act as person authorized to the processing of personal data, specifically appointed as internal delegates.

In addition, Your personal data will be processed by the following third parties:

• service providers for the management of the IT system;
• legal and consulting services providers;
• recruitment agencies;
• other service providers.

The above subjects shall act, in some cases, as autonomous data controller, in other cases as data processors specifically appointed by the Data Controller pursuant to Article 28 of the GDPR. You may request a list of our data processors at the contact details indicated at article 1 above.

Your personal data will not be disclosed to the public.

8. Your rights as data subject

With regard to the processing described in this Notice, You may exercise any of the rights described in this section in accordance with Articles 15 through 21 of the GDPR. In particular:

Managing Your Information - Right of access

Article 15 of the GDPR: right to obtain from the data controller confirmation as to whether or not Your personal data are being processed, and, where that is the case, access to the personal data and the following information (also by receiving a copy of the same):

• the purposes of the processing;
• categories of personal data concerned;
• the recipients or categories of recipient to whom the personal data have been or will be disclosed;
• the envisaged period for which the personal data will be stored or the criteria used to determine such period;
• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
• the right to lodge a complaint with the supervisory authority;
• the source of the persona data, if not collected directly;
• the existence of automated decision-making, including profiling;

Rectification of Inaccurate or Incomplete Information - Right of rectification 

Article 16 of the GDPR: the right to obtain, without undue delay, the rectification of inaccurate personal data or the integration of the same;

Erasure - Right to erasure

Article of the 17 GDPR: the right to obtain from the controller the erasure of Your personal data without undue delay, if:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• You withdraw Your consent, and there is no other legal basis for the processing;
• You object to the processing of Your personal data on legitimate grounds;
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation;
• the personal data have been collected in relation to the offer of information society services referred to in Article 8, first paragraph, of the GDPR.

If You no longer want us to use Your information, You can request that we erase Your personal information. Please note that if You request the erasure of Your personal data, we may retain and use Your personal data to the extent necessary to comply with our legal obligations or for the performance of a duty carried out in the public interest or in the exercise of official authority vested in the Data Controller, or for the establishment, exercise or defense of legal claims. For example, we may keep some of your information for tax, legal reporting and auditing obligations.

Restriction of processing - Right to restriction on processing 

Article 18 of the GDPR: right to obtain from the controller restriction of processing if:

• the accuracy of the personal data is contested by You, for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and You oppose the erasure of the personal data and request the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, but they are required by You for the establishment, exercise or defense of legal claims;
• You have objected to processing pursuant to Article 21, first paragraph, of the GDPR pending the verification whether the legitimate grounds of the controller override Yours.

Data Access and Portability - Right of portability 

Article 20 of the GDPR: the right to receive, in a structured format, commonly used and readable by an automatic device the personal data concerning Yourself provided to the Data Controller and the right to transmit the same to another data controller without impediment, if the processing is based on consent and is made with automated means. Furthermore, the right to obtain that Your personal data are transmitted directly from the Data Controller to another data controller, if this is technically feasible;

Complaints 

file a complaint to the competent data protection authority by sending a notice to: Piazza di Montecitorio n. 121 - 00186 Roma; e-mail: protocollo@pec.gpdp.it.
The above rights may be exercised by contacting the Data Controller and the DPO at the contact details indicated in previous article 1. Please note that we may ask you to verify Your identity before taking further action on Your request.