ADVISORY NOTICE RELATIVE TO THE PROTECTION OF personal data (PRIVACY NOTICE)
pursuant to art. 13-14 of the GDPR (General Data Protection Regulation) 2016/679

1) Please be informed that the personal data provided by yourself will be processed, whether in printed form and/or digitally, exclusively for the purpose of the recruitment of personnel and using technical and organizational procedures which are strictly connected with said purpose.
The data are collected in different ways: by the voluntary despatch to our company of the subject's personal information and work experience, laid out in the form of a curriculum vitae (C.V.) and sent by mail, telefax, e-mail or brevi manu, or by registration on the website of our company. The following data are processed: personal details, contact details (address, telephone, e-mail address), previous work experience and skills, and the candidate's personal reasons for the application.
The despatch of your CV to our company may be: a) a spontaneous application; b) in response to specific recruiting advertisements published by our company in local, national or foreign newspapers or periodicals or on our web site, social media or third-party portals, or c) in response to recruiting advertisements published independently by third parties, in which case we collect the data from said third-party companies to which our company has previously indicated our personnel recruitment requirements. Please do not add any information that is not related to the position offered/sought to your CV.

2) The company shall also be entitled to process specific data contained in the CV even in the absence of the express prior consent of the subject (art. 111 bis of [Italian] Legislative Decree no. 196/2003) and also if the CV is assessed by the Data Controller during the course of subsequent selection processes other than those for which the CV was submitted spontaneously or requested by the Data Controller.

3) The provision of specific information as part of the CV is at all times voluntary. Any data which might reveal the subject's state of health or racial or ethnic origins will be processed only if necessary for the establishment of an employment or similar relationship with our company. Our company will not utilize any personal data provided by you but not related to the purpose stated above, taking into account the specific functions and/or nature of the required professional profiles.
Pursuant to [Italian] Law 276/2003 (Biaggi Law), we are prohibited from conducting any process of pre-selection – even with the consent of the subject – based on personal convictions, political or trade union affiliations, religious beliefs, gender, sexual orientation, matrimonial or family status, pregnancy, age, handicap, race, ethnic origin, colour, ancestry, nationality, linguistic group, state of health, or any controversies with preceding employers, unless such characteristics are such as to affect the method of carrying out the activities required for the work or which are an essential and determining prerequisite for the working activities.
As a consequence, in the case of personal data which might reveal the state of health of the subject's family members or cohabitants, the purpose of such processing shall be exclusively that of recognizing a specific benefit for the candidate, especially in the case of obligatory hiring quotas or the recognition of a right given by disability, infirmity, acts of war or military service.

4) The fact that a social media profile is available to the public does not automatically signify that a potential employer is permitted to make indiscriminate use of the information contained therein for their own purposes. To this end, and in compliance with legal opinion no. WP249 expressed by the "Article 29 Working Party", our company acts in compliance with the following rules:

• Before using data collected from a social media platform, we take the context into specific consideration, in other words whether the subject's social media profile has been created for professional purposes or for purposes connected to their social life; this difference constitutes a fundamental aspect in determining whether our company may legitimately gather the data.
• The collection of data via social media is limited to what is necessary for and relevant to the evaluation of the ability of the candidate to take on the specific work activities related to the position (e.g. for an evaluation of specific risks for the candidate associated with the position).
• Subsequent to this evaluation (e.g. as soon as it becomes clear that no position will be offered to the subject or that the subject has not accepted the job offer), the subject's personal data will be immediately deleted.
• Our company does not ask potential future employees for their "friendship" on the social media (e.g. solely in order to examine their profiles or in any other way gain access to their social media profiles). Similarly, we do not collect the information contained in their social media profiles in a continuative manner.

5) The legal ground for lawful processing of ordinary and specific data is our legitimate interest – which in our opinion overrides the interests or rights and the fundamental freedoms of the subject – in assessing the compatibility and suitability of the candidate's profile with the requirements of the company and organizing the relative selection processes.

6) CVs which are not considered to be suitable for our requirements are protected in archives which are supervised during working hours and locked away thereafter.
These files may be accessed only by personnel who have been authorized in writing by our company and are provided with a univocal password. The personal data will not be transferred outside Italy. The personal data will never be publicized. The CVs and the data contained therein (evaluations etc.) are conserved for a maximum of 24 months, exclusively for the purpose of aiding in our further selection processes and for personnel training, after which they will be destroyed or rendered anonymous.
Personal data processed for the purposes of IT security (e.g. recordings of logs created by online systems used by the candidate to forward their candidacy to our company) will be conserved for the time necessary to complete the relative security checks and to assess the results in order to implement the technical measures necessary to rectify possible problems (one year from the date of collection).

7) The data may be communicated to training organizations and recruitment companies, labour, fiscal and legal consultants, organizations financing training programmes, temporary employment agencies, managers of personnel recruitment sites and web portals, who assume the rôle of external or independent Data Managers for the same purposes. In the case of external data managers, we oblige the third-party recipient of the data to report to us any further third parties to which the data are transferred, and we authorize such further transfer, and in addition we monitor the compliance of their processing with the requirements laid down by the privacy norms. A list of the external data managers may be obtained by written request of the subject.
The Data Controller does not transfer the data to third countries.

8) As regards the personal data, you are entitled to exercise the following rights:

• to request the Data Controller to confirm whether any personal data relative to you are being processed and, if so, to obtain access to the personal data and to the following information: a) the purposes of processing; b) the categories of personal data in question; c) the recipients or categories of recipients to whom the personal data have been or will be communicated, especially if the recipients are in third party countries or are international organizations; d) when possible, the period for which the personal data will be conserved; if this is not possible, the criteria used to determine this period; e) the existence of the data subject's right to request the data controller to rectify or cancel their personal data or to limit the processing of their personal data or to object to said processing; f) the right to complain to a supervisory authority; g) if the data have not been provided by the data subject, all available information concerning their origin; h) the existence of an automated decision-making process, including profiling and, in these cases at least, any significant information regarding the logic process used, as well as the importance and estimated consequences for the data subject of such processing;
• if the personal data have been transferred to a third-party country or to an international organization, the data subject is entitled to be informed regarding the existence of adequate guarantees relative to such transfer;
• to request, and to obtain without unjustified delay, the rectification of incorrect data; according to the purposes of the processing, request the completion of personal data that are considered incomplete, if appropriate providing a supplementary declaration;
• to request the cancellation of the data if a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; b) [omissis]; c) the data subject objects to the processing and no legitimate overriding motive exists to proceed with said processing (...); d) the personal data have been processed illicitly; e) the personal data must be cancelled in order to comply with a legal obligation contained in the laws of the Union or the Member State of which the data controller is a subject;
• to request the limitation of the processing which involves the data subject, in the following cases: a) if the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; d) the data subject has objected to processing where the personal data are processed for direct marketing purposes, while awaiting verification of the possible prevalence of the legitimate motives of the data controller over those of the data subject;
• to obtain from the data controller, upon request, the details of the third parties to which the personal data have been transferred;
• at any moment to revoke consent for the processing of the subject's personal data if such consent has been previously given for one or more specific purposes, though such revocation shall not affect the legitimacy of any processing carried out prior to such revocation on the basis of the consent given.

In particular, in order to revoke the consent previously given to our company, the data subject may forward a specific request in one of the following ways: i) following the instructions for cancellation indicated at the bottom of each e-mail message, or ii) by sending an e-mail containing the request to privacy.gdpr@venetacucine.com.

• the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. (N.B. Our company does not utilize such automated decision-making processes).
• the data subject may at any time enter a complaint to the Supervisory Authority on the basis of the GDPR (Data Protection Authority) and may exercise their legal rights before the ordinary Court in their place of residence or business.

9) The Controller responsible for the processing of personal data is: VENETA CUCINE SPA, with registered offices in Via Paris Bordone, 84 – 31056 Biancade (TV) e-mail privacy.gdpr@venetacucine.com