INFORMATION NOTICE FOR CANDIDATES ON PERSONAL DATA PROCESSING

With regards to applications relating to Gianni Versace S.r.l. and the EMEA Data Controllers, pursuant to Article 37 of the GDPR, the Data Controller has appointed a Data Protection Officer (hereinafter, also “DPO”) who may be contacted at the following e-mail address: DPO@versace.it.     

Ordinary personal data or data concerning health
The Company mainly processes the following categories of personal data:

- Identification data and contact data (e.g. name, surname, data of birth, tax number, address, telephone numbers, residential address, domicile);

- Data relating to previous work experiences (e.g. duties covered, date hired, role with company, any benefits, periodical assessments, other data relating to work experience), professional qualifications;

- Tax and income data (e.g. previous remuneration);

- Data provided by sending curriculum vitae and other data collected during the personal selection and evaluation process, including those provided when completing information questionnaire;

- Photographs (e.g. photos present in CV);

- Any other data provided by the candidate;

- Data capable of revealing health status (documentation regarding invalidity or membership of a protected category); data regarding unfitness for work for assignment of specific duties.

Ordinary personal data are collected and processed for the following purposes:

a ) Ordinary personal data are collected and processed for the following purposes;

b ) to comply with legal, regulatory and EU obligations, in particular obligations under Local Labour Law;

c ) to exercise a right in court, where necessary.

Consent is not required for these purposes because processing is necessary to fulfil legal obligations resulting from the selection of personnel and/or because the processing may qualify for a specific exemption from the consent requirement in terms of Article 6.1(f) of the Regulation such as legitimate interest or protection of rights.

Meanwhile, data concerning health shall be processed for the following purposes only:

a ) to comply with or to ensure compliance with specific obligations or to fulfil specific duties required by the EU regulation, by law, by regulations or by collective agreements ( in particular, when establishing the employment relationship and in relation to workplace health and safety issues. Consent is not required for these purposes because processing is necessary, respectively, to comply with obligations imposed by law or by the national collective agreement (Art. 9.2(b) of the Regulation);

b ) to guarantee equal opportunities at work. Consent is not required for these purposes because the processing is necessary to comply with legal obligations.

Sensitive data, concerning health status, which is processed by a doctor during any medical check-up required prior to recruitment and with reference to the duties, shall be processed by the Company in execution of obligations under the Local Labour Law, where applicable. The doctor shall communicate to the Company only those opinions on the candidate’s unfitness for the duties in question.

Any additional personal data concerning health status, other categories of personal data not necessary for selection purposes and contained in the CV or provided by the candidate or by third parties shall be cancelled immediately and shall not be processed.

Personal data of family members and third parties
The following personal data (e.g. general details, data of birth, presence of any family members in the Company or other data relating to family members provided by the candidate) relating to the data subject’s family members are processed, when necessary, in order to perform regular checks of compliance with ethical principles as well as with the requirements of the organisational model. Consent is not required for these purposes as processing is necessary to fulfil the Company’s legitimate interests in terms of Article 6.1 (f) of the Regulation. It is the duty of the data subject to communicate the contents of this information to his or her family members.

If the data subject provides the Company with data relating to third parties (e.g. previous employers or references), the Company might contact such third parties for references and to check the information received.

The submission of the aforesaid data (e.g. identification data, data relating to family members, data concerning health status) is necessary to perform activities related to the selection of personnel and failure to provide such data shall make it impossible for the Company to consider the candidacy during a selection process.

The personal data shall be processed by the Company and by its Authorized Person using information systems (and manually) in accordance with the principles of lawfulness, fairness and transparency required by the applicable regulation on personal data protection and safeguarding the confidentiality of the data subject and his/her rights by adopting appropriate technical and organisational measures to guarantee a level of security proportionate to the risk (e.g. storage of ordinary personal data and data concerning health in separate databases, encoding of personal data, capacity to restore access to data in case of an accident, etc.).

As part of its selection activities, the Company may perform activities to verify information provided (e.g. academic qualifications and previous employers) solely for selection purposes.

The personal data provided directly by the candidate – also by spontaneous submission of a CV – shall be retained for the time strictly necessary to fulfil the purposes for which the date were acquired. The data retention period is up to 24 months from collection of the data.

The personal data will be retained for the stated period also in order to demonstrate, in case of a petition/request/claim, that there has been no discrimination against candidates and that processing for recruitment purposes was performed fairly and transparently. After this period, the personal data will be destroyed securely and in compliance with applicable laws and regulations.

If, at any time, the data subject considers exhausted the scope of the processing by the Company in that it is no longer necessary or useful, the data subject may inform the Company accordingly to enable it to cancel the data immediately.

The Processing is necessary pursuant to Art. 6 paragraph 1.b) of the GDPR to the execution of pre-contractual measures adopted upon your request. Therefore, your personal data will be processed by the Company for purposes related to the conduct of research and selection of candidates.

The data shall not be communicated, disseminated or transferred but may be shared with external advisors who are supporting the Company with the selection of personnel. Processing shall be carried out by employees and collaborators of the Data Subject, instructed and authorised to do so, in pursuit of the purposes described above. The complete and updated list of persons processing personal data as Data Processors and Data Controllers is available upon request to the Company, as specified in Par. I.

In addition, personal data may be made accessible, communicated and transferred to Public Authority in order to give effect to investigation requests or where expressly authorized by legal obligation.

We also inform you that your personal data may be the subject of intra-Group correspondence, to subsidiaries or associated companies and to their collaborators, always for the purposes stated above. The data are not generally transferred outside the European Union. However, where for specific requirements regarding the location of the services rendered by suppliers, or for reasons of travel management and coordination of Group activities, it proved necessary to transfer the data to countries outside the European Economic Area – also in countries that do not offer adequate protection – the Company undertakes to guarantee levels of protection and safeguards, also of a contractual nature, in accordance with applicable laws and regulations.

A list of countries outside the European Economic Area where data is transferred is available on request at the registered office of the Data Controller.

The data subject may, in relation to the processing of data described therein, exercise the rights provided for by the Regulation (Articles 15-21), as follows:

• to receive confirmation of the existence of his/her personal data and to access their content (right of access);
• to update, amend and/or correct his/her personal data (right to rectification);
• to ask for the erasure, or the restriction of processing, of data processed in breach of the law, including those whose retention is not necessary in relation to the purposes for which the data was collected or otherwise processed (right to be forgotten and right to restriction of processing);
• to object to processing (right to object);
• to withdraw consent, where given, without prejudice to the fairness of processing based on consent given prior to withdrawal;
• to appeal to the regulatory authorities in case of violation of the rules on personal data protection;
• to receive an electronic copy of data regarding him/her as provided during the selection process (e.g. data relating to previous work experience) and to ask that said data be transmitted to another data controller (right of data portability).

In order to exercise these rights, the data subject may contact writing by email at privacy@versace.it

Updated on 26th September