Privacy Notice For Candidates
Last update: April, 27th 2023
Pursuant to articles 13 and 14 of EU General Data Protection Regulation 2016/679 (“GDPR”) and the relevant national legislation (“Privacy notice”).
The Companies Dompé farmaceutici S.p.A., Dompé US Inc. and Dompé Albania Sh.p.k., as “Joint Controllers”, whose identifying elements are listed below (herein “Dompé Group” or “Dompé” or “Joint Controllers”), provide you the following information regarding the use of your personal data. The Companies act as Joint Controllers according to the relevant joint controller agreements signed pursuant art. 26 of GDPR which defines their responsibilities and which essential content is set out in this privacy notice.
Premise
We would like to inform you about the processing of your personal data you provide to us through the online application form “HRIS” related to the Research & Recruitment processes for Dompé Group. HRIS is a computer system that allows Dompé to organize and manage the applications, in which users may create a profile and send their application by selecting the interested job position. Data are stored in a single cloud server located in Europe.
Data Controllers may collect your personal data, contact details and information relating to the application even through third-parties as, for example, recruiting companies, social network and Head-hunters.
Data Controller and DPO
In this section we indicate you our contacts
Joint Controllers are:
- Dompé farmaceutici S.p.A., with registered office at Via San Martino 12, 12/a - 20122 Milan, Italy, tel.: 02583831;
- Dompé US Inc., with operating office at 181 2nd Ave., San Mateo, CA 94401, United States;
- Dompé Albania SH.P.K., with registered office at Arena Center Hyrja D, Kati 6, Njesia D1/L6 Sheshi Italia, Tirana, Albania
Data Protection Officer: Dompé Group has a Data Protection Officer “DPO”. The DPO may be contacted through the following email address: dpo@dompe.com
1. Research & Recruitment process
Activities of research and selection of candidates in relation to all the job positions managed by Dompé Group, including future selection, as well as to take advantage of the free services offered by the same, as, for example, active labour market policies, courses and training.
Legal basis
The processing is legitimate as it is necessary to comply with your request to establish an employment relationship with us, according to art. 6.1(b) of the GDPR.
2. Next contact in case of new job positions
Join Controllers will process your personal data in order to identify you as a potential candidate for future recruitment process, related to additional positions, which may concern any company of the Group, as Joint Controllers. To this end, you may be contacted in order to inform you about these positions.
Legal basis
The processing is legitimate according to your express consent, pursuant to art. 6.1(a) of the GDPR which is optional and can be revoked at any time.
3. Sending newsletters for new job positions
Dompé will process your personal data in order to keep you updated by sending newsletters about new job positions in Dompé Group.
Legal basis
The processing is legitimate according to your express consent, pursuant to art. 6.1(a) of the GDPR which is optional and can be revoked at any time.
4. Processing of sensitive data
Any personal data provided by you and attributable to particular categories of data pursuant to art. 9 of GDPR will be processed, only when necessary and relevant, to evaluate your application for positions within the scope of targeted placement pursuant to L. 68/99.
Legal basis
The need to fulfil the obligations and exercise the specific rights of the data controller or the data subject with regard to labour law, social security and social protection, in so far as it is authorized by EU or Member State law or by a collective agreement under the law of the Member States, in the presence of appropriate safeguards for the fundamental rights and interests of the data subject (Art. 9.2 lit. b GDPR).
5. Ascertain, exercise or defend our right in court
Any personal data you provide may be used to ascertain, exercise or defend our right in court.
Legal basis
The processing is based on the legitimate interest of the Company (exercise or defense of a right in court) pursuant to art. 6 paragraph 1 letter. f) of the GDPR. The sensitive categories of data will be processed to ascertain, exercise or defend a right in court or whenever the courts exercise their judicial functions (Art.9.2, lit. f) GDPR).
Categories of personal data
In this section we indicate what types of data we collect about you
By way of example and not exhaustive, the following categories of common personal data will be collected: name, surname, password, date of birth, residence, e-mail address and telephone contacts, photos possibly present on the Curriculum Vitae, degree, work experience and any additional data you have entered in your Curriculum Vitae.
Sensitive categories of data (Sensitive data)
In this section we inform you about the sensitive data we may use
For the purpose of the recruitment process, sensitive data may be processed, such as, but not limited to, belonging to a protected category. This information is suitable to reveal the state of health and falls within the sensitive categories of data referred to Article 9 GDPR and will be processed in accordance with the current legislation.
Data related to third-party
If you provide us personal data relating to third parties (e.g. contact persons, previous and/or current employers), you will act as an autonomous Data Controller and will have to ensure that such data are managed in accordance with applicable legislation. You may, for example, provide us such data after informing third parties and obtaining their consent, if requested. Furthermore, you authorize Dompé, as autonomous Data Controller, to contact these third parties for the purposes of reference and verification of the information received.
Nature of data provision
In this section we indicate you whether the provision of your data is mandatory or not and what are the consequences of your refusal
The processing of such information is instrumental to the aforementioned purposes of staff recruitment and your provision is mandatory for the requested Data. Any refusal to provide the same will make impossible to perform and regularly manage the research and selection activities towards you.
Methods of data processing
In this section we indicate you the methods of data processing
Personal data can be processed not only by electronic tools, but also by non-automated tools, and the processing is carried out only by operations, as well as with logic and through data organization forms strictly necessary in relation to the above-mentioned obligations, tasks or purposes.
Updating of personal data
As part of the processing described, you will communicate any update of your personal data in order to allow us the correct and timely processing of the same.
Data recipients
In this section we indicate you who use your personal data under our responsibility
Data can be managed, in compliance with the confidentiality obligations, by the staff of Dompé Group who need it because of their job, hierarchical position, or the specific role and to which appropriate operational instructions have been given to avoid loss, destruction, unauthorized access or unauthorized processing of the data. Third parties may also use the data, as Data Processors or Autonomous Data Controllers, who carry out instrumental activities on behalf of Dompé.
For example:
- External consultants for staff recruitment, selection and evaluation;
- Service companies (also ICT);
- Company of the same Group, also located extra EU, to which the Data Controller belongs, for corporate and administrative-accounting purposes as Data Controller pursuant to art. 28 GDPR.
Foreign data transfer
In this section we indicate you whether your data are transmitted outside EU and with what guarantees
Data Controllers acknowledge that, for the purposes referred in this statement, your personal data may be processed by companies of Dompé Group located extra European Union. In any case, such transfer will take place only according to the existing adequacy decisions of the European Commission, or according to standard contractual clauses pursuant to art. 45 and 46, GDPR.
Data retention
In this section we indicate you how long we will keep your data
Your data will be stored for the time necessary to achieve the purposes described in this notice in compliance with the provisions of applicable laws.
For the purposes indicated above, the retention period of your Data will not exceed 24 months from the last access of the user in the platform. After two years of the account inactivity your data will be deleted.
In any case, you may delete your account at any time.
If at any time you believe that the purpose of the processing is no longer necessary or useful, please inform us in order to proceed with the immediate data deletion.
Rights of Data Subject
In this section we indicate you your rights in relation to your data
In relation to the processing of personal data, at any time the Data Subject may obtain the confirmation of whether or not of data at the Data Controller and may know the content and origin, may ask for their integration or correction or, in cases provided by law, the portability, limitation of processing, cancellation of processed data, as well as you may oppose, for legitimate reasons, to their processing; upon request, you can obtain the updated list of Data Processors, more detailed information on the entities or categories of entities to which the data are disclosed and/or transferred, and - if applicable - a copy of the guarantees used for the data transfer.
Revoke of Consent
We highlight your right to revoke your consent at any time
You may revoke your consent at any time, in accordance with the procedures provided in the section related to the exercise of your rights, without prejudice to the lawfulness of the processing carried out previously.
Complaint to the Data Protection Authority
We highlight your right to contact the Data Protection Authority
You also have the right to propose a complaint to the Data Protection Authority if you believe that your rights have not been respected or that you have not received a feedback to your requests according to law.
Exercise of rights
In this section we show you how to exercise your rights
For the exercise of your rights you may refer to the following email address: privacy@dompe.com.
Please you may find at the following links other Dompé affiliates privacy notices.
