Privacy Notice on the processing of personal data of candidates in relation to the personnel selection procedure

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR" or "Regulation"), notice is hereby given that this notice relates to the personal data provided by the data subject or lawfully obtained by the Controller, in relation to the personnel selection procedures of the companies forming part of the Dolomiti Energia Group, namely:

• Dolomiti Energia S.p.a., with registered office in Rovereto (TN), Via Manzoni No. 24, Tax Code and VAT No. 01614640223, tel. 0464-456111, certified email (PEC): info.holding@cert.dolomitienergia.it;

• Dolomiti Energia Mercato S.p.a., with registered office in Trento, Via Fersina No. 23, Tax Code and VAT No. 01812630224, tel. 0461-362330, PEC:  info.commerciale@cert.dolomitienergia.it;

• Dolomiti Energia Solutions S.r.l., with registered office in Trento, Via Fersina No. 23, Tax Code and VAT No. 01840970220 tel. 0461-362222, certified email (PEC): info@cert.dolomitienergiarinnovabili.it;

• Dolomiti Ambiente S.r.l. with registered office in Rovereto (TN), Via Manzoni No. 24, Tax Code and VAT No. 02352570226, tel. 0464-456111, certified email (PEC): info@cert.dolomitiambiente.it;

• Dolomiti Energia Trading S.p.a., with registered office in Trento, Via Fersina No. 23, Tax Code and VAT No. 03027910235, tel. 0461-362222, certified email (PEC): info.trading@cert.dolomitienergia.it;

• Dolomiti Edison Energy S.r.l., with registered office in Trento, Via Fersina No. 23, Tax Code and VAT No. 02051850226 tel. 0461-362222, certified email (PEC): info@cert.dee.tn.it;

• Dolomiti Energia Rinnovabili S.r.l., with registered office in Trento, Via Fersina No.23, Tax Code and VAT No. 02725200220 tel. 0461-362222, certified email (PEC): info.der@cert.dolomitienergia.it

• Hydro Dolomiti Energia S.r.l. with registered office in Trento, Viale Trieste No. 43, Tax Code and VAT No. 02075180220, tel. 0461-457111, certified email (PEC): hde.pec@hde.legalmail.it.

• EPQ S.r.l., with registered office in Trento, Via Fersina 23, Tax Code and VAT No. 09388440969, certified email (PEC): epq@legalmail.it.

For further information, please refer to the website  www.gruppodolomitienergia.it.

1. DATA CONTROLLER

The Data Controller (i.e. the party that determines the purposes and means of the processing of personal data) is one of the companies of the Dolomiti Energia Group indicated above with which the candidate enters into relations for the purposes of the process of selecting his or her application for possible subsequent recruitment.

2. CONTACT DETAILS OF THE DATA PROTECTION OFFICER

Please be informed that the Dolomiti Energia Group has designated, pursuant to Article 37(2) of the Regulation, the Data Protection Officer ("DPO"), who may be contacted for any need relating to the protection of personal data, including the exercise of the rights referred to in point 9 below, at the email address: info.privacy@cert.dolomitienergia.it, or at the address at via Fersina 23, 38123 - Trento.

3. TYPE OF PERSONAL DATA PROCESSED

For the purposes listed in the following point, the Controller shall process ordinary and special category personal data, provided directly by the candidate or lawfully acquired independently by the Controller, such as, by way of example:

1) personal details and contact details: name, surname, date and place of birth, tax ID code, residence, domicile, email address, mobile phone number, further data contained in identity documents;

2) data relating to educational and professional background: educational background, professional experience, letters of reference, awards, certifications of the candidate, other information available on the candidate's professional social media profiles;

3) data relating to images and video recordings/video interviews: the photographic image if the candidate wishes to attach it at the application stage (non-mandatory data that does not prevent the possibility of a spontaneous application or participation in the open selection) and the video recording/asynchronous video interview requested from him or her during the application selection process;

4) special category data: relating to health status, suitability to perform specific duties, performance of public functions, membership of protected categories by reason of personal psycho-physical characteristics pursuant to Law No. 68/1999 or other laws in force.

Please do not include any other data and/or information relating to special category data in the curriculum vitae, the relevant attachments and/or in the video recording/video interview, such as, for example, statements relating to membership of trade unions, political opinions, religious beliefs, sexual orientation; where these types of unsolicited data are present, the Controller, in compliance with the Code of Conduct of the Dolomiti Energia Group as well as by reason of the provisions of Article 8 of Law No. 300 of 20 May 1970, may ask the candidate to produce new documentation free of such data and/or information.

This Notice covers both personal data provided directly by the data subject and those lawfully acquired by the Controller from third parties, as specifically indicated in point 7.

4. PURPOSES OF PROCESSING

The processing of personal data shall take place as part of the procedures for the selection of employees of the Company of the Dolomiti Energia Group to which the data subject has applied. The processing of personal data may also take place in response to a spontaneous application by the candidate in the absence of a specific selection procedure for open positions. In both cases, the data shall be processed in order to carry out all operations connected with and resulting from the following activities:

1) analysis and management of applications for the selection and possible recruitment of human resources - processing activity that may arise both following the voluntary submission of the CV by the candidate and following a request to participate in personnel selection procedures open at one of the companies of the Dolomiti Energia Group, which includes: the registration and filing of the candidate's curriculum vitae in the Controller's database; the assessment of the information contained in the curriculum vitae in order to evaluate a possible interest of the Controller in the candidate’s professional profile, including through the use of consultancy companies specialised for that purpose; the collection of data and information necessary for the possible establishment of an employment relationship with the Controller;

2) profiling of the candidate - specific processing activity that makes it possible to collect information both regarding the candidate's soft skills and regarding technical and/or specialist skills relating to the sector or area for which the selection process is under way (or hard skills); for this purpose, the candidate may be asked to complete trials, checks and assessment tests useful for the continuation of the selection process; furthermore, in compliance with the provisions of point 5 below, for this purpose the Controller may make use of legally binding decision-making processes, partly or wholly automated, without prejudice to the safeguards for the candidate's rights and interests (as specified in point 5);

3) fulfilment of legal obligations connected with the selection activity - activity linked to the fulfilment of regulatory obligations, whether deriving from national or EU sources, or provisions issued by Authorities lawfully entitled to do so and measures issued by Supervisory and Control Bodies;

4) exercise and defence, including before the courts, of the Controller's rights.

5. LEGAL BASIS OF PROCESSING AND MANDATORY NATURE OF PROVISION

With regard to the purposes described above, the legal basis for the processing of personal data is:

1) for the purposes referred to in point 4 no. 1) above, the necessity of processing personal data in order to carry out the pre-contractual activities preparatory to the possible establishment and then performance of the employment relationship, within the framework of the personnel selection procedure, on the basis of the provisions of Article 6 letter b) of the GDPR and Article 111-bis of Legislative Decree 101/2018; for this reason, there is no obligation to provide the data, but failure to provide them or inaccurate provision thereof shall make it impossible to access the selection and assessment procedure aimed at the possible establishment of an employment relationship; 

2) for the purposes referred to in previous point 4 no. 2), also carried out using partly automated decision-making processes, the legitimate interest of the Controller, on the basis of what is permitted by Article 6 letter f) of the GDPR; there is no obligation to provide the data for this purpose, but failure to perform the tests, trials and checks that may be requested of the candidate, aimed at verifying his or her soft and/or specialist skills, may make it impossible for the Controller to proceed with the candidate selection and evaluation process; this activity is carried out in full compliance with the safeguards and rights of the candidate, who may at any time exercise the rights recognised to him or her by the GDPR, in particular, the right of access, rectification and objection to the processing (referred to in point 8);

3) for the purposes referred to in previous point 4 no. 2), carried out using wholly automated decision-making processes, the consent of the data subject, on the basis of the provisions of Articles 6 letter a) and 22 paragraph II letter c) of the GDPR; failure to give consent shall not in any event prevent the Controller from asking the candidate to carry out trials, checks and tests, aimed at verifying his or her soft and/or specialist skills, including through the use of processes that are only partly automated as indicated in no. 2) above, without prejudice in any case to full compliance with the candidate's safeguards and rights;

4) for the purposes referred to in previous point 4 no. 3), the necessity to process the data for the fulfilment of legal obligations, on the basis of the provisions of Article 6 letter f) of the GDPR;

5) for the purposes referred to in previous point 4 no. 4), the legitimate interest of the Controller in the exercise and defence of its rights, including before the courts, on the basis of the provisions of Article 6 letter c) of the GDPR;

6) for the processing of special categories of data such as health status, membership of protected categories, suitability to perform certain duties, the performance of public functions, the necessity to fulfil specific legal obligations and exercise the specific rights of the data controller or of the data subject, on the basis of the provisions of Article 9, paragraph 2, letter b) of the GDPR, specifically in matters of labour law, social security, social protection, occupational medicine and assessment of the employee's working capacity, activities always carried out in the presence of appropriate safeguards for the fundamental rights and interests of the data subject; 

7)   for the video recording/asynchronous video interview requested during the selection phase, the consent of the data subject, on the basis of the provisions of Article 6 of the GDPR letter a), to process such data for the specific purposes indicated in point 4 no. 1); as specified in previous point 3, any special categories of personal data that may be present in the video recording/asynchronous video interview and that are not relevant to the purposes referred to in point 4 no. 1) shall not be processed.

6. PROCESSING METHODS AND RETENTION PERIODS

The processing of personal data shall be carried out by means of the operations indicated in Art. 4, No. 2) of the GDPR and shall take place using IT and telematic tools, according to logic strictly related to the purposes indicated and, in any case, in ways suitable to guarantee its security and confidentiality in accordance with the provisions laid down in Article 32 GDPR, by persons authorised to perform the relevant tasks, using adequate measures to guarantee the confidentiality of the data and prevent access thereto by unauthorised third parties.

In order to protect personal data, the Controller adopts appropriate technical, physical, legal and organisational security measures in order to ensure full compliance with the security rules provided for by the legislation in force.

The personal data of the Data Subject received in response to specific personnel search and selection advertisements, or relating to spontaneous applications, collected for the purposes referred to in point 4 numbers 1, 2) and 3) shall be retained for a maximum of 24 months in electronic or paper format, without prejudice to the possibility of exercising the rights recognised by the GDPR (including the right to erasure), as better specified in point 9; as regards, instead, the needs for protection of the Controller referred to in point 4, no. 4), the data shall be retained for the time necessary to ensure the exercise and defence, including in court, of the Controller's rights.

If the selection process has a positive outcome, concluding with the signing of an employment contract, the retention of the data shall be maintained for the entire duration of the work performance.

7. COMMUNICATION OF DATA

The data collected and processed may be made accessible and/or communicated for the purposes referred to in point 4:

- to employees and collaborators of the Controller, in their capacity as authorised persons and/or System Administrators, within the scope of their respective duties and/or contractual obligations relating to the performance of the contractual relationship with the data subjects;

- to third-party companies that carry out activities on behalf of the Controller, in their capacity as entities appointed as Data Processors in compliance with the provisions of Article 28 of the GDPR (by way of example, these may include other companies of the Dolomiti Energia Group that carry out activities under Intercompany service agreements and companies appointed to provide consultancy services in the search for and assessment of personnel) or in their capacity as independent Data Controllers appointed to carry out consultancy activities of various kinds (such as legal consultants, lawyers, tax consultants and accountants);

- to the entities to which they must be disclosed in fulfilment of an obligation provided for by law, by a Regulation or by EU legislation, or in order to comply with an order or measure of the Judicial Authority or other public Authorities, Public Administrations, supervisory and control Authorities, in their capacity as independent Data Controllers;

The data provided shall not be subject to dissemination except in order to comply with obligations expressly provided for by law, as indicated in previous point 4.

8. PLACE OF DATA PROCESSING

The processing of your personal data takes place within the territory of the European Union and there is no intention to transfer the data outside the European Union or to an international Organisation. Any transfers of personal data to countries located outside the European Economic Area may take place only on the basis of an adequacy decision for the country by the European Commission, in compliance with Article 45 GDPR, or through adherence to specific agreements where appropriate safeguards exist pursuant to Article 46 GDPR, or where one of the derogations specifically provided for by Article 49 GDPR applies.

9. RIGHTS OF THE DATA SUBJECT

In relation to the processing operations described in this Notice, the Data Subject may exercise, free of charge, the rights provided for by Articles 15 et seq. of the GDPR and, among these, the following are relevant for the processing in question (the description set out below is an indicative summary; for the complete statement of the rights, including the limitations thereof, reference is made to Articles 15 et seq. of the GDPR):

- Right of access to personal data (right to receive, free of charge, information regarding the personal data held by the Controller and the related processing, including the results of the tests, checks and assessments administered, as well as to obtain a copy thereof in accessible format);

- Right to rectification of data (right to obtain the correction or supplementation of your data that are not the expression of assessment elements carried out by the Controller following tests, checks and candidate evaluation assessments);

- Right to withdraw consent (where the processing is carried out on the basis of consent expressed by the Data Subject, the latter may withdraw it at any time, without prejudice to the lawfulness of the processing carried out before such withdrawal);

- Right to erasure of data (right to be forgotten) (right to obtain, without undue delay, the erasure of personal data, including following the withdrawal of consent or objection to the processing);

- Right to restriction of processing (where the legal requirements pursuant to Article 18 of the GDPR are met);

- Right to object to processing on legitimate grounds (right to object, at any time, to the processing of personal data concerning you based on the condition of legitimate interest, including the profiling activity referred to in point 4 no. 2), unless there are legitimate grounds for the Controller to continue the processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defence of a legal claim);

- Right to data portability (in the cases and according to the procedures indicated in Article 20 of the GDPR);

- Right to lodge a complaint with the Data Protection Authority using the forms available on its website, if you consider that the processing of your personal data has taken place in breach of the GDPR.

10.  EXERCISE OF RIGHTS

For any request concerning this notice or the operations described herein, including the methods of data processing, as well as to exercise the rights recognised to You by the GDPR, a communication may be sent by letter or by email to the Data Protection Officer, using the contact details indicated above.

The Controller shall take charge of your request and provide, without undue delay and, in any event, at the latest within one month of receipt thereof, the requested information. This time limit may be extended by two months, if necessary, taking into account the complexity and number of the requests.

 The exercise of rights as a Data Subject is free of charge pursuant to Article 12 GDPR; however, in the case of manifestly unfounded or excessive requests, including due to their repetitive nature, the Controller may charge you a reasonable expense contribution, in light of the administrative costs incurred to handle your request, or refuse to satisfy your request.