Information on candidates and suppliers

Privacy information for suppliers and candidates

(“Information”)

(version “01”, February 2020)

 

Index:

Data controller and contact details

Normative requirements

Cookies

Interested in the processing and recipients of the Information

Categories of personal data processed, purposes and related legal basis

Revocation of consent and retention period of personal data

Authorized and other recipients of personal data

Transfer of data abroad (outside the EU and EEA)

Rights of interested parties

Complaint

Updates and revisions to the information

 

***

 

Data controller and contact details

The data controller of supplier and candidate data is the company Steve Srl (“Company”). The contact details of the Company are as follows:

Viale Italia, 16

07100 - Sassari

E-mail:

privacy@desoleabbigliamento.it

info@desoleabbigliamento.it

telephone: +39 079/2019202 - +39 079/2019208

The same data is published and available for consultation in the "Contacts" section of the Company's website www.desoleabbigliamento.it (“Site”). Through the Site, through the relevant eCommerce platform, the Company carries out its commercial sales and distribution activity in the clothing sector, providing its users and customers as well as, for the purposes of this information, suppliers and candidates, the related services ( "Services").

Normative requirements

The Information is provided by the Company pursuant to article 13 of Regulation (EU) 679/2016 (“GDPR”) on the protection of personal data and in compliance with Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, as well as the provisions of the Guarantor Authority for the protection of personal data ("Guarantor").

Cookies

For the processing of navigation data carried out using cookies, please refer to the relevant Cookie Policy published on the Site.

Interested in the processing and recipients of the Information

Subjects interested in whom it is destined the Information (“Data Subjects”) are i providers of the Company ei candidates , who, respectively:

  1. provide services of any nature to the Company;
  2. they send their own curricula to the Company's contact details and/or through the Site, to apply for the open job positions reported by the Company or who spontaneously send their CV to express their interest in working at the Company.

As part of these relationships, the Company processes the personal data of the interested parties for the purposes and in the manner described below.

Categories of personal data processed, purposes and related legal basis

The following are listed categories of personal data of suppliers and candidates treated by the Company as part of the Services and their respective relationships, in compliance with:

  1. minimization principle of the data (article 5.1.c. of the GDPR),
  2. principle of purpose limitation , with indication of the relative specific processing purpose (article 5.1.b. of the GDPR) e
  3. principle of lawfulness, with indication of the relative legal basis for each purpose (article 5.1.a. of the GDPR).

For the purposes of the processing described below, the Company does not need to process particular categories of personal data , as defined in Article 9 of the GDPR (data on racial and ethnic origin, religious or philosophical beliefs, trade union or political membership, data relating to health, biometric, genetic or orientation sexual), therefore, suppliers and candidates are asked not to send these categories of data , without prejudice to the fact that if received, the Company will immediately delete them.

 

Personal data:

Purpose:

Legal basis:

common and contact details : name, surname, email, telephone, addresses, VAT number, PEC, economic and payment data of natural person suppliers and legal person supplier contacts

these data are processed for the purpose of:

  1. respond to requests for information of suppliers forwarded through the Site or in general as part of the management of the relevant commercial relationships;
  2. manage the relationship with suppliers or with the suppliers' representatives (from the assignment of the assignment/mandate to payment and invoicing) as part of the services provided by the latter to the Company;
  3. send newsletters and information material on Supplier Services

for the purposes (the) And (ii) the legal bases of the processing are, respectively,

  • the execution of pre-contractual measures And
  • the fulfillment of contractual and legal obligations towards suppliers (article 6.1.b. and 6.1.c. GDPR);

for the purpose (iii) the legal basis of the processing is

  • The consent of the supplier to send newsletters (article 6.1.a. GDPR)

data contained in curricula sent by candidates : including personal data and data relating to the candidate's positions and work and training experiences.

These data are processed by the Company exclusively for purposes of selecting the candidate for the purposes of hiring and evaluating professional aptitude necessary according to the specific task to be carried out and for the related job placement. In any case, the limits and prohibitions regarding data processing provided for by articles 111 -bis are respected. and 113 of Legislative Decree 196/2003 and in matters of labor law. The personal data belonging to the particular categories referred to in Article 9 of the GDPR and of a judicial nature possibly contained in the CVs, they will not be used by the Company and will be immediately deleted

for this purpose the legal basis of the processing is

  • the execution of pre-contractual measures And the fulfillment of contractual obligations (article 6.1.b. GDPR)

Revocation of consent and retention period of personal data

The processing of data for which consent is required lasts until the consent is revoked , the revocation or refusal to give consent leads to the interruption or impossibility of sending newsletters and information material.

The data retention time processed on legal bases other than consent is determined by the type of relationship established:

  1. with i suppliers , as a result of the contractual relationship in place with the Company, the relevant personal data are processed for the entire duration of the contractual relationship and, without prejudice to the data that must be retained on the basis of legal obligations, the Company deletes the data after termination of the relationship;
  2. with i candidates , in the event that the candidacy leads to hiring, the specific information for Company employees applies; in the event, however, of the candidate not being selected, the CV is immediately canceled by the Company. More extensive conservation of curricula it may be necessary in the event that the Company draws up rankings for the future selection of candidates.

In any case, the Company, in accordance with the principle of storage limitation referred to in article 5.1.e) GDPR, carries out a periodic check, every 5 years starting from January 2020, to determine whether there is data from suppliers or curricula of candidates with whom there have been no relationships of any kind for more than 5 years from the last contact, after which the relative data will be deleted.

Supplier data relating to invoicing and to keeping of accounting records they are kept for ten years from the date of issue of the invoice or the last entry in the accounting books.

The possible establishment of a proceeding before the judicial authorities or any negotiations/agreements of an extrajudicial nature in progress between the Company and the interested parties, entail the extension of the aforementioned data retention terms and criteria

Authorized and other recipients of personal data

The personal data of suppliers and candidates are processed by the Company's staff in accordance with the authorizations and instructions specifically provided to each employee/collaborator, however bound by obligations of confidentiality on personal data and the processing limits deriving from the specific task or assignment carried out under the the authority of the Company.

In addition to the aforementioned subjects, the personal data of suppliers may be communicated by the Company, within the limits of achieving the purposes for which they are processed, to the following categories of subjects:

  1. IT infrastructure development, management, support and maintenance providers;
  2. suppliers of software management, applications and hardware and related assistance/maintenance and management;
  3. providers of connectivity and email services and related management, assistance/maintenance;
  4. legal, safety/quality, accounting and tax consultants;
  5. communication and marketing agencies;
  6. Authorities and public bodies, even outside the purposes for which the data were initially collected.

THE curricula of the candidates are processed exclusively internally by the Company's authorized personnel and, in rare cases, they may be communicated to employment consultants or accountants for recruitment purposes.

Among the recipients of the data, the subjects who carry out processing operations on behalf of the Company as data controllers, pursuant to Article 28 of the GDPR, have been specifically authorized and instructed by the Company through a specific contractual agreement. The list of managers involved in the processing can be requested from the Company, which will make the relevant information available.

Transfer of data abroad (outside the EU and EEA)

There is no transfer of personal data outside the EU or European Economic Area (EEA). Should the transfer occur to countries outside the EU or the European Economic Area (EEA), this will take place, in any case, after verification of compliance with the provisions contained in articles 44 et seq. of the GDPR and prior communication regarding the third country of destination of the data and the safeguard mechanism based on the provisions of the GDPR.

Rights of interested parties

Browsers, suppliers and candidates can contact the Company or any external managers to exercise the rights provided for by the GDPR (articles 15 et seq.) and by the National Data Protection Laws as applicable, and, in particular, to access the own personal data, request rectification, updating or cancellation, limitations, as well as request portability, by sending a communication to the Company contact details indicated above.

Complaint

Each interested party who believes that the processing of data concerning him or her is carried out in violation of the GDPR, in compliance with the provisions of Article 77 of the GDPR, may lodge a complaint with the supervisory authority where the interested party habitually resides or works or to a supervisory authority where the alleged data breach occurred.

Updates and revisions to the information

 

The Company reserves the right to modify and/or update the Information, also taking into account any subsequent additions and/or modifications to national and/or European Union regulations regarding the protection of personal data or as a result of any further purposes of data processing. For this reason the information is published with the progressive identification number and the month of publication. The new versions of the Information will replace the previous ones and will be valid, effective and applied from the date of publication on the Site or from the date of communication to interested parties.