Last update: 3 July 2018 (Version 1.1)
1) Who is the Data Controller of your personal data?
The Data Controller of the processing carried out through the Site is Carlo Rossi Chauvenet (hereinafter referred to as Carlo Rossi Chauvenet): “Owner"), with an address for service in Piazza Duomo No 20, Milan. For any information regarding the processing of personal data by the Owner you can write to the following address: [email protected].
2) What is meant by personal data and what data do we process?
3) Why do we process your personal data?
First of all, we collect and process personal data about you that is strictly necessary to respond to your requests and services. In particular:
a) Respond to requests for assistance, information or quotes via the "Contact Us" section;
(b) Analyse the CVs and contact the candidates who have submitted their applications via the 'Work with us' section;
c) Send communications of an informative or informative nature, invitations to webinairs following registration with the "Legal Tech Focus" service, including any invitations to events and/or conventions organized and/or sponsored by the Firm;
(d) To fulfil any legal obligations (e.g. accounting and tax). In any case, we are committed to ensuring that the information collected and used is appropriate for the purposes described, and that this does not lead to an invasion of your personal sphere.
4) On the basis of what condition of lawfulness do we process your personal data?
The condition of lawfulness of the processing of personal data for the purposes referred to in section 3(a) and 4(c) is art. 6(1)(b) as the processing is necessary for the provision of the Services and for the response to requests from the data subject. In particular, the provision of personal data for these purposes is optional, but failure to provide such data would make it impossible to activate the Services provided by the Site, to respond to requests or to evaluate CVs.
With specific reference to the purpose 3(b) and the related analysis of the professional social profiles made freely available on the Internet referred to in section 3, the legal basis for the processing is Article 6(1)(f) of the Regulation, i.e. our legitimate interest in verifying any risks on the candidate's suitability to fill the specific open position.
The purpose referred to in section 4(d) represents a legitimate processing of personal data pursuant to Article 6(1)(c) of the Regulation. Once the personal data has been provided, the processing is indeed necessary to fulfil a legal obligation to which we may be subject.
5) How do we treat your data?
Your personal data may be processed by means of manual processing or electronic or automatic instruments, according to logic strictly related to the purposes or in any case so as to ensure the confidentiality and security of Personal Data (with particular regard to the use of remote communication techniques).
6) To whom do we communicate your data?
Your Personal Data may be shared, for the purposes set out in section 4 above, with:
- parties who typically act as external data processors upon our appointment, i.e.: i) persons, companies or professional firms that provide assistance and advice on accounting, administrative, legal, tax, financial and credit recovery matters in relation to the provision of Services; ii) parties with whom it is necessary to interact in order to provide Services (e.g. hosting providers or banking institutions) iii) or parties delegated to carry out technical maintenance activities (including the maintenance of network equipment and electronic communication networks);
- persons, entities or authorities to whom it is obligatory to disclose your personal data pursuant to legal provisions or orders of the authorities;
- subjects who collaborate with the Firm for the organization of events;
- authorised persons authorised to process Personal Data, necessary to carry out activities strictly related to the provision of the Services, who are committed to confidentiality or have an adequate legal obligation of confidentiality (e.g. collaborators of the Data Controller).
7) Where do we transfer your data?
We do not normally transfer your data outside the European Union. Should this be the case, we make sure that the recipient complies with the provisions of the Regulation including the rules specifically dictated for the transfer of personal data to third countries. In particular, we ensure that such transfers are made on the basis of an adequacy decision or the signature by the data controller of standard contractual data protection clauses approved by the European Commission.
8) How long do we keep your data?
We keep your data only for the time necessary to perform the processing for the above mentioned purposes. In particular, we report below the main periods of use and storage of your personal data with reference to the different purposes of processing: - with reference to the processing for recruitment purposes of staff and collaborators we will process your data for up to 24 months after receiving your CV; - for the fulfilment of legal obligations, your data will be processed and stored for as long as the need for processing to fulfil these legal obligations persists.
9) What are your rights?
- Access: you have the right to obtain confirmation as to whether or not your data is being processed and the right to receive any information relating to the same processing.
- Rectification: you have the right to have your data corrected if it is incomplete or inaccurate.
- Deletion (the so-called "right to be forgotten"): in certain circumstances, you have the right to obtain the deletion of your data in our files if it is not relevant for the continuation of the contractual relationship or necessary for legal obligations.
- Limitation of the processing: if certain conditions are met, you have the right to obtain the limitation of the processing, if not relevant for the continuation of the contractual relationship or necessary for legal obligation. - Right to portability: you have the right to obtain the transfer of your data to a different data controller.
- Opposition: you have the right to object, at any time for reasons related to your particular situation, to the processing of data concerning you based on the lawfulness of the legitimate interest or the performance of a task in the public interest or the exercise of public authority, including profiling.
- Revocation of consent: you have the right to revoke your consent to the processing of your data at any time, without prejudice to the lawfulness of the processing based on consent before revocation. Requests for the exercise of privacy rights should be addressed in writing to the following address: [email protected]. The exercise of your rights as an interested party is free of charge in accordance with Article 12 of the Regulations. In any case, you are always entitled to lodge a complaint with the competent Control Authority (Guarantor for the Protection of Personal Data), pursuant to art. 77 of the Regulations, if you believe that the processing of your Personal Data is contrary to the regulations in force.