NOTICE ON PROCESSING APPLICANTS' PERSONAL DATA 
ARTICLES 13 & 14 OF EU GDPR REGULATION 2016/679

Metal Work S.p.A. with headquarters in Via Segni, 5/7/9, Concesio (BS), Postcode: 25062, VAT Reg. no. 03472820178, tel. 030 218711 e-mail: metalwork@metalwork.it, certified e-mail: metalworkspa-bs@legalmail.it, in its capacity as Data Controller, recruits personnel in accordance with an equal opportunities policy that complies with legislation.

Data collection methods and categories 
The Data Controller collects and processes personal contact details relating to employment and previous experience, professional qualifications, the contractual agreement and background, such as forename, surname, date and place of birth, tax code, address, gender, telephone numbers, educational qualifications, work experience and anything else applicants include in their CV.
The personal data is provided by applicants via delivery in person, post, e-mail, on forms on the company website, or via other parties, such as recruitment agencies and job centres, in order to obtain employment in the Data Controller's organisation.
People may apply as follows:

• voluntary application;
• responding to staff recruitment drives published by the Data Controller or via recruitment agencies, job centres, in newspapers or other national and foreign publications;
• responding to job vacancies displayed on the company website. 

Data processing strictly involves purely personal data concerning requirements, aims and actions relating to staff recruitment.
Data subjects should not therefore provide specific categories of data, such as data that reveals political, philosophical or religious beliefs, membership of unions or political parties, state of health or sexual orientation, genetic or biometric data, unless strictly related to seeking employment (e.g. as a member of a protected category for the purposes of recruitment).  

Purposes of Processing
The processing of the candidate’s personal data is carried out for the following purposes:

1. carrying out activities related to the search, selection and evaluation of personnel for job positions within the Company;
2. managing spontaneous applications or applications submitted in response to job advertisements;
3. complying with obligations established by laws, regulations or EU legislation, including obligations relating to mandatory or protected-category recruitment procedures;
4. establishing, exercising or defending the Controller’s rights in judicial or extrajudicial proceedings;
5. subject to the data subject’s specific consent, carrying out marketing activities and sending commercial, informational and promotional communications regarding the Controller’s products, services, initiatives and events via e-mail, telephone, SMS, newsletters or other electronic communication tools;
6. subject to the data subject’s specific consent, communicating personal data to third parties operating in the same business sector as the Controller for marketing purposes, commercial communications, market surveys and market research activities.

Legal Basis for Processing
The legal basis for the processing is as follows:

• for the purposes referred to in points 1, 2 and 3, the performance of pre-contractual measures adopted at the request of the data subject pursuant to Article 6(1)(b) GDPR and compliance with legal obligations;
• for the purpose referred to in point 4, the legitimate interest of the Controller in protecting its rights pursuant to Article 6(1)(f) GDPR;
• for the purposes referred to in points 5 and 6, the freely given, specific, informed and optional consent expressed by the data subject pursuant to Article 6(1)(a) GDPR.

Any consent provided may be withdrawn at any time without affecting the lawfulness of processing carried out prior to such withdrawal.

Nature of the Provision of Data
The provision of personal data for the purposes referred to in points 1, 2 and 3 is mandatory for the management of the application and participation in personnel search and selection activities. Failure to provide the requested data will make it impossible for the Controller to consider the application or proceed with the recruitment process.

The provision of data for the marketing and third-party communication purposes referred to in points 5 and 6 is optional. Failure to provide consent will not in any way affect the possibility of applying for or participating in personnel selection procedures.

Data processing methods 
Personal data will be processed in line with principles of fairness, lawfulness and transparency. We guarantee that data processed will be sufficient, pertinent and not excessive with regard to meeting the purposes of the processing (data minimisation principle).
Data will be processed manually on paper and electronically with tools designed to guarantee data security and confidentiality, in accordance with the requirements of the GDPR. 
Processing may be carried out using automated tools designed to store, manage and transmit the data, in accordance with the regulations. 
Your data will be processed via the collection, logging, organisation, structuring, storage, modification, extraction, consultation, use, transmission, circulation of the data, or any other type of distribution, comparison, interconnection, restriction, deletion or destruction operations.
The Data Controller will use suitable security measures to ensure the confidentiality, integrity and availability of your personal data, and require third-party suppliers and data processors to adopt similar security measures. 
Personal data will be stored in paper, electronic and remote archives situated in countries where the GDPR applies (EU countries). 

Storage and destruction timescales
Personal data will be processed for 6 months, after which it will be destroyed using secure destruction methods (overwriting, wiping, document shredding).
In the event of legal defence requirements, personal data will be stored for the duration of the proceedings, until the timescales for appeal proceedings and/or legal protection have lapsed. 

Data communication
Personal data may be disclosed to:

• employees and collaborators authorised to process personal data;
• companies belonging to the corporate group;
• providers of IT, management, administrative or recruitment services;
• appointed consultants and professionals;
• third parties operating in the same business sector as the Controller, exclusively subject to the data subject’s specific consent;
• public authorities or judicial authorities where required by law.

Entities processing personal data on behalf of the Controller are appointed as Data Processors pursuant to Article 28 GDPR, where required.

Transfer of data to countries outside the EU: 
Your data will not be transferred to countries outside of the EU.

Rights of data subjects (articles 15-22 of the GDPR) 
At any time you have the right to obtain confirmation of the existence of your personal data, understand its origin, check its accuracy or ask for it to be supplemented, updated or amended.
To do this please submit a request in writing, with the date and your signature, and send it by e-mail or registered post with acknowledgement of receipt.
We will respond to your request within one month, except in particularly complex cases, when a response could take up to a maximum of 3 months. We will however provide an explanation if a longer response time is expected, within one month of receiving your request.
The outcome will be sent in writing or electronically. If you request an amendment, deletion or restriction of processing, we undertake to communicate the outcome of your request to each of the recipients of your data, except where this is impossible or requires disproportionate effort.
We remind you that withdrawing consent will not affect the legitimacy of the processing based on consent given prior to the withdrawal request.
With regard to processing the aforementioned data, you have the right to obtain the following:

1. confirmation of the existence of your personal data, its communication in an intelligible format, understanding of its origin, and the logic at the basis of its processing;
2. deletion of your personal data within a reasonable timescale, its transformation to make it anonymous, or block data processed in breach of legislation;
3. have data updated, supplemented or amended;
4. confirmation that the operations referred to in 2) and 3) above were made known to parties to whom the data was communicated, except where this is impossible or involves disproportionate methods;
5. to have your personal data amended or deleted, or its processing restricted;
6. the right to withdraw consent to processing which is optional and is not related to executing the contract agreed with the Data Controller.

You also have the right to object to your data being processed, even if it is relevant for the purpose it was collected, request data portability, exercise your right to be forgotten, and to contact legal authorities and the Supervisory Authority for the protection of personal data to report any alleged breach through the methods indicated on the Authority's site at www.garanteprivacy.it.

Automated decision-making processes: 
The Data Controller does not use automated decision-making processes, including profiling  defined by the GDPR as any type of automated data processing to use the data to assess personal aspects relating to individuals, in particular for analysing or predicting aspects relating to professional performance, financial situation, health, personal preferences, interests, reliability, conduct, location or movements regarding these individuals.