Policy statement and concurrent request for consent to the processing of personal and sensitive data pursuant to article 13 of EU Regulation no. 679/2016 (GDPR) and current regulation

This policy statement is provided pursuant to article 13 of the EU General Data Protection Regulation no. 679/2016 (hereinafter referred to as the “GDPR” or the “Regulation”) and pursuant to current regulation; the aim is to illustrate the purpose and the way in which personal information provided by the candidate to Value Search S.r.l. is used, shared, accessed, amended or erased. Value Search S.r.l. is an executive search company authorised by the Ministry of Employment and Social Policies to provide personnel search and selection services as per article 4, paragraph 1, paragraph d) of Legislative Decree no. 276 of 2003 (authorisation no. 9712 of 05/04/2007) and is registered with the Employment Agency’s National Computerised Register.
The processing of your personal data (here in after “Data”) shall be performed by Value Search S.r.l. (hereinafter referred to as “Value Search” or the “Company”) in its capacity as Data Controller (see point 6 for corporate data). As you are aware, the Company provides search and selection services in respect of managers and corporate specialists (hereinafter the “candidates”). Pursuing its aim of safeguarding the privacy of its candidates, the Company shall do everything in its power to ensure that the processing of personal data respects every person’s rights, fundamental freedoms and dignity, with particular regard to confidentiality and personal identity, in accordance with the provisions of the Code and the Regulation, in the manner set forth in the following paragraphs.

. Personal data being processed and collection procedures

1.1 Candidates’ “personal data” or “data” means any information relating to an individual who is identified or identifiable, including indirectly, with particular regard to an identifier such as the name, an identification number, data pertaining to location or an online identifier.

1.2 Candidates’ data is collected via various channels: electronic mail, mobile phone, registration by invitation and provision of one’s data to the site cv.valuesearch.eu (hereinafter the “Site”), or by means of direct interviews with Company representatives.

Value Search may also acquire candidates’ data from internet portals, where consent has already been requested and obtained from candidates to their data being disseminated to companies which have acquired the related rights. Lastly, candidates’ data may be sent directly to Value Search by its corporate clients or third parties which have requested and obtained consent from the candidates.

1.3 Personal data collected in the manner described above falls into the following categories:
• identification data (name, residence and domicile address, email, telephone numbers, age, sex, place and date of birth);
• personal data pertaining to education and work (curriculum vitae, qualifications, professional skills, job responsibilities, department, job function, remuneration and any corporate property assigned to the employee as benefits or suchlike);
• photos and video CV’s.

1.4 We hereby inform you that as expressly authorised by the Data Protection Authority, we are authorised to process sensitive data. Nevertheless, given the purpose of collecting data as specified in point 2.1, candidates are asked to omit sensitive data, or data concerning their ethnic origins, religious, political or philosophical opinions or other types of opinions relating to support for a political party, in addition to other information pertaining to their health and sex lives.

1.5 You are also requested not to provide any confidential information pertaining to third parties, including individuals or legal entities, or information which is covered by candidates’ nondisclosure agreements and specifically, but not solely, companies where candidates have worked or companies where they are currently working.

2. Purpose and legal basis of data-processing

2.1 The personal data which you provide in the manner set forth in point 1.2 or data which is acquired by Value Search as part of its routine activities shall be processed solely for the following purposes:
• in order to outline your personal and professional profile;
• in order to recommend your professional profile to companies, bodies and organisations which are our clients, which have specifically appointed us and which are seeking personnel to add to their staff;
• in order to comply with legal obligations to which Value Search is subject;
• in order to ascertain, exercise or defend rights in legal proceedings or whenever jurisdictional functions are exercised.

2.2 Consent to the processing of personal data in order to achieve the above purposes is deemed to have been obtained when the personal account on the Site (hereinafter referred to as “personal account”) is opened and when this policy statement is concurrently signed; your consent is deemed to have been revoked when you close the aforementioned account.
In all cases, within two years of the date on which the account is opened, notification shall be sent to the candidate to remind him that his data is being processed and that he is entitled to object thereto at any time and in the manner set forth in point 7.1.

2.3 Provision of personal data by candidates for the above purpose is optional. However, should candidates fail to provide the data, this will make it impossible for the Company to consider their candidacy as part of a selection process in addition to other related services.

3. Manner in which data is processed and data retention timeframe

3.1 Candidates’ data shall be processed both manually, using hard copy documents and electronic and online instruments by persons appointed by the Company in compliance with rules governing nondisclosure and security in accordance with law. Specific security measures are complied with in order to prevent the loss or alteration of data, unlawful or incorrect use, unauthorised access or processing which is disallowed or which fails to respect the reason for processing.

Your data shall be placed in files belonging to our company and shall be available solely to our personnel or our data-processing agents who have been duly authorised and vetted.

3.2 Data-processing shall be performed in accordance with the provisions of the Privacy Code, by GDPR and in accordance with legislation applicable at any one time, for as long as is necessary in order to achieve the aims of data collection and for as long as the candidate’s personal account remains active.
Nevertheless, should the candidate wish, for any reason, even if the purpose of data processing has not been met, to terminate the processing of his data, he may make an express request to the Data Controller in the manner indicated in point 7.2 or otherwise may independently proceed to close his personal account. Once the personal account is closed, all data provided shall be immediately erased and/or anonymised.

4. Scope of data communication and dissemination

4.1 In order to achieve the above purpose, all personal data provided shall only be processed by persons who have been so tasked by Value Search, in other words employees, freelance contractors and Value Search’s internal and external consultants appointed in writing such as internal or external data-processing agents or data processors responsible for processing your data and who have received specific instructions to this end.

4.2 Your personal data may also be sent and transferred:

• to all those whose entitlement to access personal data has been acknowledged by legal provisions and secondary laws or by instructions given by authorities which are entitled to do so by law;

• to Value Search’s client companies including those whose registered offices are abroad (in Europe or outside Europe), by sending your curriculum vitae, should they so request.

5. Transfer of cross-border data
Your data are intended for client companies in Italy and in the European Union and may also be communicated and transferred to client companies outside the European Union in accordance with the conditions laid down by law to ensure that such data transfer is lawful. Specifically, this transfer of data may take place to companies present in the United States which have complied with or which will comply with what is known as Privacy Shield, vis-a-vis companies in other countries outside the European Union regarding which the European Commission has adopted an adequacy determination or failing this, compliance with other conditions required by law.

6. The Data Controller and the Data Processor
The Data Controller in respect of your personal data is Value Search S.r.l., having its registered office in Milan, Viale Piave n. 28, in the person of its pro tempore legal representative. Within the framework of the Company’s organisational structure, a Data Processor has been selected and appointed and you may contact this person in order to exercise your rights in accordance with the provisions of articles 15 et seq of the EU Regulation no. 679/2016 and of current regulation as specified in point 7 below, in the person of Ms Giovanna Brambilla.
Furthermore, by sending an email to the following address info@valuesearch.it or by phoning 028356656 you can receive further information regarding the data you provide and you may request an updated list of all persons appointed as data processors and data-processing agents.

7. Data Subject’s Rights

7.1 You are hereby informed that article 7 of the Privacy Code and articles 15 et seq of the GDPR grant users specific rights vis-a-vis the Data Controller. Specifically, you may:

• obtain confirmation as to whether or not your data is being held in addition to access to personal data concerning you, even if you are not yet registered and you may make a request to discover the source of same, subject to third-party rights, in addition to the purpose thereof, the data retention timeframe, data-processing procedures and criteria adopted should data be processed using automated instruments;

• revoke your consent, if given, to the processing of your personal data, subject to the legality of data processed up to that time;

• receive your processed personal data in a commonly used structured format which can be read by automatic devices, and, except in cases where it is not technically feasible, directly send your data to another Data Controller;

• obtain the erasure, anonymisation or blocking of data which it is not necessary to retain in respect of the purpose for which the data has been collected and processed;

• obtain the updating, correction and completion of your processed data;

• raise objection either in its entirety or partially, for legitimate reasons to the processing of personal data concerning you, even though such processing may be pertinent to the reason for which such data is collected;

• file a complaint to the Supervisory Authorities.
The fact that you exercise your rights does not compromise and/or adversely affect the rights and freedoms of others, including industrial and corporate secrecy and intellectual property.

Specifically, access rights are limited to the personal data provided by you and do not extend to any professional processing of same performed by Value Search which becomes the sole owner. Nevertheless, should you exercise your right to erase your data, the results of these operations shall be deleted and/or anonymised in order to ensure that under no circumstances may they be identified.

7.2 You may exercise these rights directly through your personal account in the manner set forth therein or otherwise at any time by writing an email to the address of the Data Controller indicated above or by email to the address info@valuesearch.it.

7.3 It is agreed that should the requests be submitted through electronic means, the information shall be provided to you free of charge and in a commonly used electronic format.

 Should the user’s requests be patently groundless or excessive, particularly with regard to their repetitive nature, Value Search may choose to:

• charge the user for a reasonable contribution, taking into consideration the administrative costs incurred for providing the information or the notification or communication for undertaking the requested action;

• refuse to meet the request.
In both circumstances the Company provides sufficient justification to the user.

7.4 Rights referring to personal data belonging to people who are deceased may be exercised by whosoever has a vested interest therein. In order to exercise the rights as per article 7 of the Privacy Code and as per articles 15 et seq of the Regulation, the data subject may, in writing, delegate or grant a power of attorney to individuals or to associations.