1. Who we are

This information is made available to you pursuant to art. 13 of the European Regulation 2016/679 on the protection of personal data (hereinafter also “Regulation” or “GDPR”), subsequent amendments and additions, and in any case to the regulations in force at the time – also pursuant to art.13 of D.Lgs.30/06/2003 n. 196 Code for the protection of personal data (“Privacy Code”), by Arpa Consulting S.r.l. (hereinafter also “ARPA” or the “Company”), in its capacity as Data Controller of your personal data.

Arpa Consulting S.r.l., with registered office in Turin (TO). Corso Re Umberto n.65, is a company authorised by the Ministry of Labour and Social Policies to carry out personnel search and selection activities pursuant to art. 4, paragraph 1, letter d) of Legislative Decree n. 276 of 2003 (authorisation no. 9697 of 5 April 2007) and registered in the Register of Employment Agencies.

By “Candidate” herein is meant the person Arpa Consulting S.r.l. considers in the context of personnel search and selection programmes

2. Categories of personal data processed

In the context of existing relations, your personal data that ARPA will process relate to the following categories:

1. data relating to your person, such as, but not limited to: name, surname, tax code, nationality, place and date of birth, residence and home addresses, landline and mobile telephone numbers, email addresses, etc.;
2. personal data relating to your family, such as, but not limited to: marital status, family composition, residence, etc.;
3. data relating to your Curriculum Vitae, from your education to your career, such as, by way of example and not limited to: educational qualifications, work experience, current and previous roles and duties, grading, promotions, performance and results obtained, hobbies and personal preferences, voluntary activities, etc;
4. data relating to your remuneration such as, but not limited to: gross annual remuneration, bonuses, stock options, insurance, company assets assigned as benefits, etc.;
5. Your images and audio and video recordings.
6. Your sensitive data, to the extent necessary and legally permissible, such as, but not limited to: Your health data, judicial data, residence permit, etc.

The collection of your data may take place by means of your communication to ARPA through different channels: by e-mail, by telephone or Skype, by registration of the data on our site, by direct interviews with employees of the Company, etc.

ARPA may also acquire your data on internet portals, where the latter have already requested and obtained from you the consent to disclose it to third parties who have acquired the right to do so.

In addition, the data may also reach the Company directly from its own clients or third parties that have requested and obtained your consent.

3. Legal basis and purpose for which we process your personal data

ARPA is a company specialized in human resources development and management consulting, which in particular carries out, on behalf of its clients, research and selection of personnel for executive, board, managerial and professional positions.

The company, processes your data with your explicit consent, in order to be able to consider your possible candidature within the scope of the above-mentioned search activities, and in particular:

• represent your personal and professional profile;
• propose your professionalism to our client companies, entities and organizations that have entrusted us with a specific task and are looking for personnel to be included in their staff;
• fulfil legal obligations to which the Company is subject;
• ascertain, exercise or defend rights in court or whenever judicial functions are exercised.

The company, in pursuit of the objective of protecting the privacy of its candidates, which is closely linked to the above-mentioned activity, makes every effort to ensure that the processing of your personal data is carried out with respect for your

rights, fundamental freedoms and the dignity of persons, with particular reference to confidentiality and personal identity, in accordance with the provisions of the Regulation.

4. Sharing and transfer of your personal data

The data collected by ARPA will only be shared for the above purposes; we will not share or transfer your personal data to third parties other than those indicated in this Policy.

In the course of our activities and exclusively for the same purposes as those listed in this Policy, your personal data may be transferred to the following categories of recipients:

1. staff of ARPA;
2. consultants working with ARPA;
3. customers of ARPA;
4. Third Party companies that assist ARPA in research activities.

ARPA may need to transfer your personal data to countries outside the European Union (EU)/European Common Space (EEA), to so-called “third countries”. Such transfers to third countries may include all the processing activities described in section 3 above. This Privacy Policy is also applicable in the case of data transfers to third countries where the level of data protection differs from that in the European Union. In particular, the international transfer of data may take place in the following situations:

1. third parties outside the European Union/EEA: any transfer of personal data to third parties will only take place after informing you and, where required, after receiving your consent. Any transfer of data to countries other than those for which the European Commission has taken an adequacy decision shall take place on the basis of agreements using standard contractual clauses adopted by the European Commission or other appropriate safeguards in accordance with applicable law.

You can request further information in relation to international transfers of personal data and obtain a copy of the adequate protection put in place by exercising your rights as set out in Section 8 below.

6. Protection of your personal data

ARPA will process your data both manually, with paper supports, and with computer and telematic instruments. Your data will be stored in files that are our exclusive property and will be accessible only by our staff or by our duly authorised and controlled personnel.

The Company has implemented appropriate technical and organisational measures to provide a suitable level of security and confidentiality for personal data.

These measures take into account:

1. the state-of-the-art technology;
2. the costs of its implementation;
3. the nature of the data; and
4. the risk of the processing.

The aim is to protect against accidental or unlawful destruction or alteration, accidental loss, unauthorised disclosure or access, and other forms of unlawful processing.

Furthermore, when handling your personal data, ARPA:

1. collects and processes data that are adequate, relevant and not excessive to fulfil the purposes stated above;
   
2. ensures that it is accurate and remains reasonably up to date on the basis of your communications. 
   

7. Retention periods for your personal data

Without prejudice to your right to object to the processing of your personal data and/or to request its deletion, ARPA will only retain your personal data for as long as necessary to fulfil the purpose for which it was collected or to meet contractual, legal or regulatory requirements.

The retention period is therefore the time of their actual use, plus the period of time until contractual obligations and legal requirements are prescribed, unless the timing of legal or regulatory planning requires a longer retention period. When this period expires, your personal data will be removed from active systems and/or anonymised.

8. Your legal rights

The rights associated with the personal data that ARPA processes are:

• Right to rectification: You may obtain from ARPA the rectification of personal data concerning you or communicated to us by you. ARPA makes reasonable efforts to ensure that the personal data in its possession are accurate, complete, up to date and relevant, based on the most recent information made available by you;
• Right to restriction: You may obtain a restriction on the processing of your personal data if:
  1. you contest the accuracy of your personal data during the period in which ARPA has to verify its accuracy;
  2. the processing is unlawful and you request a restriction of the processing or deletion of your personal data;
  3. there is no longer a need for ARPA to retain your personal data but you need it to establish, exercise or defend your rights in court; or
  4. You object to the processing while ARPA verifies whether its legitimate reasons prevail over yours;
• Right of access: You can ask ARPA for information about the personal data stored about you, including information about which categories of personal data ARPA owns or controls, for what purpose they are used, from where they were collected (if not directly from you), and to whom they may have been disclosed;
• Right to portability: following your request, ARPA will transfer the personal data provided by you in electronic format, to another Data Controller, if technically possible, provided that the processing is based on your consent or is necessary for the performance of a contract;
• Right to erasure: You may obtain from ARPA the erasure of your personal data if:
  1. the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
  2. You have the right to object to further processing of your personal data and exercise this right to object;
  3. personal data have been processed unlawfully;

unless the processing is necessary because of legal or statutory obligations or for the establishment, exercise or defence of legal claims;

• Right to object: You may object to the processing of your personal data at any time, provided that the processing is not based on your consent but on the legitimate interests of ARPA or of third parties. In such cases ARPA will no longer process your personal data unless you can demonstrate compelling legitimate grounds, an overriding interest in the processing or establishment, or the exercise or defence of a legal claim. If you object to the processing, please specify whether you wish to delete your personal data or to restrict their processing;

Right to lodge a complaint: in the event of an alleged violation of the applicable data protection law, you may lodge a complaint with the competent authorities in your country or in the place where the alleged violation occurred.

9. Changes to this privacy policy

Any future changes or additions to the processing of personal data as described in this Policy will be notified in advance by means of an individual notification through the usual communication channels used by ARPA (e.g. by e-mail) or via the Company’s corporate website (www.arpaconsulting.it).

10. Data Controller and Processor

The data controller of your personal data is Arpa Consulting S.r.l. in the person of its pro-tempore legal representative.

By sending an e-mail to the following address info@arpaconsulting.it you will be able to receive further information on the data provided as well as request an updated list of the persons appointed to process the data.

Arpa Consulting S.r.l.

The legal representative (Allegra Piano)