CANDIDATE PERSONAL DATA PROCESSING NOTICE

PURSUANT TO ARTICLE 13 OF REGULATION (EU) 2016/679

Dear Sir/Madam,

We wish to inform you that our Company is the Data Controller of the personal data you provide for recruitment and personnel selection purposes.

1. Identification details of the Data Controller

The Data Controller is VALE HOSPITALITY MANAGEMENT, Galleria del Corso, 1 – 20122 Milan (MI), Italy, privacy@ih-hotels.com.

The list of Data Processors is available upon request.

2. Purposes and legal basis of data processing

Personal data and, where applicable, special categories of personal data (if voluntarily provided by the Candidate) will be processed exclusively for the following purposes:

• Recruitment and personnel selection activities. The legal basis for the processing is the performance of pre-contractual measures taken by the Data Controller at the request of the Data Subject, pursuant to Article 6(1)(b) of the GDPR;
• To allow Vale Hospitality Management to exercise or defend its rights in legal proceedings and to address unlawful conduct. In this case, the legal basis for the processing is the legitimate interest of the Data Controller, pursuant to Article 6(1)(f) of the GDPR, relating to the establishment, exercise or defence of its own rights or those of a third party.

The Data Subject has the right to object, at any time, to the processing of his or her Personal Data based on the legitimate interests of the Data Controller.

3. Methods and duration of processing

For the purposes indicated above, your data will be processed both electronically and in paper format. Processing operations are carried out in such a way as to ensure the logical and physical security and confidentiality of your Personal Data.

Your Personal Data contained in your Curriculum Vitae will be retained for a maximum period of 6 months from the date of receipt, unless an employment relationship is established or a different retention period is required for the protection of the Data Controller’s rights.

4. Categories of Personal Data

The Data Controller processes the following Personal Data provided by the Candidate through the completion of the dedicated form available on the ihhotels.com website:

a) Identification and contact details: first name, surname, tax identification number, photograph and introductory video, gender, date of birth, address or other personal identification details, telephone number and email address;

b) Education and professional background: including education, professional experience, references, distinctions, awards and certifications.

5. Mandatory or optional nature of providing Personal Data

Providing Personal Data through your CV is not mandatory; however, it is necessary in order to participate in the recruitment and selection process.

Failure to provide the Personal Data indicated above may make it impossible to proceed with the recruitment process and the assessment of your application.

6. Scope of communication and disclosure of Personal Data

Candidates’ Personal Data will be processed by personnel of Vale Hospitality Management who have been specifically designated as persons authorised to process Personal Data, where necessary for the purposes set out in Section 2 of this Notice.

The Data Controller also informs Candidates that their Personal Data may be disclosed, for the purposes described above, to third parties specifically appointed as external Data Processors, including:

• Service providers specifically appointed to carry out recruitment, personnel selection and assessment activities;
• IT service providers.

The complete list of recipients of Candidates’ Personal Data, including further details regarding their locations, is kept at the Data Controller’s registered office and may be consulted upon request by contacting the Data Controller using the contact details provided in Section 7.

The Data Controller also informs Candidates that their Personal Data will not be otherwise communicated to third parties or publicly disclosed.

7. Rights of the Data Subject

Pursuant to Regulation (EU) 2016/679 (Articles 15–22), Data Subjects may exercise the following rights in relation to the Data Controller and/or Joint Data Controllers:

• Right of Access: The Data Subject has the right to access the Personal Data concerning him or her that is being processed, in order to verify whether such Personal Data is being processed in accordance with applicable law.
• Right to Rectification: The Data Subject has the right to obtain the rectification of inaccurate Personal Data and the completion of incomplete Personal Data concerning him or her, in order to ensure that such information is accurate in light of the purposes of the processing.
• Right to Erasure: The Data Subject has the right to request the erasure of his or her Personal Data and to request that such data no longer be processed, where the conditions provided for by applicable law are met.
• Right to Restriction of Processing: The Data Subject has the right to request that the Data Controller restrict the processing of his or her Personal Data in the circumstances provided for by the GDPR.
• Right to Data Portability: The Data Subject has the right to receive his or her Personal Data in a structured, commonly used and machine-readable format and to transmit such data to another Data Controller, where applicable.
• Right to Object to Processing: The Data Subject has the right to object to the processing of Personal Data in the circumstances provided for by the GDPR, at any time and without prejudice to the applicable legal requirements.
• Right not to be subject to automated decision-making: The Data Subject has the right not to be subject to a decision based solely on automated processing of his or her Personal Data, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

You also have the right to lodge a complaint with the competent Supervisory Authority.

If you would like further information regarding the processing of your Personal Data or wish to exercise any of the rights described above, you may contact us by email at privacy@ihhotels.com.