Privacy notice for job candidates
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Article 111-bis of Italian Legislative Decree 196/2003
Version 1.0 – October 2026
Valli Granulati S.r.l. processes the personal data of people who apply to work with us. This notice explains which data we process, for what purposes, how long we keep them and which rights candidates have. It applies both to applications for advertised positions and to unsolicited applications.
1. Data controller and contact details
The data controller is VALLI GRANULATI S.R.L., Via Selva 20, 24060 Zandobbio (BG), Italy, VAT and Tax Code IT 01624170161, tel. +39 035 940249, certified e-mail (PEC) valligranulati@pec.it.
For any matter concerning personal data, please write to our internal privacy contact at privacy@valligranulati.it. The controller has not appointed a Data Protection Officer (DPO), as none of the cases in which an appointment is mandatory applies (Art. 37 GDPR).
2. Data we process
- Identification and contact data: first name and surname, date and place of birth, address, telephone, e-mail, photograph if included in the CV.
- Education and work history: qualifications, work experience, skills, languages, driving and other licences, certifications, availability and expectations.
- Data collected during selection: outcome of interviews and tests, evaluation notes, references provided by the candidate.
- Membership of protected categories under Italian Law 68/1999, only if the candidate discloses it or the position is reserved for those categories.
Please do not include in your CV any data that is not needed, in particular data concerning health, ethnic origin, religious or political beliefs, trade union membership or criminal convictions. If we receive such data anyway, we do not use it in the evaluation. In line with Art. 8 of Italian Law 300/1970 and Art. 10 of Italian Legislative Decree 276/2003, we do not investigate opinions or facts that are irrelevant to assessing professional aptitude.
3. Where the data come from
The data are provided directly by the candidate, for example by sending a CV by e-mail or post or handing it in. They may also reach us from employment agencies, recruitment firms, job boards, public employment centres, schools and universities (for internships), always in connection with the candidate’s own application.
4. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| A. Recruitment: assessing the application, contacting the candidate, interviews and tests, any offer of employment or collaboration. | Pre-contractual steps taken at the data subject’s request (Art. 6(1)(b)). Consent is not required for unsolicited CVs (Art. 111-bis Italian Legislative Decree 196/2003). For protected-category membership: Art. 9(2)(b) GDPR and Italian Law 68/1999. | For the duration of the selection. If the candidate is hired, the data become part of the employee file and the employee privacy notice applies. |
| B. Other positions: considering the application for future positions matching the profile, if the selection was unsuccessful or for unsolicited applications. | Pre-contractual steps at the data subject’s request (Art. 6(1)(b)) and the controller’s legitimate interest in identifying suitable profiles (Art. 6(1)(f)). Candidates may ask at any time for their CV to be deleted. | 12 months from receipt of the application or from the last contact, then deletion. |
| C. Protection of rights: handling any disputes concerning the selection. | Legitimate interest in protecting the controller’s rights (Art. 6(1)(f); for any special category data, Art. 9(2)(f)). | For the duration of the dispute and until the time limits for appeal have expired. |
When the retention periods expire, the data are deleted or anonymised.
5. Whether providing data is mandatory
Providing data is optional, but without the essential CV data and contact details we cannot assess the application.
6. How we process the data
Data are processed on paper and electronically, with technical and organisational measures appropriate to the risks (Art. 32 GDPR). They are accessed only by authorised staff involved in the selection: management, heads of the departments concerned and the personnel office.
No decisions are taken based solely on automated processing, including profiling (Art. 22 GDPR).
7. Who we share the data with
The data are not made public and are disclosed only where necessary to:
- employment agencies and recruitment firms engaged by the controller for a specific selection;
- the payroll and employment consultant, if the candidate is hired;
- public authorities, where required by law.
These recipients act as independent controllers or as processors, depending on their relationship with the controller.
The data are also stored on the controller’s IT systems and on e-mail and cloud services provided by companies acting as processors (Art. 28 GDPR), bound by a written agreement. The up-to-date list of processors is available on request at privacy@valligranulati.it.
8. Transfers outside the European Economic Area
As a rule, data are processed within the European Economic Area (EEA). Some IT service providers may process data outside the EEA. In that case the transfer is based on an adequacy decision, including the EU-U.S. Data Privacy Framework for participating companies, or on the standard contractual clauses adopted by the European Commission (Art. 46 GDPR).
9. Candidates’ rights
Candidates may exercise the following rights:
- access to their data (Art. 15), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18);
- portability of the data they provided (Art. 20), where processing is carried out by automated means;
- objection (Art. 21) to processing based on legitimate interest, on grounds relating to their particular situation, for example to ask that the application not be considered for other positions.
Requests can be sent to privacy@valligranulati.it or by registered letter to the controller’s address. We reply within one month; this may be extended by two further months for complex requests (Art. 12 GDPR).
Candidates also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of their EU country of residence or workplace, or to apply to the courts.
10. Updates
This notice may be updated. The current version is published at www.valligranulati.it. In case of discrepancy between language versions, the Italian version prevails.