Who are we and what do we do with your personal data?

Geolog International BV (hereinafter also the Data Controller), as the data controller, is concerned with the confidentiality of your personal data and with guaranteeing them the necessary protection from any event that could put them at risk of violation.

The Data Controller implements policies and practices regarding the collection and use of personal data and the exercise of the rights that are recognized to you by the applicable legislation. The Data Controller takes care to update the policies and practices adopted for the protection of personal data whenever this becomes necessary and in any case in the event of regulatory and organizational changes that may affect the processing of your personal data.

How and why does the owner collect and process your personal data?

The Data Controller collects and/or receives information about you, such as:

• name, surname;
• tax code and/or VAT number;
• Images;
• e-mail;
• telephone number;
• address;
• date of birth;
• data relating to the state of health if the interested party belongs to protected categories;
• curricular data.

The personal data concerning you will be processed for the following purposes:

1) the selection of personnel and/or the start of a collaboration

Your data may also be collected from third parties such as, for example:

• IT service provider;
• private entities that carry out work supply, intermediation, personnel search and selection, training and professional relocation support activities;
• university.

Where applicable, the right to rectification of the data processed or collected remains intact.

The data collected or otherwise obtained by the Data Controller following the selection procedure for available positions within its organization, except for those relating to your health, spontaneously provided by you, must be considered necessary and failure to provide them will make it impossible for the Data Controller to follow up on activities aimed at:

• evaluate your application in the personnel selection process which the Data Controller also follows up through its suppliers (third parties/recipients);
• manage the candidate selection process in all its phases and the related obligations.

2) for communication to third parties and for dissemination

The Owner does not transfer your personal data abroad (countries outside the EU). Your personal data will not be in any way disseminated or disclosed to unspecified and unidentifiable subjects, not even as third parties.

The communication concerns the categories of data whose transmission is necessary for the performance of the activities and purposes pursued by the Data Controller in the management of the selection procedure. The related processing does not require the consent of the interested party in the event that the same occurs in order to carry out the obligations deriving from the established relationship or in the event that another hypothesis of exclusion should occur (in particular the traceability of a legitimate interest by the Data Controller), expressly provided for or dependent on the legislation and regulations applied by the Data Controller, or even through third parties identified as data controllers. Where the communication involves data suitable for revealing the state of health, the related processing operations will take place with all the guarantees of the case including those that, if requested based on the risks identified, determine the application of pseudonymization solutions, and/or aggregation and/or encryption of the data.

How, where and for how long is your data stored?

How?

The data processing is carried out through paper media or computer procedures by specifically authorized internal subjects. These are allowed access to your personal data to the extent and within the limits in which it is necessary for the performance of the processing activities that concern you.

The Data Controller periodically verifies the tools by which your data are processed and the security measures provided for them, which are constantly updated; verifies, also through the subjects authorized to process, that no personal data are collected, processed, archived or stored that are not necessary for processing or whose purposes are exhausted; verifies that the data are stored with the guarantee of integrity and authenticity and of their use for the purposes of the processing actually carried out, also due to the particular nature of the same. The checks allow the Data Controller to evaluate the strict relevance, non-excess and indispensability of the data belonging to particular categories with respect to the activity selection procedure as well as to the relationship to be established, also with reference to the data that you provide on your own initiative.

The Owner guarantees that the data which, even following checks, are found to be excessive or irrelevant will not be used except for the possible conservation, in accordance with the law, of the deed or document containing them.

Where?

The data is stored in paper, computer and electronic archives, located within the European Economic Area, and specific security measures are ensured.

How long?

Your personal data is stored for the time necessary to complete the activities that concern you.

In particular:

Once all the purposes that legitimise the storage of your personal data have been exhausted, the Data Controller will take care to delete them or make them anonymous.

What are your rights?

The rights that are recognized to you allow you to always have control over your data. Your rights are those of:

• access;
• rectification;
• revocation of consent;
• cancellation;
• limitation of processing;
• opposition to processing;
• portability.

At any time and free of charge and without any particular charges or formalities for your request, you can:

• obtain confirmation of the processing carried out by the Data Controller
• access your personal data and know their origin (when the data are not obtained directly from you), the purposes and aims of the processing, the data of the subjects to whom they are communicated, the period of retention of your data or the criteria useful for determining it;
• update or rectify your personal data so that it is always accurate and up-to-date;
• revoke consent at any time, if this constitutes the basis of the processing. However, the revocation of consent does not affect the lawfulness of the processing based on the consent carried out before the revocation itself;
• delete your personal data from databases and/or archives, including backup archives, in the event, among others, that they are no longer necessary for the purposes of the processing or if this is assumed to be unlawful, and always if the conditions provided for by law exist; and in any case if the processing is not justified by another equally legitimate reason;
• limit the processing of your personal data in certain circumstances, for example where you have contested the accuracy of the data, for the period necessary for the Data Controller to verify its accuracy. You must also be informed, in appropriate times, when the suspension period has expired or the cause of the limitation of processing has ceased to exist, and therefore the limitation itself has been revoked;
• obtain your personal data, if their processing is based on a contract and with automated tools, in electronic format also for the purpose of transmitting them to another data controller.

The Data Controller shall proceed in this direction without delay and, in any case, no later than one month after receiving your request. The deadline may be extended by two months, if necessary, taking into account the complexity and number of requests received. In such cases, the Data Controller shall inform you within one month of receiving your request and shall make you aware of the reasons for the extension.

For any further information and to send your request write to privacy@geolog.com

How and when can you object to the processing of your personal data?

For reasons relating to your particular situation, you may object at any time to the processing of your personal data if it is based on legitimate interest, by sending your request to privacy@geolog.com

You have the right to have your personal data erased if there is no legitimate reason that prevails over the reason that gave rise to your request.

Who can you complain to?

Without prejudice to any other administrative or judicial action, you may lodge a complaint with the data protection authority, unless you reside or work in another Member State. In this latter case, or if the violation of the legislation on personal data protection occurs in another EU country, the supervisory authorities established therein shall be competent to receive and hear the complaint.

Any update to this information will be communicated to you promptly and through appropriate means and you will also be communicated before proceeding and in time to give your consent if necessary.