PRIVACY POLICY

By means of this information notice provided pursuant to Article 13 of Regulation (EU) 679/2016, Hydro Holdin s.p.a. describes the methods by which it processes the personal data of the user of the website https://www.hydro-holding.com/.com (“Website“).

 

  1. DEFINITIONS

Pursuant to Regulation (EU) 679/2016 (hereinafter also Regulation) and Legislative Decree no. 196/2003 (Code on the protection of personal data) as amended by Legislative Decree no. 101/2018, the following shall mean:

“Personal Data“: any information concerning an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, with particular reference to an identifier such as a name, an identification number, location data, an online identifier or one or more characteristic elements of his/her physical, physiological, genetic, psychic, economic, cultural or social identity.

“Usage Data“: information collected automatically by this Application (or by third party applications that this Application uses), including: IP addresses or domain names of computers used by the user who connects with this application, URI (Uniform Resource Identifier) addresses, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.. ) the country of origin, the characteristics of the browser and the operating system used by the visitor, the various temporal connotations of the visit (for example, the time spent on each page) and the details of the itinerary followed within the application, with particular reference to the sequence of pages consulted, the parameters relating to the operating system and the User’s IT environment.

“Processing“: any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, restriction, deletion or destruction.

“Profiling” means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the professional performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements of said natural person.

“User“: the individual who uses this application, who must coincide with or be authorized by the Data Subject and whose personal data are the subject of any processing.

“Data Controller“: the natural or legal person, public authority, service or other body which, individually or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the Data Controller or the specific criteria applicable to its designation may be established by Union or Member State law.

“Processor” means the natural or legal person, public authority, service or other body that processes personal data on behalf of the data controller.

“Data Protection Officer (also Data Protection Officer – DPO)“: mandatory figure in certain cases provided for in Article 37 of the Regulation. It performs consulting, monitoring, coordination and management of relations with the Supervisory Authority in the field of personal data processing.

“Communication“: the giving of knowledge of personal data to one or more determined subjects other than the data subject, the owner’s representative in the territory of the European Union, the person in charge or his representative in the territory of the European Union, the persons authorized to process personal data under the direct authority of the owner or manager, in any form, including by making them available, consultation or through interconnection.

“Dissemination“: the giving of knowledge of personal data to unspecified subjects, in any form, including by making them available or consultation.

 

  1. DATA CONTROLLER

The Data Controller of any personal data processed following the use of the Website is Hydro Holding s.p.a., with registered office in Via Provinciale Nord, 26/a – 40050 Castello D’Argile (BO) – Italy.

 

  1. TYPE AND SOURCE OF DATA

In the context of the use of the Website, Hydro Holding may process the data listed below:

  • Personal data voluntarily provided by the interested party

The optional sending of electronic mail to the e-mail address indicated on the Website entails the subsequent acquisition by Hydro Holding of the sender’s address, necessary in order to respond to the requests sent, as well as any other personal data included in the e-mail message.

The optional, explicit and voluntary sending of the curriculum vitae to the e-mail address indicated on the Website implies the subsequent acquisition of the sender’s address as well as any other personal data included in the curriculum itself, which may include:

  1. common data, such as personal information (e.g. first name, last name, date of birth, address, image, gender, marital status, tax code, etc.), contact information (e.g. landline and/or mobile phone number, e-mail address, etc.), work and professional data;
  2. “particular” data as defined in art. 9 of the Regulation, i.e. data that can reveal racial and ethnic origin, religious beliefs, political opinions, membership of political parties, membership of trade unions, associations or organizations of a religious or philosophical nature, as well as health status (e.g. membership of so-called protected categories). We invite users, in the process of self-application not to send “special” data referred to in Articles. 9 and 10 of Regulation (EU) 679/2016, if not strictly necessary.

The data that may be provided by the interested party through the sending of their CV will be processed to assess the professional profile with respect to open job positions and, in general, for the management of the selection procedures of employees. The Data Controller may contact the interested party in order to schedule any interviews that may be necessary, using the contact details indicated in the curriculum itself.

  • Navigation data

The computer systems and procedures used to operate the Site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified interested parties, but by their very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of computers used by users who connect to the Site, URI (Uniform Resource Identifier) of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the response from the server (successful, error, etc..) and other parameters regarding the operating system and computer environment. These data are processed for the sole purpose of obtaining statistical information on the use of the Site and to check its correct functioning. However, such data could be used to ascertain responsibility in the event of any unlawful acts committed to the detriment of the Site.

  • Cookies

To ensure the operation of the Site and improve the service offered, cookies are used. Cookies are small text files that sites visited by the user send to his terminal (usually the browser), where they are stored and then transmitted to the same sites the next time the same user visits. For more information, to know the cookies used on the Site and possibly disable them and / or deny consent, please refer to the cookies policy below.

 

  1. LEGAL BASIS AND LAWFULNESS OF PROCESSING

The users’ data will be used to respond to requests made by the users themselves by sending e-mail messages to the e-mail address indicated on the Website. The legal basis of the processing is, therefore, that provided for in Article 6, paragraph 1, letter b) of Regulation (EU) 679/2016. The provision of your personal data for these purposes is optional, but any failure to do so would make it impossible for the Controller to respond to the requests received.

The data that may be provided by the data subject by sending his/her curriculum vitae to the e-mail address indicated on the Website will be processed for the purpose of assessing the professional profile with respect to open job positions and, in general, for the management of employee selection procedures. The Data Controller may contact the data subject in order to schedule any interviews that may be necessary, using the contact details indicated in the curriculum itself. The provision of your personal data for these purposes is optional, but failure to provide them would make it impossible for the Data Controller to assess your profile or to schedule interviews.

The legal basis for the processing of common personal data contained in the curriculum is the ones indicated in Article 6.1.b) of EU Regulation 679/2016, which legitimizes the processing where the same is necessary for the execution of pre-contractual measures taken at the request of the person concerned. Any processing of special data indicated in the curriculum transmitted by the data subject, on the other hand, may take place pursuant to art. 9.2.a) of the Regulation, only with the explicit consent of the data subject. In this regard, if it is not strictly necessary, we ask you not to provide this type of information; otherwise, if the person concerned decides to provide it, it will be necessary – in compliance with current legislation on the protection of personal data – the release of specific consent by means of a statement included in the curriculum itself. The lack of consent to the processing of any particular data indicated in the curriculum prevents the document from being used. Should your application for collaboration be accepted, your personal data will be processed by the Data Controller in accordance with the privacy policy prepared for employees and/or collaborators.

  1. COMMUNICATION AND RECIPIENTS OF PERSONAL DATA

Your personal data may be communicated, exclusively for the achievement of the purposes described above, to employees and direct collaborators of the Data Controller as well as to other companies of the Group.

Your data may also be accessible to companies, entities or consortia that perform, on behalf of the Data Controller, technical and organizational tasks consistent with the pursuit of the purposes described above, as well as to public authorities that make a legitimate and formal request.

In any case, your data will be processed only by persons duly trained and able to provide adequate protection of a technical and organizational, and bound to strict confidentiality by the owner.

  1. METHODS AND MEANS OF TREATMENT

Personal data are processed with automated tools, for the time necessary to achieve the purposes for which they were collected.

Specific security measures are observed to prevent the loss of data, illegal or incorrect use and unauthorized access in compliance with the obligations to adapt adequate security measures. All data in fact will be acquired and stored in accordance with Articles 32, 33 et seq. of EU Regulation 679/2016.

The Owner is not responsible for errors, content, cookies, publications of immoral illicit content, advertising, banners or files that do not comply with current regulations by sites not managed by the same.

 

  1. TRANSFER OF DATA TO A THIRD COUNTRY

If there is a need to transfer your personal data outside the European Economic Area, this will only take place if the level of protection of personal data, guaranteed by the Regulation, is not affected.

 

  1. DURATION OF TREATMENT

The personal data acquired will be kept for the duration necessary to carry out the activities requested by the User and in any case for a period of time not exceeding 24 months from the date of insertion.

The storage time may be extended and involve the acquisition of additional data at a later date, if the user requests services or purchases goods; in this case the duration of the treatment, for administrative, accounting, tax and contractual purposes may extend up to 10 years from the termination of the relationship, as required by law (art. 2220 of the Civil Code, art. 22 of the Decree of the President of the Republic of 29/09/1973 n. 600 and art. 2200 Civil Code).

The personal data acquired by sending the curriculum to the mail address indicated on the Site will be kept by the Data Controller for the time necessary for the fulfilments foreseen for the selection of the Candidate and, in any case, not more than 12 months from their collection, except for the possible establishment of the working relationship and/or collaboration. In this case, your personal data will be processed by the Owner according to the privacy policy specifically prepared for employees and/or collaborators.

The technical navigation cookies will be stored for the sole purpose of allowing the proper technical operation of the site itself and will expire automatically when the browser is closed.

  1. RIGHTS OF THE INTERESTED PARTIES

The subjects whose personal data refer have the right at any time to obtain confirmation of the existence or otherwise of such data and to know its content and origin, verify its accuracy or request to integrate, update or correct them. The subjects whose personal data refer also have the right to request cancellation, transmission of data to other owners, transformation into anonymous form or blocking of data processed unlawfully, and to oppose in any case, for legitimate reasons, to their treatment. The interested parties also have the right to appeal to the control authority (Privacy Guarantor).

Below is the art. 13 of the European Regulation 679/2016 that lists these rights.

Article 13

Information to be provided where personal data are collected from the data subject

  1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:
    1. the identity and the contact details of the controller and, where applicable, of the controller’s representative;
    2. the contact details of the data protection officer, where applicable;
    3. the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
    4.  where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;
    5. the recipients or categories of recipients of the personal data, if any;
    6. where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available
  2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:
    1. the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
    2. the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
    3. where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
    4.  the right to lodge a complaint with a supervisory authority;
    5. whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
    6. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
  3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.
  4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

 

  1. CONTACT DATA

Requests relating to art 13 of EU Regulation 679/2016 must be addressed to the Data Controller via e-mail at hhinfo@hydro-holding.com