Privacy Policy – Candidates

This privacy notice, provided pursuant to Regulation (EU) 2016/679 (“GDPR”), contains important information on the processing of personal data of individuals applying for job positions at the Controller's company (hereinafter, the “Candidates”).

Data controller

Wash Out S.r.l. (the “Controller”)
Via Costanza 1, 20146 Milan
VAT: 09454100968
E-mail: privacy@washout-app.com

The Controller has appointed a Data Protection Officer (“DPO”) who can be contacted at the following address: dpo@washout-app.com

Personal data collected

We collect the personal and contact data voluntarily entered by the candidate in their CV, such as first name, last name, e-mail address, telephone number, and image. In some cases, the documents received may mention membership of protected categories. Such data is processed, where necessary, to fulfill specific legal obligations relevant to establishing the employment or collaboration relationship (i.e., targeted placement).

Purposes of processing

Your personal data will be processed by the Controller for the following purposes:

Personnel search and selection

Personnel search and selection in relation to the possible commencement of an employment or collaboration relationship with the Controller.

The lawful condition of the processing is the implementation of pre-contractual measures adopted at the data subject's request. Where special categories of data are also involved, the processing would be based on the fulfillment of legal obligations and the exercise of specific rights of the Controller or the data subject in matters of labor law and social security and protection, deriving from the need to establish the employment or collaboration relationship with the data subject.

The provision of data for this purpose is necessary to evaluate the application; failure to provide such data entails the impossibility for the Controller to proceed with the search and selection process and to establish the possible employment or collaboration relationship.

Compliance with legal obligations

Compliance with legal obligations to which the Controller is subject (e.g., in labor law, such as targeted placement).

The lawful condition of the processing is the fulfillment of legal obligations to which the Controller is subject. Where special categories of data are also involved, the processing would be legitimate as it is based on the fulfillment of legal obligations and the exercise of specific rights of the Controller or the data subject in matters of labor law and social security and protection, deriving from the need to establish the employment relationship with the data subject (art. 9, par. 2, lett. b) GDPR).

The provision of data for this purpose is necessary to allow the Controller to fulfill the legal obligations to which it is subject; failure to provide such data entails the impossibility for the Controller to fulfill its regulatory obligations and, therefore, to establish and manage the contractual relationship.

Exercising or defending the Controller's rights

The lawful condition of the processing is the legitimate interest of the Controller to ascertain, exercise or defend a right in court or out of court, where necessary to protect its own interests.

Data transfer

The Controller stores the data on servers located within the European Union.

Where the Controller, due to requirements related to the location or places of processing of its suppliers, needs to transfer data outside the European Union to countries for which the European Commission has not issued an Adequacy Decision, the Controller undertakes to guarantee adequate levels of protection and safeguards, also of a contractual nature, according to applicable rules, including the stipulation of standard contractual clauses, supplemented where appropriate by additional technical, legal and organizational measures necessary to ensure that the level of protection of personal data is equivalent to that of the European Union.

Data retention

The Controller retains personal data only for the time necessary to achieve the purposes for which they were collected or for any other related legitimate purpose. In particular, personal data are retained for the entire duration of the candidate selection process and for a subsequent period of a maximum of two years from the end of such process.

In the event that it is necessary to process data for the purposes of protecting rights in the course of judicial and extrajudicial proceedings, the data are retained for the time necessary to pursue such protection of rights (i.e., for the entire duration of the pre-litigation and litigation, until the expiry of the time limits for taking action for appeal).

Recipients

For the performance of certain processing activities, data may be communicated to external parties who act as data controllers or who process personal data on behalf of the Controller, as data processors. In particular, personal data may be communicated to parties who provide IT, accounting, administrative, legal, insurance services or assistance and consultancy, as well as to employment agencies, Head Hunters and employment centers. In addition, data will be processed, if necessary, by authorities and institutions to which the right to access such data is granted by law or regulations (e.g., public security authorities and police forces).

Rights of the data subject

In the cases provided for, you may exercise the following privacy rights in relation to the processing of your data:

• the right to receive confirmation as to whether or not personal data processing is ongoing and the right to know what personal data is being processed and how it is used (right of access);
• the right to request the updating, modification and/or correction of personal data (right of rectification);
• the right to request the deletion of data (right to be forgotten);
• the right to request restriction of processing (right of restriction);
• the right to receive a copy of the data in electronic format and to request that such data be transmitted to another data controller (right to data portability);
• the right to object to processing where the processing is based on our legitimate interest or in the case of processing carried out for marketing purposes, also based on profiling (right to object).

If you exercise any of the aforementioned rights, it will be the Controller's responsibility to verify that you are entitled to exercise it.

Contacts

To exercise your rights or for any questions, you can write to us at the e-mail address privacy@washout-app.com or contact the DPO at dpo@washout-app.com.

Further rights

If you believe that the processing of your personal data is in breach of the provisions of personal data protection legislation, you will always have the right to lodge a complaint with the Data Protection Authority or to take action before the competent judicial Authority.