Poke House S.r.l. VAT number 10300540969, located in Milan, Corso Garibaldi 12, acting through its legal representative pro tempore (“Poke House”), in compliance with Art. 13 of the Regulation, and regarding your personal data (“Personal Data”) informs each applicant that the Personal Data concerning him or her, held by the Owner or that will be requested later or communicated by third parties, are necessary and will be used for the purposes indicated below.

1. Data Controller; Data Protection Officer and Data Processors

1.1. The data controller (“Controller”) is Poke House. 1.2. The Controller has appointed the Data Protection Officer, to whom the task of supervising compliance with the Regulation is assigned, and to whom you can turn for any further information by sending a communication: To the attention of Avv. Simone Bongiovanni

• by email, at the following address: avv.bongiovanni@sbd-dpo.it;

by registered mail, at the following address: via Galliano n.18, Turin (TO), 1.3. Some companies that provide specific processing services or carry out related, instrumental or support activities or that carry out control activities against the Controller have been appointed as Data Processors and, as required by current regulations, guarantee appropriate technical and organizational measures so that the processing meets the requirements of the Regulation and guarantees the protection of the data subject’s rights. 1.4. The data subject is the natural person to whom the Personal Data refer and which are processed under this information notice ex art. 13 of the Regulation (the “Data Subject”).

2. Personal Data subject to processing and source of the data

2.1. The Controller processes the following categories of Personal Data:

• Identification Data. The Personal Data collected by the Controller are those voluntarily provided by the Data Subject, specifically, for example: name, surname, email, phone number, date and place of birth, residential address.

• CV Data: educational path, previous jobs, knowledge of languages and software, photo if present in the CV.

• Economic-financial data. For example: salary, bonuses, iban, cu (single certification), contributory statement, tfr destination module, tax deduction, pension fund adherence module.

• Special categories of Personal Data. Additional data that the Data Subject should provide during the application, selection or interview phase.

2.2. The Personal Data processed will be conferred to the Controller directly by you, through your Curriculum Vitae during the application and interview phase.

3. Purposes and legal basis for the processing of Personal Data

3.1. The processing of Personal Data is primarily aimed at managing your application and assessing your suitability for the role for which you are applying. Specifically, among the purposes of processing, the following are included:

a) purposes strictly connected and instrumental (thus also preliminary and consequential) to follow up on the possible request of the Data Subject and, more precisely, to proceed with the verification of the prerequisites to start the selection phase aimed at hiring and/or starting a collaboration. The legal basis of the processing is the execution of pre-contractual and contractual measures at the request of the Data Subject pursuant to Art. 6 par. 1 lett. b) Regulation. Therefore, the provision of Personal Data is necessary, and the possible failure to communicate the required Personal Data determines the impossibility of proceeding with the phase of selection of candidates and subsequent and possible hiring.

b) purpose related to the fulfillment of regulatory obligations to carry out recruitment and selection of personnel. The legal basis of the processing is the legal obligation from national and European regulations, pursuant to Art. 6 par. 1 lett. c) Regulation. Therefore, the provision of Personal Data is necessary, and the possible failure to communicate the required Personal Data determines the impossibility of proceeding with the phase of selection of candidates and subsequent and possible hiring.

c) purpose of using the candidate’s curriculum vitae for the selection of other professional positions different from those for which he or she has applied. The legal basis is consent, pursuant to art. 6 par. 1 lett. a) Regulation. The provision of Personal Data is optional. Personal Data may be used only and exclusively with free, optional, specific, and explicit consent that can be revoked at any time. After expressing consent, it is still the right of the Data Subject to oppose, at any time and without costs, the processing of Personal Data for this purpose.

4. Methods of processing

4.1 Within the purposes indicated in the previous point, the processing of the Data Subject’s Personal Data may take place using manual, electronic, and telematic tools, in compliance with the principles of lawfulness, correctness, transparency, accuracy, relevance, and non-excessiveness, adopting adequate organizational, technical, and computer security measures.

4.2 Applications can be collected in the following ways:

• through the Indeed and LinkedIn platforms;
• through the Poke House website: https://poke-house.com/it-it/candidatura-spontanea/.

5. Recipients of Personal Data

5.1. For the pursuit of the above purposes, the Personal Data of the Interested Party may be communicated to/be known by the following categories of recipients:

• the staff employed by the Data Controller, such as people authorized to process the data;
• third-party companies that the Data Controller uses for the performance of related, instrumental or consequential activities to the execution of archiving services;
• professional training schools;
• employment agencies and targeted placement agencies;
• third-party companies that manage address management and email sending services;
• Public Security authorities and/or financial administration, to social security and welfare institutions if necessary;
• system administrators;
• external professionals (including, for example: lawyers, labor consultants, data processing centers, etc.) who provide services functional to achieving the purposes indicated, who – if legal conditions exist – will assume the role of external data processing managers.

5.2. Third parties to whom your Personal Data can be communicated act as:

• Independent Data Controllers, i.e., entities that independently determine the purposes and means of processing Personal Data;
• Data Processors, i.e., entities that process Personal Data on behalf of the Data Controller.

6. Communication of Personal Data – Transfer of Personal Data abroad

6.1. Personal Data may be communicated for the management of established/establishing relationships and for the performance of obligations, to other subjects, such as, for example, those who carry out legal protection activities, auditing, market research, and commercial information, etc.. Personal Data collected, if necessary and always for the aforementioned purposes, can be transferred outside the national territory, even outside the EU, to entities that collaborate with the Controllers and Managers, always in compliance with the current privacy regulations and the Regulation.

6.2. If necessary, your Personal Data may be transferred, by Poke House, to third countries outside the European Economic Area. In these cases, the transfer will take place in accordance with the conditions indicated by articles 44 and following of the Regulation, or towards countries for which there are “adequacy” decisions by the European Commission, based on Standard Clauses approved by the European Commission, or by applying specific exemptions provided for by the Regulation itself.

6.3. Personal Data is stored on servers located at the Data Controller’s headquarters, as well as on servers managed by Google Drive and Amazon Web Services. In particular, Google and AWS adopt specific procedures to ensure the adequate treatment of Personal Data and the protection of their privacy and security.

6.4. The collected Personal Data is not subject to dissemination.

7. Personal Data Retention Times

7.1. Personal Data undergoing processing is stored only for the time strictly necessary to carry out the activities/purposes described above and in any case stored for different periods depending on the purposes for which they are processed, in compliance with the regulations applicable from time to time.

• Personal Data processed for the purposes referred to in point 3 a); b) are stored for the duration of the selection activity.
• Personal Data processed for the purposes referred to in point 3 c) are stored for 12 months from the receipt of the curriculum vitae.

7.2 In any case, the possibility remains to retain the data described above for the need to protect the rights of the Data Controller in any extrajudicial and also judicial proceedings, in arbitration and/or mediation and conciliation procedures.

8. Security measures

8.1. The Data Controller adopts security measures suitable to minimize the risks of destruction or loss, even accidental, of Personal Data, of unauthorized access or processing not allowed or not in accordance with the purposes of collection indicated in this information.

8.2. However, the transmission of Personal Data via the Internet is not always secure. Despite adopting all necessary measures to ensure the protection of Personal Data, we cannot exclude any risks connected with factors beyond our control. Therefore, when you decide to transmit your Personal Data through systems that have access to the Internet, you are aware of the potential risks that may arise from such activity. When we collect your Personal Data, we ensure the adoption of rigorous procedures and technical and organizational security measures to prevent any unauthorized access.

9. Rights of the Interested Party

9.1. Under the applicable legislation on the protection of personal data, the interested party can exercise the rights provided for by articles 15 to 22, 34 and 77 of the GDPR. If you wish to exercise one of the following rights, please contact Poke House at the above addresses.
a) The right to be informed. You have the right to receive clear, transparent and easily understandable information about how we process your Personal Data and what your rights are under articles 13 and 14 of the GDPR. For this reason, we provide you with the information contained in this Privacy Information.
b) The right of access. You have the right to access your Personal Data (if processed) as provided for by art. 15 GDPR. This will allow you, for example, to verify that we are using your data in accordance with the law on the protection of personal data.
c) The right to rectification. You have the right to rectify your Personal Data in the case they are inaccurate or incomplete as provided for by art. 16 of the GDPR. In particular, you can request to correct any errors present in the Personal Data in our possession.
d) The right to cancellation. This “right to be forgotten” allows you to request the deletion or removal of some of your Personal Data as provided for by art. 17 of the GDPR. This right is not absolute and only applies in certain circumstances.
e) The right to limitation. You have the right to “limit” the further use of your Personal Data as provided for by art. 18 GDPR. If processing is limited, data can only be processed in certain cases and in the light of specific assumptions (e.g., any subsequent conservation after the limitation of processing does not need the consent of the interested party).
f) The right to portability. You have the right to receive your Personal Data in an accessible and transferable format so that you can reuse them for your purposes with different data controllers as provided for by art. 20 of the GDPR. However, this is not an absolute right and there are exceptions.
g) The right to lodge a complaint with the authority. You have the right to lodge a complaint with the relevant authority responsible for data protection concerning the way we manage or process your information, under Article 77 of the GDPR. h) The right to withdraw consent. You have the right to withdraw the consent you provided to us (in the case that it forms the legal basis of the processing under consideration) at any time with future effect under Article 7 of the GDPR. The legality of processing based on the consent before its withdrawal remains unaffected. i) The right to object. You have the right to object to the processing of your personal data under Article 21 of the GDPR. This also applies to direct marketing activities and the related profiling activities. Specific information on the right to object under Article 21(4) of the GDPR You have the right to object at any time, for reasons related to your particular situation, to the processing of your personal data carried out under Article 6(1)(e)(f) of the GDPR, including profiling based on those provisions. In the event that you exercise this right, we will no longer process your personal data unless we demonstrate compelling legitimate grounds that override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of a legal claim. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data carried out for this purpose, including profiling to the extent that it is related to such direct marketing activity.

10.1. As a data subject, you can exercise your rights at any time by contacting:
– Poke House s.r.l., Milan, Corso Garibaldi 12.
– E-mail: privacy@pokehouse.it

LAST UPDATED JULY 2023