Work with us Policy

NOTICE TO DATA SUBJECTS REGARDING THE PROCESSING OF GENERAL AND/OR SPECIAL (SENSITIVE) CATEGORIES OF PERSONAL DATA PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679 

G&G DESMAC Srl (VAT No. 02345340687), represented by its legal representative p.t., with its registered office at Contrada Cocullo snc, 66026 Ortona (CH).

1. Data Controller

The company G&G DESMAC Srl (VAT N. 02345340687), with its registered office and administrative headquarters in Ortona (CH), Contrada Cocullo snc, 66026 (CH), in the person of its current legal representative, acting as Data Controller, hereby informs you, pursuant to Article 13 of EU Regulation 679/16, of the following:

2. Data Protection Officer (DPO)

The company’s Data Protection Officer (DPO) can be contacted at the following email address: federica.digiandomenico@ggdesmac.com

3. Purposes of processing and legal basis

The processing of the data requested from the data subject is carried out in accordance with Article 6(e) of EU Regulation 2016/679 for the following purposes.

The processing of the data requested from the data subject or content in resumes is carried out for the following purposes: 

  • Searching for, selecting and assessing professional candidates with a view to potentially establishing an employment or collaborative relationship.
  • Compliance with legal obligations relating to social security and health and safety at work.
  • Compliance with obligations relating to the payment of remuneration and associated legal and/or contractual obligations.


4. Legal basis

The legal basis for the processing of your personal data is Article 6 ‘Lawfulness of processing’, first paragraph, point (b) of the GDPR, ‘insofar as the processing is necessary for the implementation of pre-contractual measures taken at the request of the data subject’. The legal basis for the processing of special categories of personal data (e.g. membership of protected groups, health data that may be included in your Resume) is Article 9, second paragraph, point (b) of the GDPR, in conjunction with the applicable provisions governing the establishment of an employment relationship

5. Nature of the provision of data

The provision of personal data is optional. Candidates are free to submit their Resume. The provision of incomplete data or failure to provide data may prevent the candidate’s profile from being assessed, thereby making it impossible to include the candidate in the company’s selection procedures.

6. Methods of processing

The processing will be carried out in accordance with the company’s administrative procedures. Processing may be carried out with or without the use of electronic or other automated means, and will include all operations or sets of operations necessary for the processing in question. The personal data you provide will be recorded, processed and stored in our archives (or on the software provider’s servers), in both paper and electronic form, in compliance with the appropriate technical and organisational measures referred to in Article 32 of the GDPR.

7. Disclosure of personal data

Personal data relating to the processing in question will be disclosed, where necessary or in any event relevant to the pursuit of the recruitment purposes, to the following parties:  a) Group companies; b) where applicable: the company managing the IT system and the recruitment platform on behalf of the employer; c) where applicable: external companies specialising in personnel recruitment and selection; d) where applicable: third-party companies with which procurement and/or service contracts are in place for the performance of the contractual relationship. e) Other third parties, whether public or private, including those not expressly mentioned above, to the extent that the disclosure of data is necessary or relevant to the purposes of staff recruitment, as well as to the fulfilment of legal or regulatory obligations.

Where such recipients process data on behalf of the company, they will be designated as data processors, by means of a specific contract or other legal instrument. The data will not be disclosed to unspecified third parties. 

8. Data controllers and data processors

The data controller in this case is the undersigned company, represented by its legal representative. The following have been appointed as external data processors: the employment consultant’s practice/the IT company responsible for processing administrative data/other (please specify, without mentioning the supplier’s name) (details are available from the HR department).

9. Transfer of personal data

Place of processing: Italy and the European Union.

Personal data is processed using IT systems, hosting services and email services used by the Data Controller.

In particular:

the website is hosted on infrastructure provided by Aruba S.p.A., with its registered office in Italy: Place of processing: Italy and the European Union.

Personal data is processed using IT systems, hosting services and email services used by the Data Controller.

In particular:

The suppliers listed above act, where necessary, as data processors within the meaning of Article 28 of Regulation (EU) 2016/679.

Data processing is carried out in accordance with the principles of security, integrity and confidentiality set out in the GDPR, through the adoption of appropriate technical and organisational measures.

Where necessary, data may also be processed using infrastructure located outside the European Union; in such cases, the transfer takes place on the basis of appropriate safeguards provided for by the GDPR, including the Standard Contractual Clauses approved by the European Commission.

10. Data retention period

Data is retained for the period necessary to fulfil the purposes for which it was collected. This retention period is determined by the need to assess your application and to retain your profile for future roles in line with your skills: a maximum of 12/24 months from the date of receipt of your CV.

Rights of the data subject. The data subject may exercise the data rights set out in Articles 15–22 of European Regulation No 679/2016. These rights may be exercised by sending a specific request to the DPO, with the subject line: ‘privacy rights – Recruitment’, by email to federica.digiandomenico@ggdesmac.com.

11. Rights of the Data Subject

The data subject may exercise the data rights set out in Articles 16–21 of European Regulation N. 679/2016.

  • Art. 16 – Right to rectification
  • Art. 17 – Right to erasure (right to be forgotten)
  • Art. 18 – Right to restriction of processing
  • Art. 19 – Obligation to notify
  • Art. 20 – Right to data portability
  • Art. 21 – Right to object

These rights may be exercised by sending a specific request to the DPO, with the subject line: “Privacy rights”, by email to federica.digiandomenico@ggdesmac.com. 

12. Competent court

Any dispute relating to the processing of candidates’ personal data and to this privacy notice shall be subject to the jurisdiction of the Court of Chieti, Italy, unless otherwise provided for by mandatory provisions of law.

13. Complaints

The data subject has the right to lodge a complaint with the supervisory authority and may contact the Italian Data Protection Authority in accordance with the procedures set out on the website: www.garanteprivacy.it

Place: Chieti, 24th June 26