Applicant
privacy notice.

The data controller is Direttiva Casa S.r.l., trading as ClouCasa^® (also referred to below as the “Controller” or “ClouCasa^®”), with registered office at Via Maria Barbara Tosatti 31, 00137 Rome (RM), Italy, tax code and VAT number 14157691008, certified email (PEC) direttiva.casa@legalmail.it.

The company is currently managed by Maria Ippoliti, sole director and legal representative.

For any request concerning the processing of personal data in connection with an application, individuals may contact the Controller at:

• Privacy email: privacy@cloucasa.it
• Certified email (PEC): direttiva.casa@legalmail.it

The Controller has not appointed a Data Protection Officer (DPO), as the conditions for mandatory appointment under Article 37 of Regulation (EU) 2016/679 do not currently apply.

For any data protection request, individuals may contact the Controller directly at privacy@cloucasa.it.

References cited: Regulation (EU) 2016/679, Article 37, Recital 97.

This notice applies to the processing of personal data of people who submit an application to Direttiva Casa S.r.l. / ClouCasa^®, whether in response to a specific advertisement or on their own initiative, for the possible establishment of an employment relationship, collaboration, traineeship or other professional relationship.

The Controller may process personal data contained in:

• CVs;
• covering letters;
• application emails or forms;
• supporting documents submitted with an application;
• information collected during introductory and selection interviews.

In particular, this may include:

• personal and identification details;
• contact information;
• information about education, qualifications, professional experience, skills and professional references;
• other information relevant to assessing the applicant’s suitability for the position.

Processing must be limited to data that is adequate, relevant and necessary for selection purposes. Excessive information or information unrelated to professional assessment of the application is not requested.

References cited: Regulation (EU) 2016/679, Article 13.

The Controller does not request the inclusion in a CV or application of special categories of personal data, such as health information, religious or philosophical beliefs, political opinions, trade union membership, sexual orientation or other categories protected by law.

Applicants should submit only information relevant to their professional background.

If an applicant provides special-category data on their own initiative, it will be processed only where strictly indispensable for assessing the application or complying with legal obligations, subject to the applicable safeguards.

Personal data is processed for the following purposes:

1. Receiving, administering and reviewing applications;
2. Assessing the applicant’s professional profile against suitable current or future positions;
3. Organising and conducting interviews and other selection activities;
4. Complying with legal obligations connected with selection and the possible establishment of a working relationship;
5. Protecting the Controller’s rights, including in pre-litigation or judicial proceedings where necessary.

Receipt and assessment of applications are generally based on:

• taking pre-contractual steps at the individual’s request;
• compliance with any applicable legal obligations;
• where necessary, the Controller’s legitimate interests in properly organising and administering selection, while respecting the individual’s rights and freedoms.

Assessment of an application does not require general or mandatory consent to process a CV. If consent is needed for additional processing separate from selection, it will be requested separately and must be freely given, specific and informed.

References cited: Regulation (EU) 2016/679, Article 13.

Providing information relevant to an application is optional. However, failure to provide information strictly necessary to assess the applicant’s profile may prevent the Controller from considering the application or continuing the selection process.

Applicants should not include excessive, irrelevant or unrequested information.

References cited: Regulation (EU) 2016/679, Article 13.

Data is processed using paper records, IT and electronic communications, in ways strictly connected with the stated purposes and in accordance with lawfulness, fairness, transparency and data minimisation.

The Controller adopts appropriate technical and organisational measures to protect data against unauthorised access, loss, destruction, improper disclosure or unauthorised use.

Within their respective responsibilities and solely for the purposes stated above, personal data may be accessed by:

• authorised Controller personnel involved in selection;
• collaborators and advisers supporting the administration of applications;
• IT, hosting, data management and storage providers;
• third parties providing services related to selection, duly engaged or appointed in accordance with applicable law;
• public authorities or other persons entitled by law, where applicable.

Data will not be made public unless required by law or by the competent authority.

As a rule, data is processed within the European Economic Area.

If it becomes necessary to transfer personal data to third countries or international organisations, transfers will take place only under the conditions and safeguards required by applicable law, with appropriate information provided to the individual.

References cited: Regulation (EU) 2016/679, Article 13.

Applicants’ personal data is retained no longer than necessary for the purposes for which it was collected.

Unless specific circumstances require a different period justified in the particular case, application data is retained:

• for as long as needed to manage the relevant selection procedure;
• subsequently, for a reasonable and proportionate period for further selection processes compatible with the applicant’s profile and to protect the Controller’s rights.

The retention period currently adopted is six months after the last relevant contact, unless further retention is necessary to comply with legal obligations or to establish, exercise or defend a legal claim.

Once the applicable period has expired, data will be erased or anonymised, unless retention is necessary for compliance with legal obligations or the establishment, exercise or defence of a legal claim.

References cited: Regulation (EU) 2016/679, Article 13.

Where applicants submit a CV on their own initiative, the Controller processes the data for possible assessment of the application and makes this notice available through the channels used to collect applications or at the first appropriate contact.

Where provided for by applicable law, individuals may exercise the following rights:

• access to their personal data;
• rectification of inaccurate data or completion of incomplete information;
• erasure;
• restriction of processing;
• objection to processing, where the relevant conditions apply;
• data portability, where applicable;
• withdrawal of consent at any time, limited to processing based on consent, without affecting the lawfulness of processing carried out before withdrawal.

Individuals may exercise their rights by contacting:

• privacy@cloucasa.it
• direttiva.casa@legalmail.it

Individuals also have the right to lodge a complaint with the Italian Data Protection Authority.

References cited: Regulation (EU) 2016/679, Article 13.

Unless individuals are specifically informed otherwise, applicants’ personal data is not subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on them.

References cited: Regulation (EU) 2016/679, Article 13.

The Controller may update or amend this notice, including following changes in legislation, organisation or operations. The updated version will be made available through the channels used to collect applications.