Data protection notice for job applicants (O_ES_IT)

December 2025

Version 1

Data protection is a matter of utmost importance to us. Therefore, we would like to inform you about how your personal data is processed and the rights you may exercise under the applicable data protection legislation, in particular Regulation (EU) 2016/679 (hereinafter also referred to as the “GDPR”), when you apply for a position with us.

1 Data Controller

The data controller is

Technoform Glass Insulation Italia S.r.l.

Viale Europa n. 30, 20047, Cusago (MI)

E-mail: privacy [dot] oesit [at] technoform [dot] com (privacy[dot]oesit[at]technoform[dot]com)

For any questions regarding data protection, feel free to contact us at any time using the contact details mentioned above.

2 Categories of Personal Data Processed

The categories of personal data (as defined in Article 4(1) of the GDPR) processed by the Data Controller may include, by way of example and without limitation:

Personal and identification data (such as, for example, first and last name, date of birth, place of birth, nationality, tax identification number, marital status, current occupation/profession, etc.);
Contact details (address, email address, telephone number and similar information);
Data relating to education, professional experience and activities performed;
Special categories of personal data (such as, for example, information concerning an individual's general health condition, membership of a specific protected category, or trade union membership).

3 Purpose and legal basis

3.1 Purposes Related to Compliance with a Legal Obligation (Article 6(1)(c) GDPR)

The processing of personal data is intended to enable the assessment of the Data Subject’s (candidate’s) application, whether submitted for a specific vacancy or on a speculative basis. In particular, within this context, personal data is processed for the following purposes:

Compliance with legal obligations connected with the application process and any subsequent employment placement, including the processing of special categories of personal data (see General Authorization No. 1/2016 and subsequent Decision No. 146 of 5 June 2019 issued by the Italian Data Protection Authority).

The retention period for personal data processed for the purposes set out in this section is 12 months from the date the information is collected, unless the candidate is hired. In such case, the retention period will follow the specific retention periods provided for or required in relation to the employment relationship established, as indicated in the relevant privacy notices.

3.2 Purposes Related to the Performance of a Contract or Pre-Contractual Measures (Article 6(1)(b) GDPR)

The processing of personal data is necessary for the implementation of pre-contractual measures, namely:

Management of the recruitment and selection process in relation to one or more vacant positions and, therefore, for the purpose of entering into an employment contract. This includes, by way of example and not limitation, the assessment and identification of one or more candidates for such positions and the collection of any information necessary for hiring and for the execution of the relevant employment agreement.

4 Recipients or Categories of Recipients of Personal Data

Within the scope of the above-mentioned purposes and pursuant to Article 13(1)(e) and (f) of the GDPR, the Data Controller may disclose your personal data to:

Internal departments and functions of the Data Controller;
Consulting firms;
Companies and professional service providers supplying IT services, including electronic data processing, software and cloud management services, website management, and IT consulting services;
The occupational health physician (where a pre-employment medical examination or other activities related to the health management plan are required).

The Data Controller informs you that it does not intend to transfer your personal data to countries outside the European Union (EU) or the European Economic Area (EEA) for the purposes described above.

5 Your right

The Data Subject may exercise the following rights pursuant to Article 13(2)(b) of the GDPR:

Right of access (Article 15 GDPR): the right to obtain confirmation as to whether or not personal data concerning them is being processed, to receive information about such processing, and, where applicable, to obtain a copy of their personal data.
Right to rectification (Article 16 GDPR): the right to obtain the correction of inaccurate personal data concerning them and to have incomplete personal data completed.
Right to erasure (“right to be forgotten”) (Article 17 GDPR): the right to obtain the deletion of their personal data without undue delay in the circumstances provided for by the GDPR.
Right to restriction of processing (Article 18 GDPR): the right to obtain the restriction of processing in the cases provided for by the GDPR, including where the processing is unlawful or the accuracy of the personal data is contested by the Data Subject.
Right to data portability (Article 20 GDPR): the right to receive their personal data in a structured, commonly used and machine-readable format and, where technically feasible, to have such data transmitted to another data controller in the cases provided for by the GDPR.
Right to object (Article 21 GDPR): the right to object, at any time and on grounds relating to their particular situation, to the processing of their personal data in the circumstances provided for by the GDPR.
Right not to be subject to automated decision-making (Article 22 GDPR): the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

Further information regarding the Data Subject’s rights may be obtained by requesting from the Data Controller the full text of the above-mentioned GDPR provisions.

These rights may be exercised in accordance with the GDPR by contacting the Data Controller, including by email, at privacy [dot] oesit [at] technoform [dot] com (privacy[dot]oesit[at]technoform[dot]com).

Pursuant to Article 19 GDPR, where required and feasible, the Data Controller shall inform the recipients to whom the personal data has been disclosed of any rectification, erasure, or restriction of processing requested by the Data Subject.

If the Data Subject believes that their rights under applicable data protection legislation have been infringed, they have the right to lodge a complaint with the competent Data Protection Authority in accordance with the procedures established by that Authority, available at: http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524, or by submitting a written complaint to the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

6 Possible consequences of failure to provide data and nature of data provision

Please note that where the legal basis for the processing of personal data is a legal obligation or a contractual (including pre-contractual) requirement, the Data Subject is required to provide the requested data.

Failure to provide such data may result in the Data Controller being unable to pursue the specific processing purposes for which the data is required.

When personal data is no longer necessary for the purposes for which it was collected and processed, it is routinely deleted. Where deletion is impossible or would require a disproportionate effort due to a specific method of storage, the data will no longer be processed and will be archived in areas with restricted access.

7 Existence of automated decision-making (Including profiling)

The use of solely automated decision-making processes, as described in Article 22 of the GDPR, is currently excluded.

Should the Data Controller decide in the future to implement such processes in specific cases, the Data Subject will be informed separately where required by law, or through an update of this Privacy Notice.

8 Source of the personal data and, where applicable, whether the data originates from publicly accessible sources

The Data Controller has obtained the personal data it processes from the following sources: universities, vocational training institutions, and IT platforms dedicated to recruitment and employment placement activities.

For further information regarding the origin of the personal data, the Data Subject may submit a request to the Data Controller using the contact details provided, pursuant to Article 14(2)(f) of the GDPR.

9 Methods of processing

Personal data will be processed in paper, electronic and telematic form and entered into the relevant databases (e.g., candidate databases), which may be accessed by, and therefore disclosed to, personnel expressly appointed by the Data Controller as Data Processors and Authorized Persons for the processing of personal data.

Such personnel may perform operations including consultation, use, processing, comparison and any other appropriate activities, including automated processing, in compliance with the applicable legal provisions designed to ensure, among other things, the confidentiality and security of the data, as well as the accuracy, updating and relevance of the data in relation to the stated processing purposes.

10 Validity and modification of this data protection notice

This data protection notice is currently valid (see status in the heading). Due to the further development of our offers or due to changes in legal or official requirements, it may become necessary to change this data protection notice.