CANDIDATES' PRIVACY INFORMATION NOTICE

 

1. Introduction

 

YT IT Service S.r.l. , acting as data controller (hereinafter, the “Company” or the “Data Controller”), hereby informs candidates who send their Curriculum Vitae to the Company or who, in any other way, take part in selection procedures aimed at establishing an employment relationship or collaboration with the Data Controller (hereinafter, the "Candidates" or "Data Subjects") of the methods and purposes of the processing of their personal data in compliance with Legislative Decree no. 196/2003 as subsequently amended and supplemented by Legislative Decree no. 101/2018 (hereinafter, "Privacy Code") and with the European General Data Protection Regulation no. 679/2016 (hereinafter, "GDPR”).

 

1. Who Is the Data Controller?

 

YT IT Service S.r.l., with registered office at Via Delle Quattro Fontane 20, Rome (RM), VAT no. 17621541006  and which can be contacted at the following address compliance@yellowtree.com, is the data controller in relation to the processing of personal data described in this privacy information notice (hereinafter, “Privacy Notice”).

 

1. What Personal Data Are Collected?

 

The Company collects the following categories of personal data relating to the Candidate:

 

1. identification data, such as name, surname, age, date of birth, nationality, as well as the photo of the Candidate, as contained in the Curriculum Vitae;

2. contact details, such as address, telephone number and email;

3. information relating to educational background and knowledge of languages;

4. information on professional experience, including the last position held and details of the last salary received;

5. Curriculum Vitae of the Candidate;

6. further personal data that may be provided by the Candidate during the selection process, in particular during the interview

 

(hereinafter, the “Personal Data”).

 

1. Where Does Personal Data Come From?

 

Within the limits of the purposes described in paragraph 5 below, the Data Controller mainly processes the Personal Data provided directly by the Candidate during the selection phase or through the application procedure by physical or electronic mail delivery of the Curriculum Vitae to the Data Controller.

 

1. What Are the Purposes of the Personal Data Processing?

 

The Company processes the Data Subject’s Personal Data for the following purposes:

 

1. To execute pre-contractual measures upon Candidate's request for the possible establishment of an employment relationship;

2. To evaluate the Candidate's professional profile for the purposes of establishing an employment relationship or collaboration;

3. For administrative-accounting purposes, in the phase preparatory to the possible signature of the employment or collaboration agreement;

(the purposes as per letters a), b) and c) are jointly referred to as the "Contractual Purposes");

 

1. To comply with any legal or regulatory obligations (hereinafter, the "Law Purposes");

 

1. To keep the Curriculum Vitae of the Candidate whose application has been unsuccessful, in order to assess, if necessary, his/her suitability for positions other than the one for which he/she had applied, should new working positions at the Data Controller open;

2. To exercise and defend its rights against the Candidate or third parties in court proceedings or in administrative or out-of-court procedures;

3. To complete a potential merger, sale of assets, transfer of company or business by transferring the Candidate’s Personal Data to the third party(ies) involved;

(the purposes as per letters e), f) and g) are collectively referred to hereinafter as the "Legitimate Interest Purposes").

 

1. On Which Legal Basis Does the Company Process Data?

 

The processing of the Candidate’s Personal Data is necessary with regard to the Contractual Purposes and Law Purposes, as it is essential to: (i) assess the Candidate’s suitability for the position he/she applied to and (ii) allow the Data Controller to adapt to any obligations imposed by law or regulation. Should the Data Subject refuse to provide its Personal Data with regard to the purposes above, the Company will not be able to evaluate his/her profile and, therefore, to sign any employment or collaboration agreement with him/her.

 

The processing of the Candidate’s Personal Data for the Legitimate Interest Purposes is carried out pursuant to article 6, letter f) of the GDPR, for the pursuit of the Company's legitimate interest, which is adequately balanced with the Candidate's interest since the data processing is performed within the limits strictly necessary to perform the required economic activities and the other processing set forth in paragraph 5 above. This data processing activity with regard to the Legitimate Interest Purposes is not mandatory and the Candidate can object to the data processing at any time through the modalities as per paragraph 11 of this Privacy Notice. In such case no data processing will be carried out for Legitimate Interest Purposes, without prejudice to an overriding interest of the Data Controller in continuing the processing.

 

1. How Is Data Processed?

 

Personal Data is processed for the purposes above through adequate paper and electronic means and will be protected by appropriate measures to ensure Personal Data’s confidentiality and security. In particular, the Data Controller adopts appropriate organizational and technical measures to protect Personal Data against loss, theft, as well as unauthorized use, disclosure or modification of the Personal Data.

 

1. Who Can Have Access to Personal Data?

 

For the purposes set forth in paragraph 5 above, the following categories of recipients can access to Personal Data:

 

1. The personnel belonging to the Data Controller or the subjects indicated below as data processors, within the scope of their respective duties and within the limits established by law;

2. Providers of support services, as well as of assistance or advice, to those carried out by the Data Controller, such as, by way of example but not limited to, legal, administrative and tax consultants, auditing companies, suppliers of technological services, as independent data controllers or data processors;

3. Sub-providers and/or sub-contractors engaged in activities connected to the execution of the recruiting process, in their quality as data processors;

4. Public bodies and/or judicial and/or control authorities, whose right to access the Personal Data is provided for by the applicable legislation, acting as independent data controllers; and

5. Other companies belonging to the group the Data Controller is part of and/or subjects transferring a company or business, companies resulting from possible mergers or any other transformation involving the Data Controller, acting as independent data controllers.

 

A complete and updated list of the data processors is available upon request to the Data Controller to be sent to the contact details indicated in paragraph 11 of this Privacy Notice.

 

In any case, Personal Data will not be disseminated.

 

1. Are Personal Data Transferred Abroad?

 

In compliance with the applicable laws Data Subjects’ Personal Data may be transferred to countries outside the European Economic Area and, in particular, to Gibraltar, Israel, and the UK. In any case, the Candidate’s Personal Data will be transferred in compliance with appropriate and suitable safeguards to carry out such transfer, pursuant to articles 44 et seq. of the GDPR.

 

1. Which Is the Data Retention Period?

 

The Candidate’s Personal Data will be retained for the period of time necessary to achieve the purposes for which such Personal Data were collected, as set out in this Privacy Notice. In any event, the Candidate’s Personal Data will be retained for the entire duration of the selection process and:

 

1. in the event of an unsuccessful application, for 2 year after collection; or

2. in the event of a successful application and subsequent employment, for the duration of the employment relationship and for 10 years after its termination.

 

At the end of the retention period, the Personal Data will be deleted or anonymized.

 

1. What Are the Data Subject's Rights?

 

Notwithstanding the possibility for the Data Subjects to not provide their Personal Data, Candidates, free of charge and at any given time, can:

 

1. obtain confirmation of the existence of Personal Data relating to them;

2. know the origin of the data, the purposes of the processing and its methods, as well as the logic applied to the processing carried out by electronic means;

3. verify the accuracy of Personal Data and request its integration, update or amendment;

4. request the erasure, anonymisation or restriction of the processing of Personal Data processed in breach of the applicable laws, and object, on legitimate grounds, to the processing of Personal Data;

5. withdraw previously given consents, if any;

6. request the Company to limit the processing of the Personal Data where (i) Data Subjects contest the accuracy of the personal data until the Company has taken sufficient steps to correct or verify its accuracy; (ii) the processing is unlawful but the Data Subjects do not want the Company to erase the Personal Data; (iii) the Company no longer needs the Personal Data for the purposes of the processing, but the Data Subjects require them for the establishment, exercise or defence of rights; or (iv) Data Subjects have objected to processing justified on legitimate interests according to Article 21.1 of the GDPR, pending verification as to whether the Company has compelling legitimate grounds to continue the processing;

7. object to the processing of the Personal Data for the Legitimate Interest Purposes;

8. request the erasure of the Personal Data without undue delay;

9. obtain the Personal Data portability.

 

Data Subjects will also have the right to lodge a complaint with the Garante per la protezione dei dati personali to the contact details available on the website www.garanteprivacy.it, provided the conditions are met.

 

In case of the Candidate’s death, the aforesaid rights relating to its Personal Data may be exercised by anyone who has a personal interest in the Candidate, or acts to protect the Candidate as its representative, or for family reasons worthy of protection pursuant to article 2-terdecies of the Privacy Code. Data Subjects may expressly prohibit the exercise by its assignees of some of the rights above by written notice to be sent to the Data Controller as indicated below, without prejudice to their right to withdraw or modify such expressed intention later on according to the same procedure. 

 

Requests for the exercise of rights may be made in writing to the Data Controller at the following e-mail address compliance@yellowtree.com.

 

1. Changes and Updates

 

This Privacy Notice is valid from the date of effectiveness below. However, the Company may subsequently update or integrate, with prior notice, this Privacy Notice, also as consequence of possible subsequent amendments and/or integrations of the applicable laws. In any case, changes will be notified in advance.

01.01.2026

​