GENERAL PRIVACY POLICY FOR THE USERS OF IMA Servizi ScarlCollection and use of informationINFORMATION NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION N. 2016/679IMA ITALIA ASSISTANCE S.p.A., (Fiscal Code: 09749030152 – VAT Number: 02069150965) (hereinafter "IMA ITALIA"), in the person of its legal representative pro tempore, with registered office in Sesto S. Giovanni (MI), Piazza Indro Montanelli, 20, and IMA SERVIZI S.c.a.r.l., (C. f.: 10977590156 – P. IVA: 02420860963) hereinafter (“IMA SERVIZI”) with registered office in Sesto S. Giovanni (MI), Piazza Indro Montanelli, 20, in theirs capacity as autonomous Data Controllers ex art. 4 n. 7) and 24 of EU Regulation n. 2016/679 (GDPR), informs you, pursuant to art. 13 of GDPR, that your personal data, described in art. 1, will be processed by IMA ITALIA and IMA SERVIZI for the execution of the processing purpose described in art. 2. 1. Category of personal data being processed1.1. IMA ITALIA and IMA SERVIZI collects and processes, in order to pursue the processing purpose described in art. 2, the following information about you:        i.         personal data within the meaning of art. 4 n. 1) of GDPR, contained in your curriculum vitae (CV) delivered to/received by IMA ITALIA and IMA SERVIZI by any direct/indirect means, communicated by you to IMA ITALIA and IMA SERVIZI by completing one or more questionnaires made available to IMA ITALIA and IMA SERVIZI for the purpose of the processing in question, or communicated on your own initiative, always for this purpose, to IMA ITALIA and IMA SERVIZI (hereinafter "personal data");       ii.         if necessary, special categorie of personal data within the meaning of art. 9(1) of GDPR (with the exception of any genetic data within the meaning of art. 4(13) of GDPR, in accordance with paragraph 1.4.1.) letter d) of Order n. 146 of 5.6.2019 signed by the Italian Data Protection Authority [web doc. no. 9124510]), possibly contained within your CV, communicated by you to IMA ITALIA and IMA SERVIZI thanks to the completion of one or more questionnaires made available to the latter for the fulfilment of the processing purpose in question, or communicated on your own initiative (hereinafter “special personal data");     iii.         if necessary, judicial personal data pursuant to art. 10 of GDPR (e.g. criminal records; self-declaration in lieu of affidavit pursuant to Presidential Decree n. 445/2000), concerning, in particular, the existence, or otherwise, of the requisites of respectability provided for/required by IMA ITALIA and IMA SERVIZI (hereinafter "judicial personal data"). In compliance with paragraph 1.4.1) of Provision n. 146 of 5.6.2019 signed by the Italian Privacy Guarantor [web doc. n. 91245101], IMA ITALIA and IMA SERVIZI specifie, in this regard, that: the processing carried out, for the purposes of establishing an employment/collaboration relationship or a professional/employment/corporate role, will concern, within the limits established by the provisions referred in art. 113 of amended Legislative Decree n. 196/2003 (Privacy Code), only the information that is strictly pertinent and limited to what is necessary for that processing purpose, also taking into account the particular task/assignment/employment/collaboration role requested; if the CV sent by the candidate or if the communications/statements/documents sent by the latter to IMA ITALIA and IMA SERVIZI contain data that are not pertinent to the processing purpose pursued, the latter undertakes to refrain from using them. 2. Purpose of processing and legal basis.2.1. Your personal data and, if necessary, your special personal data and your judicial personal data are/can be processed by IMA ITALIA and IMA SERVIZI for the performance of the following processing purpose:a.      Search/selection/assessment of a candidate for an employment or similar/collaboration relationship or a corporate position/role in IMA ITALIA or IMA SERVIZI, including verification, if necessary, of the preliminary existence of the requirements (e.g. of professionalism/honourableness/independence/competence/autonomy/absence of operational conflicts) required by law (e.g. art. 30 and 76 of Legislative Decree n. 209/2005 (Private Insurance Code); art. 2399, 2382 and 2387 of Civil Code; art. 5 paragraph 2) and 25 of IVASS Regulation n. 38 of 3.7.2018; Legislative Decree n. 231/2001), based on the function/role covered in the name and on behalf of IMA ITALIA or IMA SERVIZI (e.g. administration/management/control function; person who performs a key function). In compliance with art. 13 paragraph 2) letter e) of GDPR, IMA ITALIA and IMA SERVIZI specifie that any failure to communicate (even partial, if necessary) your personal data and, if necessary, your special personal data and/or your judicial personal data may, if necessary, result in the impossibility for IMA ITALIA and IMA SERVIZI to perform, in a correct and complete manner, the processing purpose referred in art. 2.1. letter a). In this regard, IMA ITALIA and IMA SERVIZI specifie that the legal basis of the processing purpose referred in art. 2.1. letter a) is to be found in the following regulatory provisions, in addition to those indicated in art. 2.1. letter a) above: art. 6 paragraph 1) letters b) and c) of GDPR, for your personal data; art. 9 paragraph 2) letter b) of GDPR, Provision n. 146 of 5.6.2019 of the Italian Privacy Guarantor (to be read, together with art. 21 paragraph 5) of Legislative Decree n. 101 of 10.8.2018), art. 113 of Privacy Code, art. 8 of Law n. 300/1970 (Worker's Statute), for your special personal data; art. 10 of GDPR (to be read, together with art. 2 octies paragraph 3) letters a) and c) of Privacy Code), for your judicial personal data.3. Retention period.3.1. In accordance with art. 13 paragraph 2) letter a) of GDPR, IMA ITALIA and IMA SERVIZI inform you of the following retention periods/criteria, after which your personal data, your special personal data and your judicial personal data will be subject to deletion, destruction or anonymisation: (i) for the execution of the processing purpose referred in art. 2.1. letter a): in case of success of the selection process: 10 years pursuant art. 2946 c.c., in the event of failure of the selection process: in general, n. 1 year, commencing from the communication to you by IMA ITALIA and/or IMA SERVIZI of the negative outcome (also in the form of the so-called silence/denial, after a reasonable period of time has elapsed since the last job interview carried out for IMA ITALIA and/or IMA SERVIZI in relation to the job position/role applied for: at the expiry of this period, IMA ITALIA and IMA SERVIZI reserve the right to ask you, in accordance with Recommendation CM/Rec (2015)5 of the Committee of Ministers to Member States, for your permission to further (but predetermined) retention of your CV, in anticipation of further job opportunities.  4. Target audience.4.1. In compliance with art. 13 paragraph 1) letter e) of GDPR, IMA ITALIA and IMA SERVIZI specifie that your personal data, your special personal data and your judicial personal data may be subject to communication, if necessary and appropriate, to one or more recipients pursuant to art. 4 n. 9) of GDPR, identified, in general, by category as follows: (i) for the execution of the (macro) purpose of processing referred to in art. 2.1. letter a): parties authorised to process the data pursuant to art. 4 n. 10), 29 and 32 paragraph 4) of GDPR by IMA ITALIA and IMA SERVIZI; subsidiaries/parent companies/former members of the business group of IMA ITALIA and IMA SERVIZI, in compliance with Recital n. 48) of GDPR; consultants/companies of various kinds/forms that provide services directly/indirectly connected to the fulfilment of the (macro) processing purpose referred in art. 2.1. letter a) (e.g. labour/ICT/human resources consultant). 5. Transfer.5.1. Your personal data, your particular personal data and your judicial personal data are stored in automated/partially automated/non-automated files belonging to, or in any case traceable, even indirectly, to IMA ITALIA and IMA SERVIZI, and located within the European Economic Area (EEA). 6. Data subject’s rights.6.1. In relation to the user's personal data, IMA ITALIA and IMA SERVIZI inform that the relevant data subject pursuant to art. 4 n. 1) of GDPR has the right to exercise the following rights which may be subject to the limitations provided for in art. 2 undecies and 2 duodecies of Legislative Decree n. 196/2003 (Privacy Code): right of access pursuant to art. 15 of GDPR: right to obtain confirmation as to whether or not personal data concerning the data subject are being processed, as well as the information referred in art. 15 of GDPR (e.g. purpose of processing, storage period); right to rectification under art. 16 of GDPR: right to correct, update or supplement personal data; right to erasure under art. 17 of GDPR: right to obtain erasure or destruction or anonymisation of personal data, where, however, the conditions listed in the same article apply; right to restriction of processing under art. 18 of GDPR: right to obtain the restriction of the processing of personal data in the cases governed by art. 18 of the GDPR; right to data portability under art. 20 of GDPR: right to obtain the personal data provided to IMA ITALIA and IMA SERVIZI in a structured, commonly used and machine-readable format (and, where required, to transmit them directly to another Data Controller), where the specific conditions set out in that article are met (e.g. legal basis of consent and/or execution of a contract; personal data provided by the data subject); right to object under art. 21 of GDPR: right to obtain the cessation, on a permanent basis, of a specific processing of personal data; right to lodge a complaint with the Privacy Guarantor under art. 77 of GDPR: right to lodge a complaint where it is considered that the processing under analysis violates national and EU legislation on the protection of personal data. 6.2. In addition to the rights described in art. 6.1. above, IMA ITALIA and IMA SERVIZI specifie that, in relation to the personal data of the data subject, there is, where possible and conferring, the right to exercise, on the one hand, the (sub)right provided for art. 19 of GDPR ("The controller shall communicate to each of the recipients to whom the personal data have been transmitted any rectification or erasure or restriction of processing carried out pursuant to article 16, article 17(1) and article 18, unless this proves impossible or involves a disproportionate effort. The data controller shall inform the data subject of such recipients if the data subject so requests"), to be considered connected and related to the exercise of one or more of the rights regulated in articles 16, 17 and 18 of GDPR; on the other hand, IMA ITALIA and IMA SERVIZI specifie that, in relation to the personal data of the data subject, there is, where possible and conferring, the right to exercise the right provided for in art. 22(1) of GDPR ("The data subject shall have the right not to be subject to a decision which is based solely on automated processing, including profiling, and which produces legal effects concerning him or her or significantly affects him or her in a similar way"), subject to the exceptions provided for in paragraph 2 below.)6.3. Pursuant to article 12 paragraph 1) of GDPR, IMA ITALIA and IMA SERVIZI undertake to provide the User with the communications referred in art. from 15 to 22 and 34 of GDPR in a concise, transparent, intelligible, easily accessible and plain language form: such information shall be provided in writing or by other electronic means, or, at the User's request, orally provided that the User's identity is proven by other means. 6.4. In accordance with article 12 paragraph 3) of GDPR, IMA ITALIA and IMA SERVIZI inform you that it undertakes to provide you with information regarding the action taken in respect of a request pursuant to art. from 15 to 22 of GDPR without undue delay and, in any event, at the latest within one month of receipt of such request; this period may be extended by n. 2 months if necessary, taking into account the complexity and number of requests (in this case, the Controller undertakes to inform the user of such extension and the reasons for the delay, within one month of receipt of the request).6.5. The user may exercise the above-described rights at any time (with the exception of the right under Art. 77 of GDPR) by using the contact details set out in art. 7.7. Contact details.7.1. IMA ITALIA and IMA SERVIZI can be contacted at the following address: [email protected]. The Data Protection Officer (DPO) ex art. 37 of GDPR, appointed by IMA ITALIA, can be contacted at the following address: [email protected] 7.3 The Data Protection Officer (DPO) ex art. 37 of GDPR, appointed by IMA SERVIZI, can be contacted at the following address: [email protected] Sesto S. Giovanni (MI), 17.10.2022 (date of last update). IMA ITALIA ASSISTANCE S.p.A.(in the person of its legal representative pro tempore)IMA SERVIZI S.c.a.r.l.(in the person of its legal representative pro tempore)