Dedalus Spa (“Dedalus”) attaches a great deal of importance to and intends to pay particular attention to protecting your personal data and respecting your privacy.
The aim of this privacy policy (the “Policy”) is therefore to inform you of how your personal data is processed when you submit your application for a position within Dedalus (paid employment, internship, etc.).
In this regard, please note that Dedalus is deemed to act as the controller of your personal data (hereinafter referred to as “we”, “us” and “our”). Please refer to Section 7 (“How can you contact us?”) below to access the contact details.

1. What personal data do we collect? 

We collect the following categories of personal data about you:

• Identification data (e.g., surname, first name, date of birth, etc.).
• Professional and educational data (e.g., resume, identity of your current employer (if applicable).
• Evaluation data regarding your professional skills, including the results of practical tests performed during the recruitment process.
• Personal data (i.e., data relating to your personal life, as it appears on your resume or that you voluntarily convey in your exchanges with us, such as your hobbies or your marital
  status).
• Economic data (e.g., your current salary and salary expectations, etc.).
• Health-related data (e.g., information regarding disability) and other special categories of data (e.g., racial, or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership) if applicable pursuant to local legislation.
• Data related to criminal convictions and offences, if authorized by local laws.

The provision of your personal data is voluntary, but in most cases, we will be unable to process your application properly without it. For example, if you refuse to provide us with reasonably required information regarding your educational and professional background, we will be unable to determine
whether your profile meets the needs of the position and will have to reject your application.

In any case, we will inform you when it is mandatory to provide your personal data.
Additionally, if you provide us with personal data belonging to third parties (e.g., contact details for people with whom we can verify your references), you undertake to ensure that such persons have been duly informed of the processing of their personal data in accordance with this policy and, if required, have consented to the processing of their personal data.

The personal data may be collected directly from you or can be provided by third parties (such as, previous employers to verify your references) and/or publicly accessible sources.

2. Why do we use your personal data?

The table below outlines the purposes that we process your personal data for and, for each purpose, the legal basis for the processing operation in question:

PURPOSES	LEGAL BASIS
Processing of your application to: (i) determine the suitability of your profile for the position in question; and (ii) make you an offer if we believe that your profile matches the position that you have applied for.	The legal basis of the processing is the performance of the necessary steps to enter a potential employment contract with you. If special categories of data (such as, data relating to your health, your membership of a trade union and/or your political opinions, racial and/or ethnical origins, philosophical and/or religious beliefs, etc.) is processed in this context, the legal basis for such processing is the necessity to comply with relevant laws.
If your application is unsuccessful, your profile will be kept in a pool of applicants (so we can offer you future opportunities that are likely to suit you) and, if necessary, your profile will be shared with the other entities of the Dedalus Group that are likely to offer opportunities corresponding to your expectations.	Our legitimate interest is to simplify and improve our recruitment processes.
Site access and security management, including video surveillance if you are interviewing on our premises	Our legitimate interest is to protect people, premises, and property.
Compliance with the applicable legal framework	Need to comply with a legal obligation that we are subject to.
Management and follow-up of potential disputes	Our legitimate interest is to defend our interests, including through legal action.
Processing your request to receive our job alerts	Your optional consent.

In any case, please note that we will not process your personal data for any other purpose that is incompatible with the above-mentioned purposes.

3. Who do we share your personal data with?

In the context of our processing operations, we may communicate your personal data to the following recipients:

• to our service providers, suppliers, agents, and contractors, to the extent that they assist us in carrying out the purposes set out in this policy (e.g., we use IT service providers to host
  your personal data on our behalf).
• to other entities of the Dedalus Group.
• to competent courts, public authorities, government agencies and law enforcement agencies
  (including where we are required to comply with legal or regulatory requests).

Regardless of the recipient, we will only disclose your personal data to them on a strictly need-toknow basis and only to the extent required to fulfill the purposes identified in this policy.

We do not sell your personal data.

4. Do we transfer data outside the european economic area?

Should your personal data be transferred outside the European Economic Area (“EEA”), we ensure that the level of protection your personal data is given is not adversely affected by such transfers.

This specifically means that each of the intended transfers is based on one of the following mechanisms at least:

• the existence of an adequacy decision issued by the European Commission for the country that your personal data is transferred to; or alternatively;
• the conclusion of standard contractual clauses reproducing the models adopted by the European Commission; or, alternatively;
• the existence of an exemption related to one of the specific situations exhaustively provided for by the General Data Protection Regulation 2016/679 (“GDPR”) (e.g. where you have
  given your consent to such transfer having been informed of the absence of safeguards, where the transfer is necessary for the performance of a contract concluded between you
  and us, where the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and a third party, or where the transfer is necessary for the establishment, exercise or defense of our legal claims, etc.).

5. How long do we store your personal data for? 

We store your personal data for no longer than is necessary for the purpose of the processing
concerned.

In other words, this means that the storage periods we apply vary depending on the purpose for which we process the data in question. The table below therefore indicates, for each purpose, the storage period that will be applied to your personal data:

PURPOSES	STORAGE PERIOD
Processing of the recruitment activities related to a job opportunity in line your profile and making you an offer if we believe that your profile matches the position that you have applied for.	Until the recruitment process in question is completed.
If your application is unsuccessful, your profile will be kept in a pool of applicants (so we can offer you future opportunities that are likely to suit you) and, if necessary, your profile will be shared with the other entities of the Dedalus Group that are likely to offer opportunities corresponding to your expectations.	If you do not request that we destroy your file, your data will be automatically destroyed after the time provided by the applicable legislation and in any case no more than two years after we last have contact with you.
Compliance with the applicable legal framework	For the duration of the limitation period of the obligations that we are subject to
Management and follow-up of potential disputes	For the duration of the dispute and until all potential remedies have been exhausted
Processing your request to receive our job alerts	Until your consent is withdrawn

We have also defined an archiving policy. This ensures that your personal data is not stored in the active database unnecessarily.

In any case, once the applicable storage period has elapsed, we will irrevocably erase or anonymize your personal data so that you can no longer be identified.

6. What rights do you have?

In accordance with the applicable data protection legal framework, particularly the GDPR, you have the following rights as a data subject:

• You may request access to your personal data and request that it be rectified or erased.
• You also have the right to request that processing of your personal data be restricted or to object to the same.
• You have the right to portability of your personal data.
• Where processing of your personal data is based on your consent, please note that you may withdraw your consent at any time, without affecting the lawfulness of processing based on your consent carried out prior to your withdrawal of the same.

However, please note that some of the above rights are subject to specific conditions dictated by the applicable data protection legal framework. So, if your specific situation does not meet these conditions, we will unfortunately be unable to comply with your request.

To exercise your rights, please contact our DPO using the contact details provided in Section 7  (How can you contact us?). To process your request as efficiently as possible, we may ask you for certain additional information to confirm your identity and/or assist in locating the personal data that forms the subject matter of your request.

In any case, please note that you may lodge a complaint with the relevant data protection supervisory authority. A list of data protection authorities can be found at https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.

7. How can you contact us?

If you have any questions or requests regarding our processing operations with your personal data under this policy, including exercising your rights, as outlined above, you may contact us at the address specified in your documentation for the recruitment process.
We also have appointed a data protection officer (“DPO”), which you can contact by e-mail at thefollowing address:

• for Dedalus S.p.A [email protected]
• for companies based in UK [email protected]
• for companies based in France [email protected]
• for companies based in Germany/Austria [email protected]

Current version: Dedalus – applicant privacy policy – v. 1 ]

Last updated: September 2021