Privacy Notice on the Processing of Personal Data – Recruitment procedure pursuant to Article 23 of Italian Law 240/2010

Introduction

Luiss, the Guido Carli Free International University of Social Studies (hereinafter “Luiss” or the “Data Controller”), is an independent university that offers an advanced educational model.

This privacy notice describes how Luiss processes the personal data provided by individuals who wish to apply for the competitive selection procedure under Article 23 of Italian Law 240/2010 (hereinafter the “data subject”), and sets out the rights guaranteed by Regulation (EU) 2016/679 (also referred to as the “Regulation” or “GDPR”).

This privacy notice is updated periodically to align it with current legislation or with new methods of processing personal data.

What personal data do we collect?

The Data Controller collects and processes the following personal data:

  • the data subject’s identifying information (first name, surname, place and date of birth, tax code, nationality);
  • contact details (home address, email, telephone number);
  • curriculum vitae.

Providing the data required for submitting and assessing an application is mandatory. Failure to provide this data, even partially, may make it impossible to take part in the procedure or to proceed with the assessment of the application. Providing any additional data is optional, unless such data is necessary to demonstrate that the declared requirements or qualifications are met.

For what purposes do we collect your data, and why is the processing lawful?

The Data Controller collects and processes the personal information of the data subject for the following purposes:  

  1. to enable the data subject to submit their application and to take part in the procedure for compiling/updating lists of eligible candidates for the award of teaching contracts on degree courses pursuant to Article 23 of Italian Law 240/2010, by verifying that the application is complete and that the eligibility criteria set out in the notice are met (the legal basis for the processing is the performance of pre-contractual measures taken at the data subject’s request, pursuant to Article 6(1)(b) of Regulation (EU) 2016/679, and, for the checks required by applicable law, compliance with a legal obligation pursuant to Article 6(1)(c) of the Regulation);
  2. to manage, from an administrative standpoint, the selection procedure, including the assessment of candidates based on merit, their curriculum vitae, qualifications, and any other criteria set out in the notice; the work of the evaluation committee; the preparation and approval of the results; and communications with candidates (the legal basis for the processing is the performance of pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) of Regulation (EU) 2016/679, as well as compliance with any legal obligations under Article 6(1)(c) of the Regulation);
  3. to verify the truthfulness of the statements made by the data subject and the authenticity of the qualifications and documents submitted (the legal basis for the processing is compliance with a legal obligation under Article 6(1)(c) of Regulation (EU) 2016/679 and, in other cases, the pursuit of the Data Controller’s legitimate interest in ensuring the regularity and integrity of the procedure, under Article 6(1)(f) of the Regulation);
  4. to communicate or publish the results and records of the procedure, within the limits set by applicable law, the University’s regulations, and the selection notice, while observing the principles of necessity, proportionality, and data minimisation (the legal basis for the processing is the fulfilment of a legal obligation under Article 6(1)(c) of Regulation (EU) 2016/679 and, where no specific legal obligation exists, the pursuit of the Data Controller’s legitimate interest in ensuring the transparency, fairness, and verifiability of the procedure, pursuant to Article 6(1)(f) of the Regulation);
  5. to handle any requests from authorised parties to access the records of the procedure, while respecting the rights and interests of other parties concerned (the legal basis for the processing is compliance with a legal obligation under Article 6(1)(c) of Regulation (EU) 2016/679);
  6. to proceed, with regard to the successful candidate, to the possible award of the position and to the management of the administrative, tax, accounting, social security and insurance obligations associated with the employment relationship (the legal basis for the processing is the performance of pre-contractual measures and the subsequent contract, pursuant to Article 6(1)(b) of Regulation (EU) 2016/679, as well as compliance with the legal obligations to which the Data Controller is subject, pursuant to Article 6(1)(c) of the Regulation);
  7. to comply with legitimate requests from the competent administrative, judicial or supervisory authorities (the legal basis for the processing is the fulfilment of a legal obligation to which the Data Controller is subject, pursuant to Article 6(1)(c) of Regulation (EU) 2016/679);
  8. to prevent and handle any objections, complaints, appeals, or disputes relating to the procedure, as well as to establish, exercise, or defend a right of the Data Controller in out-of-court, administrative, or judicial proceedings (the legal basis for the processing is the Data Controller’s legitimate interest in protecting its rights, pursuant to Article 6(1)(f) of Regulation (EU) 2016/679).

How does the Data Controller process your personal data, and for how long does it retain it?

The personal data of the data subject are processed electronically (servers, cloud-based databases, software applications, etc.).

The Data Controller retains the data subject’s information for a period determined in accordance with civil limitation periods and in compliance with specific sectoral laws, as well as for the time necessary to properly fulfil the purposes set out above.

Who do we share your personal data with?

Scope of internal communication

Only employees and collaborators of the University who need access to the data subject's personal data in order to provide the requested services may access it, and only to the extent that the information is necessary and relevant for that purpose. Specifically:

  • administrative staff;
  • teaching staff
  • collaborators.

Our employees and collaborators have been informed and trained on the importance of complying with the principles and rules governing the processing of personal data.

Scope of external communication

The Data Controller shares the personal information of data subjects with certain suppliers who assist in providing the requested services and who are specifically appointed for this purpose as external Data Processors. In particular:

  • if it is necessary for reasons of national security;
  • for reasons of general interest;
  • in connection with a request from public authorities.

Are your data transferred abroad?

As a general rule, the data subject's data are not transferred outside the European Economic Area. Should such a transfer become necessary, the provisions set out in Chapter V of the Regulation will be applied.

What are your rights as a data subject, and how can you exercise them?

The European General Data Protection Regulation (2016/679) grants specific rights to data subjects. In particular, these include the right to access, rectify, object to, erase, restrict, and port data, as well as the right to lodge a complaint with the Data Protection Authority.

If the data subject wishes to exercise the rights granted by law, they may, without any formalities, send an email to privacy@luiss.it or write to the Data Controller, Luiss Guido Carli, at Viale Pola no. 12 – 00198 – Rome, specifying your request and providing the information necessary to identify the applicant.

The DPO can be contacted at the following address: dpo@luiss.it.