In accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), this notice is provided to individuals (hereinafter referred to as “data subjects”) who submit their applications and take part in the selection procedures of Turismo Torino e Provincia, including those aimed at establishing employment relationships or commencing work placements.
Data Controller:
The data controller is Turismo Torino e Provincia, whose registered office is located at Via Maria Vittoria 19, Torino (TO). For information or enquiries regarding the processing of personal data, please email: privacy@turismotorino.org.
Data Protection Officer (DPO):
The Data Protection Officer can be contacted by email at dpo@turismotorino.org.
What data is processed? Who provides it?
In particular, the following data may be processed:
- personal and identifying data, such as first name, surname, date and place of birth, address, tax identification number, nationality and identity document;
- contact details, such as telephone number and email address;
- data relating to educational, training and professional background, such as CVs, academic qualifications, professional experience, training courses, skills, language and IT proficiency, certifications and qualifications;
- data relating to participation in the selection process, such as the application form, the position for which the application is being made, declared requirements, documentation submitted and information necessary to verify that the required criteria are met;
- data relating to the assessment of the candidate, such as information gathered during interviews, tests taken, scores, assessments and the outcomes of the procedure;
- where necessary, data falling within special categories, for example data relating to health, disability or membership of protected groups, where such data is necessary for participation in the procedure or to fulfil specific obligations laid down by law;
- statements made by the candidate regarding the absence of criminal convictions, offences or related security measures, where required by the selection procedure and applicable legislation.
Where applicable, certain data may be obtained from third parties or relevant authorities. This may be used to verify the data subject's statements and ensure they comply with the required criteria.
Why is the data used?
- To manage applications and participation in the selection process, including verifying eligibility criteria. The legal basis is: The performance of pre-contractual measures taken at the data subject’s request (Article 6(1)(b) of the GDPR), and where applicable, compliance with legal obligations (Article 6(1)(c) of the GDPR). The data is retained for the duration of the selection process and, subsequently, for the periods provided for by applicable legislation or for as long as is necessary to safeguard the Data Controller’s rights.
- The data is also used to carry out assessment and selection activities, including tests and interviews, to award marks, and to prepare results and ranking lists. Legal basis: The performance of pre-contractual measures taken at the data subject’s request (Article 6(1)(b) of the GDPR), and where applicable, compliance with legal obligations (Article 6(1)(c) of the GDPR). The data will be retained for the duration of the selection process and thereafter for the period required by applicable legislation or necessary to safeguard the data controller’s rights.
- To manage enquiries, complaints and disputes relating to the selection process. Legal basis: The data controller's legitimate interest in safeguarding its rights (Article 6(1)(f) of the GDPR). For any data falling within special categories, the legal basis is the need to establish, exercise or defend legal claims (Article 9(2)(f) of the GDPR). Data will be retained for as long as is necessary to handle requests, complaints or disputes, and until the expiry of any time limits for potential legal actions or appeals.
Is it compulsory to provide the data?
Providing the data required to participate in the selection process is necessary.
If this data is not provided, Turismo Torino e Provincia may not be able to admit the data subject to the process, assess their application, or proceed with subsequent stages of the selection process.
Providing any additional information is optional.
Who may access or receive the data?
Where necessary, the data may also be disclosed to external parties. These parties may include:
- external members of selection panels or other parties involved in the selection procedures;
- companies, professionals and consultants assisting Turismo Torino e Provincia with recruitment, assessment and selection activities;
- providers of platforms used to collect and manage applications;
- IT, cloud and telecommunications service providers;
- employment consultants and other professionals involved in activities relating to the selection process and the potential establishment of an employment relationship;
- organisers, universities, educational institutions or training bodies where the procedure involves arranging a work placement;
- public bodies and other parties to whom the data must be disclosed in accordance with applicable legislation;
- solicitors and advisers involved in handling any disputes or litigation;
- judicial authorities, public security authorities and other competent authorities in cases provided for by law.
Suppliers who process personal data on behalf of Turismo Torino e Provincia are appointed as Data Processors where applicable. The up-to-date list of data processors may be requested from the data controller.
In accordance with the applicable transparency legislation, certain data, documents or results relating to the selection procedure may be published on Turismo Torino e Provincia's official website, in line with the principles of necessity and data minimisation.
Is data transferred outside the European Economic Area?
Certain services used by Turismo Torino e Provincia, particularly IT and cloud services, may involve transferring personal data to countries outside the European Economic Area.
Where this occurs, the transfer is carried out in accordance with the GDPR. This may be on the basis of an adequacy decision by the European Commission or the EU-US Data Privacy Framework (where applicable), or through the use of standard contractual clauses or other legal safeguards.
Further information on transfers and the safeguards used is available from the Data Controller.
What rights does the data subject have?
In the cases provided for, the data subject may exercise the rights recognised by Articles 15–22 of the GDPR. In particular, they may:
- request information on which personal data is being processed and obtain a copy of such data (right of access);
- request the correction of inaccurate data or completion of incomplete data (right to rectification);
- request erasure of data where the conditions are met (right to erasure);
- request restriction of data processing in cases provided for by the GDPR (right to restriction);
- receive data provided to the data controller in a structured format and transmit it to another data controller (right to data portability).
The data subject may also object, on grounds relating to their specific situation, to processing carried out on the basis of legitimate interest. However, Turismo Torino e Provincia may continue to process the data if there are overriding legitimate grounds for doing so.
These rights are not absolute and may be restricted in cases provided for by law. For example, certain data cannot be erased if Turismo Torino e Provincia is required by law to retain it.
To exercise your rights, please contact Turismo Torino e Provincia at privacy@turismotorino.org.
Complaint to the Supervisory Authority
You may lodge a complaint with the Data Protection Authority if you believe that your personal data is being processed in breach of data protection legislation, in accordance with Article 77 of the GDPR.