Reference regulations:
- D.lgs. n. 196 del 30 Giugno 2003, Personal Data Protection Code (hereinafter Privacy Code), as amended by D.lgs. 101/2018;
- Regolamento UE n. 679 del 27 Aprile 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of personal data (hereinafter “EU Regulation” or “GDPR”);
- Legge n. 300 del 20 Maggio 1970, most recently updated with the amendments set forth in D.lgs. 24 settembre 2016, n. 185 (hereinafter “Workers' Statute”);
- D.lgs. n. 81 del 9 Aprile 2008, Consolidated Occupational Health and Safety Act (hereinafter Occupational Health and Safety Act);
- Provvedimento di Autorizzazione al trattamento dei dati sensibili nei rapporti di lavoro, del 15 Dicembre 2016, dell'Autorità Garante per la Protezione dei Dati Personali (hereinafter Authorization Provision of the Italian Data Protection Authority).
- Parere EDPB 2/2017 on data processing in the workplace.
- D.lgs n. 276/2003 art. 10 “Prohibition of opinion surveys and discriminatory treatment”
We wish to inform you that, following the submission of your curriculum vitae, in order to verify the possibility of transforming your application into an employment/work relationship and in compliance with Articles 13 and 14 of the European Regulation No. 679 of 2016 (the “Privacy Regulation”), The Company Toscana Aeroporti S.p.A. with registered office in Florence, via del Termine 11, as a potential employer/employer, collects and processes personal data of yours (as the “Interested Party”) and possibly personal data of your family members.
It should be noted that with reference to the selection activity, subject to your specific consent, if any, Toscana Aeroporti S.p.A. may process personal data that the Privacy Regulation as “particular” insofar as suitable to detect, for example, a general state of health or specific conditions (e.g. physical problems, allergies, belonging to protected categories and degree of disability) necessary to assess the suitability or otherwise of the Interested Party to certain tasks or the possibility of being hired as belonging to protected categories.
Subject to your specific consent, if any, and always with reference to the selection activity, the Data Controller may also acquire and manage, among your personal data, one or more photographic images to be attached to the information taken during the interview in the function of personnel selection.
1. Data Controller, Data Processors and Data Protection Officer.
The Data Controller is The Company Toscana Aeroporti S.p.A. with registered office in Florence, via del Termine 11 (hereinafter, the “Data Controller”). The updated list of Data Processors, where designated, can be provided upon request of the Data Subject.
The Data Protection Officer (pursuant to Article 37 of the Privacy Regulation) can be contacted at the office or at the email address
2. Purposes and methods of processing.
The Data Subject's personal data are processed, as part of the Controller's normal personnel selection activities, to verify the possibility of transforming your application into an actual employment/work relationship.
The CV data acquired by Toscana Aeroporti S.p.A. may be shared with companies that are part of the corporate group to which the company belongs, so that the candidate can be conveyed based on the specific employment needs of those companies (legitimate interest of the parent company, as indicated in recital 48 of the Gdpr). In this case, you will be asked for prior consent to share your personal data contained in the CV.
In relation to this purpose, the processing of personal data is carried out by parties specifically appointed, authorized and instructed to process them in accordance with Article 2 quatercedies of the Privacy Code and Articles 28 and 29 of the Privacy Regulations, as well as through external parties (e.g., personnel selection companies, external consultants for the processing of salary and contribution data, etc. ), which may take on the status of autonomous Data Controllers or be designated in writing as Data Processors; in any case, the processing will be carried out by means of manual, computerized and telematic tools, with logics strictly related to the purposes and in any case in such a way as to guarantee the confidentiality and security of personal data and in full and absolute compliance with the relevant regulations in force.
Aptitude tests may be carried out with the participation of qualified external parties (appointed as data processors ex art. 28 Gdpr) in compliance with applicable regulations and with the utmost attention to the protection of the candidate's rights.
Your data will be stored by the Data Controller for the period of time strictly necessary in relation to the purpose expressed above, without prejudice to the need for storage for a longer period in compliance with the regulations, including accounting regulations, in force. Your data will be processed in Italy and, in any case, within the EU in the preliminary selection phase for which this notice is given.
3. Compulsory or optional nature of the provision of data, consequences of any refusal and legal basis for processing.
With reference to the purposes described above, the provision of personal data is mandatory, as in its absence the possibility of establishing a working relationship/performance of work with the Interested Party could not occur. The legal basis of the processing is, therefore, the verification of the possibility of establishing a working relationship/performance of work to which the Interested Party is a party and at the request of the same (pursuant to Article 6, paragraph 1, letter b) of the Privacy Regulation). The legal basis for the processing of data that may be collected from “social recruiting” activities limited to the profiles on “professional” social media indicated by you is in the legitimate interest of the employer to protect its business by taking measures that ensure a balance with the fundamental rights and freedoms of the prospective employee. The data subject to analysis and evaluation on the basis of “social recruiting” will be acquired in compliance with current legislation (Workers' Statute in the first place).
With reference to the processing of personal data that the Privacy Code defines as “sensitive” and the Privacy Regulations as “particular” in that they are suitable for detecting, for example, a general state of health or specific conditions (e.g. physical problems, allergies, membership in protected categories and degree of disability) for the purpose of assessing the suitability or otherwise of the Data Subject for certain tasks or the possibility of being hired as a member of protected categories, the provision of such data is optional but failure to provide it and the failure to give consent to it nevertheless determines the impossibility of being selected for the aforementioned specific tasks or as a function of membership in protected categories.
4. To whom and in what scope we may transmit the personal data of the Data Subject.
In relation to the purposes of the processing indicated above, and within the limits strictly relevant to them, your personal data will or may be communicated, in Italy, or in any case within the EU:
(i) to all subjects in any capacity involved in the recruting activity aimed at the stipulation of an employment/work relationship, appointed and instructed in writing in accordance with the law by the Data Controller according to the modalities provided by the company's job descriptions;
(ii) to external consultants called to perform the aforementioned activity, if not designated in writing as Data Processors;
(iii) to companies belonging to the corporate group of Toscana Aeroporti S.p.A..
The subjects indicated above, to whom your personal data will or may be communicated (when they are not designated as Data Processors), will process the personal data as Data Controllers in accordance with the Privacy Code. A detailed and constantly updated list of these entities, with an indication of their respective locations, is always available at company headquarters.
Your personal data will not be disseminated.
5. Rights of the Data Subject.
Articles 15 et seq. of the Privacy Regulation give the Data Subject the right to obtain, in the manner established by Article 12 of EU Regulation 2016/679:
- the confirmation of the existence or not of personal data concerning him/her, even if not yet registered, and their communication in an intelligible form;
- the indication of the origin of personal data, the purposes and methods of processing, the logic applied in case of processing carried out with the aid of electronic instruments, the identification details of the owner;
- the updating, rectification, integration, deletion, transformation into anonymous form or blocking of data processed in violation of the law - including those that do not need to be kept in relation to the purposes for which the data are collected or subsequently processed -, certification that such operations have been brought to the attention, also as regards their content, of those to whom the data were communicated or disseminated, except where this proves impossible or involves a manifestly disproportionate to the protected right.
The Data Subject also has the right:
- to revoke at any time consent (where given) to the processing of personal data (without prejudice to the lawfulness of the processing based on the consent given before revocation);
- to object, in whole or in part, on legitimate grounds, to the processing of personal data concerning him/her, even if pertinent to the purpose of collection;
- to object, in whole or in part, to the processing of personal data concerning him/her for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication;
- to lodge a complaint with the Guarantor for the Protection of Personal Data in the cases provided for by the Privacy Regulations, addressing the Guarantor for the Protection of Personal Data directly. Website www.gpdp.it - www.garanteprivacy.it E-mail:
This email address is being protected from spambots. You need JavaScript enabled to view it. Fax: (+39) 06.69677.3785 Telephone switchboard: (+39) 06.69677.1 - to the portability of personal data within the limits of Article 20 of the Privacy Regulations.
In order to know the detailed and constantly updated list of the subjects to whom the personal data of the Interested Party may be communicated and to exercise the rights under Articles 15 et seq. of the Privacy Regulations, the same may contact the undersigned company, as Data Controller.
6. Security Measures.
All processing is carried out through the adoption of the appropriate technical and organizational measures to ensure a level of security appropriate to the risk in accordance with the methods referred to in Articles 5 et seq. and 32 et seq. of the Regulations, as well as the relevant provisions of the Privacy Guarantor.
In this regard, it is confirmed, inter alia, the adoption of appropriate security measures to prevent unauthorized access, theft, disclosure, unauthorized modification or destruction of the data of the Data Subject.
7. Duration of processing.
In accordance with Article 5 let. e) of the Regulation, the personal data subject to processing will be kept for the time strictly necessary in relation to the above purposes and, in any case, for a period not exceeding 24 months. In the case of employment, the CV will be attached to the employee's file and will be kept there as required by current regulations for a period of 10 years after the end of the employment relationship. In case of negative evaluation for an application against an open job position, the data acquired in the so-called “social recruiting” will be deleted at the end of the selection process. In case of positive evaluation and subsequent establishment of an employment relationship, only evaluative opinions on the acquired data will be stored.