Information on the Processing of Personal Data

Pursuant to Article 13 of Regulation (EU) 2016/679

Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation hereinafter “GDPR” or “Regulation”), Oltre Impact SGR SpA – Gestore EuVeca provides this information on the processing of your personal data for the purposes outlined below, in compliance with the GDPR, Legislative Decree 196/2003 as subsequently amended and supplemented by Legislative Decree 101/2018 (the “Privacy Code”), and the measures of the Data Protection Authority (collectively referred to as the “Privacy Regulations”).

Types of Personal Data Processed

The processing described in this information involves personal data collected through the submission of a curriculum vitae during a spontaneous application via the “Work with Us” page on Oltre Impact, in response to our job advertisement, or during a job interview. In some cases, we may obtain your personal data (such as personal details, contact information, education and professional experience, and other data typically contained in CVs, hereinafter collectively referred to as “Data”) from recruitment agencies to whom you have given consent to share your data with us. Except for positions reserved for protected categories, it is not necessary to include special data (such as data revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, membership in political parties, trade unions, religious, philosophical, political, or trade union associations, as well as data suitable to reveal health status and sexual life) in the CV.

Data Controller

The Data Controller is Oltre Impact SGR SpA – Gestore EuVeca (“Controller”).

Purposes, Legal Basis, and Methods of Processing

The collection and processing of your Data are carried out to enable this company to conduct personnel search, selection, and evaluation activities. Processing for this purpose does not require the consent of the data subject as it is necessary for the execution of pre-contractual measures adopted at the request of the data subject (art. 6(1)(b) of the GDPR), except for the processing of special categories of personal data, which, if provided, can be processed by the Controller only with explicit consent. Your Data will be processed by authorized personnel pursuant to Article 29 of Regulation (EU) 2016/679. The Data may also be collected from third parties, in which case we will promptly inform you as required by Article 14 of the GDPR.

The processing of Data for these purposes will take place using both electronic and manual methods based on logical criteria compatible with and functional to the purposes for which the Data were collected, in compliance with the confidentiality and security rules provided by law and internal company regulations. Specifically, the Data will be processed through comparison, classification, and calculation, as well as through the creation of lists or directories. Some Data will also be processed on behalf of the company by third-party companies, entities, or professionals that provide specific processing services or complementary activities as Data Processors in outsourcing.

Categories of Data Recipients

The Data may be used by individuals and/or third-party companies that carry out instrumental activities on behalf of the Controller, such as:

  • External consultants for recruitment, selection, and evaluation of personnel;
  • Individuals whose access to the Data is expressly recognized by law, regulations, or orders issued by competent authorities;

These recipients, depending on the case, will process the Data as controllers, processors, or authorized persons. Outside of the cases mentioned above, your Data will not be disclosed in any way.

Transfer of Data to a Third Country

Your Data will not be transferred abroad.

Data Retention

Data collected through the submission of a CV during a spontaneous application will be retained until the end of the calendar year following the year of receipt; Data collected during a possible interview may be retained for up to twenty-four months. If you are still interested in submitting your application after these terms, you must resubmit it. Excluded from the above terms are cases where it is necessary to retain the Data for a longer period to defend or assert a right or to comply with legal obligations or orders from authorities.

Rights of the Data Subject

Current regulations grant the data subject numerous rights, which we invite you to consider carefully. Among these, we remind you of the rights to:

  • Access to the following information:
    • Purposes of processing
    • Categories of personal data in question
    • Recipients or categories of recipients to whom such personal data have been or will be disclosed, particularly if recipients in third countries or international organizations
    • Existence of the right of the data subject to request from the controller the rectification or erasure of personal data or restriction of processing concerning the data subject or to object to their processing;
  • Rectification, meaning:
    • Correction of inaccurate personal data concerning you without undue delay
    • Completion of incomplete personal data, including by providing a supplementary statement;
  • Erasure of the data concerning you without undue delay if:
    • The data are no longer necessary for the purposes for which they were collected or otherwise processed
    • You withdraw your consent, and there is no other legal basis for the processing
    • You object to the processing, and there is no overriding legitimate reason for processing
    • The personal data have been processed unlawfully
    • The personal data must be erased to comply with a legal obligation
    • The personal data have been collected concerning the offer of information society services;
  • Restriction of processing:
    • When you contest the accuracy of the personal data, for the period necessary for the controller to verify the accuracy of such personal data
    • When the processing is unlawful, and you oppose the erasure of the personal data and request instead the restriction of their use
    • When the personal data are necessary for you to establish, exercise, or defend a legal claim, even if the controller no longer needs them for processing
    • When you object to the processing by virtue of the right to object;
  • Receive notification in case of rectification or erasure of personal data or restriction of processing;
  • Data portability, i.e., the right to receive in a structured, commonly used, and machine-readable format the personal data concerning you and have the right to transmit those data to another controller, provided that:
    • The processing is based on the explicit consent of the data subject for one or more specific purposes or is based on a contract signed with the data subject, and
    • The processing is carried out by automated means;
  • Object: you have the right to lodge a complaint with a supervisory authority if you believe that the rights indicated here have not been recognized.

To exercise the above rights, you can contact the Controller by sending a registered letter with return receipt to the indicated address or an email to

Mandatory or Optional Nature of Providing Data and Consequences

Providing Data for the aforementioned purposes is optional, and it is up to you to decide to submit your CV. However, failure to provide Data in whole or in part could prevent the continuation of the selection process.