INFORMATION ON THE PROCESSING OF PERSONAL DATA

TAS S.p.A., as data controller, informs that in accordance with article 13 of EU Regulation n. 2016/679 (hereinafter “GDPR”) that the data provided by users (the “Users”) through the website tasgroup.eu (hereinafter the” Website”), will be processed in the following ways and for the following purposes:

1 – Data Controller

The Data Controller is TAS S.p.A. (hereinafter “TAS” or the “Owner”), with registered office in Via Serviliano Lattuada 25, 20135 Milan – e-mail: privacy@tasgroup.eu.

2 – Types of data processed

The processing will concern single operations, or a set of operations, processing (for example, but not limited to: collection, recording, organization, storage, processing, communication, modification, selection, use) of the following personal data provided by the User during the use of the services provided by TAS through the Websites (the “Personal Data” or the “Data”):

identification and contact data, provided by the user in case of contact requests or policies sent to the Company, including but not limited to, first name, last name, e-mail address, address and mobile phone number;
data relating to the curriculum,personal data, provided by you when applying for a job offer, which include, by way of example but not limited to, personal data, contact details, educational qualifications, professional experience and any additional data provided by you during initial contact with the Data Controller or contained in the CV you spontaneously sent to the email address: job@tasgroup.eu; special data, which you may communicate in response to job offers reserved for the protected categories pursuant to Law 68/99 (e.g. relating to disability);
browsing data: for simple access to the Website it is not necessary to provide any personal data; however, the computer systems and software used to operate the Website acquire, during normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information collected is not associated with identified individuals.

3 – Data processing objectives

Personal Data is processed:

A) without the express consent of the User, GDPR article 6 (a), for the following purposes:

to process a request for contact and/or registration on the Websites;
to evaluate an application for inclusion in the database for recruitment by TAS and for a possible future establishment of a working relationship with TAS;
to manage and maintain the Websites;
to process a request for information using the “Talk to Lia” Chat;
to process a request for a free trial of a TAS service/product;
to fulfill obligations under law, regulation, EU legislation or by an order of the Authorities;
to fulfill obligations related to the management of relations with Users;
to prevent or uncover fraudulent activity or abuse harmful to the Websites;
to exercise the rights of the Owner, such as to exercise a right in court.

B) with the express consent of the User (GDPR article 7), for the following purposes:

to send by e-mail informative communications, including the newsletter, referring to the Data Controller products and/or services, including free trials already requested by Users;

4 – Processing methods

The processing of personal data is carried out through the operations indicated in GDPR article 4 (2) and specifically: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of Data.

Personal Data, both paper and electronic and/or automated, is processed through the use of websites hosted by TAS France E.U.R.L. and managed by the Data Controller.

The Data Controller will process the Personal Data for the time necessary to fulfill the above purposes, and guarantees the following maximum retention times:

for the purposes under article 3 (a): after the use of the service for which it is collected, the Data may be stored and maintained for a maximum period of 10 years; the personal data collected through the Work with us platform will be stored for 3 years. The personal data collected through the “Talk to Lia” Chat will be stored: the logs for 3 months, the content of the chat (questions and answers) for the sole session of use of the same;
for the purposes under article 3 (a): 3 years from consent, with subsequent updating of the Data and renewal of the consent given.

5 – Security

The Data Controller has adopted a variety of security measures to protect the Data against the risk of loss, misuse or alteration, consistent with the measures expressed in GDPR article 32.

6 – Access and communication

The Data may be made accessible for the purposes referred to in GDPR article 2 above:

to employees, partners, and associates of the Owner, in their capacity as agents and/or internal data processors and/or system administrators;
third-party companies or other parties (for example, Website providers, Cloud providers, hardware and software support technicians, etc.) for candidates only who have sent their CV to the Owner, candidate selection and evaluation companies, dedicated platforms (e.g. LinkedIn etc.) who carry out outsourcing activities on behalf of the Data Controller, in their capacity as data processors.

Without the express consent of the User (ex article 6 (a) GDPR), the Data Controller may communicate the Data for the purposes referred to in article 2 A) to Supervisory Bodies, Judicial Authorities as well as to all other subjects to whom disclosure is mandatory by law for the fulfilment of the aforementioned purposes.

Without the express consent of the User, the Data may not be transferred to third parties for their use for their own purposes, and therefore outside the access referred to in article 6 above. The Data will not be disseminated in any case.

7 – Data transfer

The Data Controller is a company that operates at a global level.

The management and storage of data will take place in Europe, on the Owner’s servers located in France and/or third party companies appointed and duly appointed as Data Processors.

The Data Controller uses tools such as Google Suite (Gmail, Drive). Google Suite services aimed at users in the EEA are provided by Google Ireland Limited (and its subsidiaries) which, to ensure an adequate level of protection, in relation to those non-EEA countries with which there is no adequacy decision, bases the transfer of personal data on the standard data protection clauses approved by the European Commission, also protecting data in transit using the HTTPS protocol and encrypting data at rest using encryption mechanisms.

The Data Controller may also provide its services in other countries, in which case the transfer of Data to these countries is strictly limited to the actual need to be aware of the Data. The Data Controller will take the necessary measures to protect the personal data of Users and candidates, and prevent unauthorized access. All information of Users and Candidates will be accessible and processed exclusively by the employees of the Data Controller involved in the purposes referred to in article 3 above, in any country, as well as by authorized third parties as companies that provide ratings to assist the Owner in the scope of the aforementioned purposes.

In cases where the Data is transferred to the systems used by the Data Controller also outside the European Union, the Data Controller guarantees the application of the standard contractual clauses of the European Commission to ensure a secure international transfer of personal data, in accordance with GDPR articles 44, 45 and 46.

8 – Provision of data and consequences of refusal

The provision of data for the purposes referred to in article 3 (a) is mandatory. In its absence, the User cannot be guaranteed the reply to contact or information requests, access to free the Data Controller’s product trials, evaluation of the candidate’s profile and selection of the same.

The relevant processing does not require the consent of the interested party in the event that the same occurs to fulfill the obligations deriving from the established relationship or in the event that another hypothesis of exclusion should occur (in particular the traceability of a legitimate interest by the Data Controller), expressly provided for or dependent on the legislation and regulations applied by the Data Controller, or even through third parties identified as data controllers. Where the communication involves data suitable for revealing the state of health, the related processing operations will take place with all the guarantees of the case including those that, if requested based on the risks identified, determine the application of pseudonymization solutions, and/or aggregation and/or encryption of the data.

The provision of data for the purposes referred to in article 2 (b) is optional. The User may decide not to provide any Data or to subsequently deny the possibility to process the Data provided: in such case, the User may not receive newsletters or other communications from the Owner.

9 – Rights of the parties involved

In their capacity as interested parties, Users have the right under GDPR article 15 to:

obtain confirmation of the existence or otherwise of Personal Data concerning the User, even if not yet recorded, and its communication in an intelligible form;
obtain indication of: a) the origin of the Personal Data; b) the purposes and methods of processing; c) the logic applied in case of processing carried out with the aid of electronic instruments; d) the identification details of the data controller, the data processors and the representative designated in accordance with article 5 (2) of the Privacy Policy and article 3 (1) GDPR; e) of the subjects or categories of subjects to whom the Personal Data may be communicated or who may learn about it as representative appointed in the territory of the State, of managers or agents;
obtain: a) updating, rectification or, when the User has an interest, integration of the Data; b) deletion, transformation into anonymous form or blocking of Data processed in violation of the law, including data that does not need to be kept in relation to the purposes for which the Data was collected or c) certification that the operations referred to in letters (a) and (b) have been notified, also as regards their content, to those to whom the Data has been communicated or disseminated, except in the case in which this fulfilment is revealed impossible or involves the use of means manifestly disproportionate to the protected right;
oppose, in whole or in part: a) for reasons legitimate to the processing of Personal Data concerning the User, even if pertinent to the purpose of the collection; b) to the processing of Personal Data concerning the User for the purpose of sending material advertising or direct selling or for carrying out market research or commercial communication through the use of automated systems without the intervention of an operator via e-mail and/ or through traditional marketing methods by telephone and/or paper mail. Please note that the right of opposition of the person concerned, as set out in point (b) above, for direct marketing purposes by automated means extends to traditional ones and that in any case remains without prejudice to the possibility for the data subject to exercise his/her right of opposition even in part. Therefore, the data subject may decide to receive only communications by traditional means or only automated communications or neither of the two types of communication. Where applicable, Users are also granted the rights under articles 16-21 of the GDPR (Right of rectification, right to be forgotten, right to limit processing, right to portability of Data, right of opposition), as well as the right to make a claim to the Guarantor Authority.

10 – Exercise of rights

The User may exercise his/her rights at any time by sending:

an e-mail to privacy@tasgroup.eu;
a registered letter to TAS S.p.A., Via Serviliano Lattuada 25, 20135 Milan, Italy.

11 – Cookies

Information regarding the management of cookies on the Website is provided in the section COOKIE POLICY reported here.

12 – Data Protection Officer

Users may contact the Data Protection Officer (“DPO”) for all matters relating to the processing of their personal data and the exercise of their rights under the Regulation.

You can contact the DPO at the following e-address: tas_dpo.it@tasgroup.eu

The updated list of data processors is kept at the headquarters of the Data Controller.

13 – Amendments to this Privacy policy

This privacy statement may be subject to change. It is therefore recommended that you check this policy regularly and refer to the most current version.

***

INTELLECTUAL PROPERTY AND PROTECTION OF THE TRADEMARK

The pages of this Website are protected by copyright, marked with the symbol © in accordance with Law 633/1941; therefore, the contents of the Website is protected against duplications and translations. In addition, the trademark is protected under article 2571 of the Italian Civil Code.