Privacy Policy for Personnel Selection pursuant to Article 13 of EU Regulation 2016/679 (GDPR)

This policy is provided to those who, following a personnel search or unsolicited application, send their curriculum vitae to Hotel Belstay pursuant to Articles 13 and 14 of EU Regulation 679/2016 (hereinafter "GDPR").

The processing of your Personal Data will be based on principles of correctness, lawfulness, transparency, purpose and storage limitation, integrity and confidentiality, in accordance with the provisions of the Regulation.

1. Data controller

The Data Controller of the personal data collected through this website is: Hotel Opco Srl, with registered office in Piazza Eleonora Duse 2, 20122 Milan (MI), VAT number 11285190960, e-mail: belstaygroup@belstayhotels.it.

2. Types of data processed

The data collected through the submission of CVs and subsequent interviews to assess professional profiles, sent in relation to any open positions or for spontaneous applications, fall within the category of "personal data" pursuant to Article 4, paragraphs 1 and 15 of the GDPR and will be processed exclusively for the purpose of assessing the professional aptitudes and skills of the candidates themselves, in relation to the open position for which a selection process is underway or for future needs to expand the company's workforce.

In the context of sending a spontaneous application, the following data will be collected and processed:

• Identification and contact details (name, surname, date and place of birth, address, telephone number, e-mail address);
• Curriculum vitae data (educational qualifications, work experience, skills, languages spoken, etc.);
• Any special categories of data (relating to the candidate's membership of a protected category) pursuant to Article 9 of the GDPR, only if relevant to the selection process and within the limits permitted by law.

Please do not include any irrelevant special categories of data, such as health information or political or religious opinions, unless explicitly requested for selection purposes.

3. Purpose and legal basis of processing

The data is processed for:

• Evaluate the application and manage the selection and recruitment process (legal basis: implementation of pre-contractual measures at the request of the data subject – Article 6(1)(b) of the GDPR).

Pursuant to Art. 6, para. 1, letter c), special data relating to the protected category status of the job applicant will be processed in order to comply with the specific regulatory obligations applicable to this type of data subject.

4. Methods of processing

Your Personal Data will be processed in accordance with the provisions of current Privacy Legislation, both electronically and automatically and manually, in such a way as to ensure maximum security and confidentiality, and only by persons trained and authorised to process it.

5. Data retention

Personal data is retained for the period necessary to achieve the specific purposes for which it is processed and, in any case, for a period not exceeding 12 months from receipt of the curriculum vitae, after which it will be automatically deleted and no copies will be retained for the past year.

If you are still interested in submitting your application after this period, you will need to resubmit it.

6. Communication of data

In addition to the Data Controller, other parties involved in the organisation may have access to the data:

• Hotel Opco employees and collaborators authorised by the Data Controller for the selection process
• Data processors appointed by the Data Controller.

The data may be disclosed to third parties who provide consultancy services, such as:

• External consultants for the recruitment, selection and evaluation of personnel.

The data resulting from the submission of the application will not be otherwise disclosed, sold free of charge and/or for a fee, or shared with third parties, and will be used solely and exclusively for the purposes indicated above.

7. Transfer of data to countries outside the EU

The data is processed within the European Union. With regard to certain support tools, although the data centres are located within the European Union, some processing operations (e.g. e-mail, cloud, etc.) may involve the communication of data to suppliers located outside the European Union (e.g. USA, UK). In these cases, the suppliers have been appointed as data processors pursuant to Article 28 of the GDPR and are required to sign standard contractual clauses pursuant to Article 46 of the GDPR to ensure the same level of protection as in the European Union.

8. Rights of the data subject

Pursuant to Articles 15-22 of the GDPR, the candidate may exercise the following rights:

• Access to personal data;
• Rectification or updating;
• Erasure;
• Restriction of processing;
• Objection to processing;
• Data portability, where technically feasible;
• Withdrawal of consent, without prejudice to the lawfulness of processing based on consent prior to withdrawal.

We remind you that you may exercise your rights under Articles 15 et seq. of EU Regulation 2016/679 at any time, modify your data or update your consent by writing to Hotel Opco srl Piazza Eleonora Duse 2 – 20122 Milan (MI) or by sending an email to belstaygroup@belstayhotels.it or PEC bcopcosrl@legalmail.it

The Data Controller may make changes and/or additions to this policy, including as a result of any subsequent regulatory changes to the Privacy Regulation. In any case, changes will be notified in advance and may be made available on the Data Controller's communication channels.