Privacy Policy

pursuant to Regulation (EU) No 679/2016 (“GDPR”), as well as applicable national and/or local legislation on the matter, and in particular the Federal Data Protection Act (FADP)

As required by European Union Regulation No. 679/2016 (hereinafter “GDPR”), as well as by other applicable legislation and, in particular, the Federal Data Protection Act (FADP), we hereby provide you with the information required by current legislation regarding the processing of your personal data.

Data Controller

The Data Controller responsible for processing your personal data is the Orienta Group (hereinafter the “Data Controller”), with its registered office at Orienta SA, Via Cantonale 23/c - 6928 Manno - Lugano - Switzerland, which can be contacted at the following addresses:

1. By post or registered post to the address Via Cantonale 23/c - 6928 Manno - Lugano - Switzerland
2. By email to the address [email protected].

Data Protection Officer

The Data Controller has appointed a Data Protection Officer, who can be contacted at the following details:

1. By post or registered post to the address Via Cantonale 23/c - 6928 Manno - Lugano - Switzerland 
2. By email to the address [email protected].

What data we process

The Data Controller collects and/or receives information about you directly from you or from third parties, such as:

• Data contained in registration forms (first name, surname, place and date of birth, postal and email addresses, landline and/or mobile phone numbers, details of your professional career), data contained in your CV, and any data relating to your state of health (personal data requiring special protection or special categories of personal data);
• Data that you send to us via correspondence/email/surveys or other contact forms.

Source of data

As previously indicated, your personal data may be obtained not only directly from you but also from third parties (for example, employment agencies, qualified professionals, job portals, etc.). For further information regarding the sources of your personal data, please contact the Data Controller at the following contact details:

1. By post or registered post to the address Via Cantonale 23/c - 6928 Manno - Lugano - Switzerland 
2. By email to the address [email protected].

Why we need your data

We use your data to process your recruitment and manage your employment relationship, to comply with legal obligations, and to provide personalised services.

In particular, your data will be processed for the following purposes:

• Activities relating to pre-contractual procedures, the management of contractual relationships, training and guidance, and the provision of services.
  Within this category, your personal data will be processed specifically for the following purposes: (i) to carry out recruitment and selection activities with a view to potentially establishing an employment relationship, by registering you in Orienta’s database, including for positions unrelated to those for which you have applied spontaneously; (ii) furthermore, based on your registration request, we will also periodically send you job vacancy notices via email that may be of interest to you; (iii) keeping you updated with job offers matching your profile/Job Agent; (iv) managing applications in response to job offers published on the Data Controller’s website and also on other job sites/portals, etc.; (v) purposes relating to the establishment, management and termination of the contractual and training relationship (e.g. compliance with accounting, remuneration, social security, welfare and tax obligations); (vi) the use of specific leave, absences and benefits related to the management of the employment relationship; compliance with legal obligations and regulations (e.g. for the purposes of preventive medicine, occupational health, anti-terrorism checks, etc.); (vii) management of disputes; (viii) provision, support, updating and information regarding the Services and features available from the companies of the Orienta Group; (ix) activation of online Services (e.g. access to the private area on the Data Controller’s website, attendance tracking); (x) where applicable and requested, activation of the Remote Digital Signature service; (xi) carrying out activities relating to counselling, guidance, management, development, career transition and professional re-employment.The legal basis for these activities is the fulfilment of pre-contractual measures taken at your request, contractual obligations to which you are a party, and compliance with legal obligations.
  Any necessary processing of your personal data requiring special protection (or special categories of personal data), should you decide to apply for a specific job vacancy and/or decide to provide the Data Controller with such categories of personal data, will be based on your free and explicit consent.
  Please note that, should you exercise your right to withdraw consent, such withdrawal will not affect the lawfulness of the processing carried out up to that point.

• Activities relating to the recording and processing of images.
  In particular, your personal data relating to images, photos, audio and video that you have voluntarily sent to us will be processed for the following purposes: (i) sending recordings and interviews to clients and/or organisations potentially interested in your application; (ii) preparing offers and promoting the candidate (e.g. applicant, temporary worker) to client companies, potential clients and the Data Controller.
  The legal basis for these activities is the fulfilment of pre-contractual measures taken at your request and contractual obligations to which you are a party, as well as compliance with legal obligations.

• Commercial communications, information, newsletters, surveys and customer care. Specifically, these activities relate to: (i) market research, economic and statistical analysis; (ii) social, cultural and charitable initiatives; (iii) commercial information; (iv) marketing; (v) sending advertising/informational/promotional material and updates on initiatives, promotions and offers from third-party companies operating in collaboration with the Data Controller and specifically appointed as external data processors, including in relation to programmes and promotions, including online, aimed at rewarding or retaining candidates and participants; (vi) communications and information regarding the Data Controller’s activities and events in which the Data Controller participates.
  The legal basis for these activities is your consent to such processing, which you may freely withdraw at any time. It is hereby clarified that, should you exercise your right to withdraw consent, such withdrawal shall not affect the lawfulness of the processing carried out up to that point.

• To disclose your data (including, where applicable and necessary, personal data requiring special protection / special categories of personal data) to the Data Controller’s clients seeking staff, as well as to public and private entities from whom the Data Controller has been commissioned to carry out one of the activities set out in points 1) and 2) of this section, for the sole purpose of enabling them to verify that your profile fully matches the position sought.  Your data is also disclosed to companies and individuals who assist the Data Controller in the provision of services (through, for example, the provision of network services, software, advertising services, etc.).

The Data Controller may also disclose your personal data to public and private entities that are entitled to access such information pursuant to statutory provisions, regulations or international standards, within the limits set out in those provisions.

Finally, your personal data may be disclosed, in an anonymised and pseudonymised form, to all parties who are duly registered with the communication service provided by the Data Controller.

Your personal data will not be disclosed; therefore, it will not be made available to unspecified parties.

The legal bases for these activities are both the need to fulfil pre-contractual measures taken at your request and contractual obligations relating to the service, as well as the existence of legal obligations.

Transfer of personal data abroad

In accordance with the purposes set out above, your personal data may be transferred to independent Data Controllers or to appointed Data Processors (for example, Group companies or third parties) based in third countries.
Should your personal data be transferred to recipients who do not provide the same level of protection as required by national and/or local legislation and/or the GDPR, or in any case an adequate level of personal data protection, the Data Controller will ensure that each recipient of such data assumes specific contractual obligations in accordance with the applicable regulations on the protection of personal data.

In any event, at present, your personal data is/will be transferred to the following countries, subject to the following safeguards:

You can always request further information regarding the recipients of your personal data or other aspects relating to the transfer of such data by writing to the following addresses:

1. By post or registered post to the address Via Cantonale 23/c - 6928 Manno - Lugano - Switzerland 
2. By email to the address [email protected].

What happens if you do not provide your personal data?

The collection and processing of your personal data is essential in the following cases:

• Where this is necessary to perform the contract to which you are a party or to take pre-contractual steps at your request;
• To manage and comply with legal obligations.

In such cases, failure to provide such data will make it impossible for the Data Controller to fulfil the contractual obligations arising from the contract to which you are a party / to take the pre-contractual measures requested by you / to comply with the obligations under current legislation.
Furthermore, in certain other cases, it may be necessary to collect and process your personal data requiring special protection / special categories of personal data: in such situations, failure to provide such data may make it impossible for the Data Controller to fulfil the contractual obligations arising from the contract to which you are a party / to take the pre-contractual measures adopted at your request / to comply with the obligations under current legislation, to the extent that such data is necessary to correctly fulfil the obligations in your interest.
However, where your consent is requested (with the exception of consent relating to the processing of your personal data requiring special protection / special categories of personal data, as described above), the provision of your personal data is optional: therefore, in such situations, failure to provide your personal data will have no further consequences other than your inability to access the services available through your consent.

How long is your data retained?

1. General data retention

   Personal data is retained for the period strictly necessary to carry out activities related to the management of the contract or pre-contractual arrangements, and to fulfil the resulting obligations, including legal obligations.
   Specifically, your personal data will be retained, from the date of receipt/last update/last access to your profile on the website, for a maximum period of forty-eight months for the management of your application (unless otherwise provided by law, which may stipulate longer periods), after which it will be deleted or irreversibly anonymised. Furthermore, the Data Controller has provided, within the website, the option to personally delete your profile.
   With regard to the processing of personal data based on your consent, such data will also be deleted or irreversibly anonymised after forty-eight months from the date of receipt/last update/last access to your profile on the website or in the event of withdrawal of consent (except in a specific case concerning data requiring special protection / special categories of personal data processed on the basis of your express consent, as indicated below).However, should it be necessary to process your personal data requiring special protection / special categories of personal data, such data will also be retained for forty-eight months from the date of receipt, the last update, or the last access to your profile on the website, or for a shorter period where retention is no longer necessary for the purposes for which it was collected. Before the expiry/deletion, you will be sent a specific email to notify you of this and to ask you, in a clear and transparent manner, whether you wish to renew the retention of your data for a further retention period equal to the original one. In the event that, despite the withdrawal of your consent or the expiry of the retention period, it is necessary to retain such personal data for a further period of time pursuant to regulatory provisions, the Data Controller will inform you promptly, providing you with all necessary information, with particular regard to the retention period arising from such obligations.

2. Retention of data in the event of an employment relationship being established

   However, should an employment relationship be established with you, your personal data will be retained, from the date of receipt, for a period appropriate to the processing purposes set out above and in accordance with current legislation, for up to 11 years following the termination of the relationship; after which, the data will be deleted or irreversibly anonymised.

3. Further information

   The Data Controller will, including through periodic checks, constantly verify that the data retained is strictly relevant, not excessive and essential in relation to the relationship, service or assignment that has ceased, including with regard to data that you provide of your own accord.
   Finally, your personal data may be retained for periods longer than those indicated in this section provided that this is permitted by current legislation, in particular by virtue of any tax or administrative obligations, and that it is strictly necessary to establish, exercise or defend a right in court. The data may not be retained beyond the applicable limitation period.
   For further information regarding the retention periods for your personal data, please contact the Data Controller at the following contact details:

   1. By post or registered post to the address Via Cantonale 23/c - 6928 Manno - Lugano - Switzerland 
   2. By email to the address [email protected].

How we process your data

Data processing is carried out using paper-based records or IT procedures by specifically authorised and trained personnel.

The Data Controller may use automated systems/processes and a decision-making procedure that is not entirely automated in order to provide you and our Clients with the requested services. For example, if our clients are seeking candidates for certain job vacancies, we may search our candidate lists using automated criteria that take into account your availability, your skill set, your salary expectations and, in some cases, feedback previously received from clients, in order to draw up a shortlist of candidates who are most likely to meet the client’s requirements.

In particular, your data may be used to generate scores based on the information contained in the CV you have submitted and/or to present you with job offers that match your profile, based on an analysis of the information you have provided.

Furthermore, please note that the processing of personal data described in this policy does not cover the processing of data carried out on the Data Controller’s website via cookies: therefore, for further information regarding the processing of personal data via cookies (or, in general, on the website), how they work, the logic used and the profiling process carried out via them, please consult the specific “Cookie Policy” dedicated to the Data Controller’s website and available in the section of the same name, “Cookie Policy”, or, alternatively, you may always write to the following contact details to request further information:

1. By post or registered post to the address Via Cantonale 23/c - 6928 Manno - Lugano - Switzerland 
2. By email to the address [email protected].

What are your rights?

At any time, where permitted by current legislation, free of charge and without any particular costs or formalities, you have the right to ask the Data Controller to:

• To obtain information regarding the identity and contact details of the Data Controller and confirmation as to whether your personal data is being processed;
• Access your personal data being processed and find out its source (where the data has not been obtained directly from you), the purposes and grounds for processing, the details of the recipients to whom it is disclosed, together with any safeguards or exceptions applicable to the transfer of your personal data abroad, the retention period for your data or the criteria used to determine it;
• Update, rectify and supplement your personal data so that it is always correct and accurate;
• Erase your personal data or anonymise it, or request the restriction of processing;
• Object to the processing of your personal data;
• Receive the data in a structured, commonly used and machine-readable format and, where technically feasible and provided that this does not entail a disproportionate burden, have the data transmitted directly to another data controller without hindrance, where the processing of your personal data is carried out by automated means and is based on consent or on the performance of a contract or pre-contractual measures;
• Withdraw any consent you may have given to the processing of your personal data; however, please note that this will not affect the lawfulness of the processing carried out up to that point.

To this end, the Data Controller has provided the following options on the website:

• if you have never had an employment relationship with Orienta, you can delete your personal profile yourself;
• if you have had an employment relationship, you can request deletion or modification by emailing [email protected] specifically, using the form provided. Alternatively, you may visit the office in person or send your request by registered post.

It should also be noted that the exercise of these rights must not prejudice and/or infringe upon the rights and freedoms of others.
Any requests will be processed within one month of receipt at the latest, subject to the possibility of extending this period by a further two months, if necessary, taking into account the complexity and number of requests received by the Data Controller. In any event, you will be informed of the specific reasons for any delay within one month of your request.

The outcome of your request will be provided to you in writing or in electronic format. Should you request rectification, erasure or restriction of processing, the Data Controller undertakes to communicate the outcomes of your requests to each of the recipients of your data, unless this proves impossible or involves a disproportionate effort.

For further information and to exercise your rights, please contact the Data Protection Officer at the following details:

1. By post or registered post to the address Via Cantonale 23/c - 6928 Manno - Lugano - Switzerland 
2. By email to the address [email protected].

The Data Controller wishes to point out that you may be asked to pay a fee if your requests are manifestly unfounded, excessive or repetitive: to this end, the Data Controller has set up a register to keep track of your requests.

To whom can you lodge a complaint?

If you are in Switzerland, you can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

However, if you are in Italy, you may lodge a complaint with the Italian Data Protection Authority (GPDP), unless specific legal provisions relating to your situation mean that a supervisory authority in another European Union Member State has jurisdiction.