PRIVACY POLICY
APPLICANT FOR A JOB
World International School S.p.a. a socio unico, in its capacity of Data Controller with regard to the processing of your personal data pursuant to (EU) Reg. 2016/679 (hereinafter the ‘GDPR’), hereby informs you that the said regulation protects data subjects with regard to the processing of their personal data and that the said processing will take place in a fair, lawful, transparent manner which protects your privacy and your rights.
Data Controller
The Data Controller, World International School S.p.a. a socio unico (VAT 09284580967) with Registered office in Via Michelangelo Buonarroti n. 39, 20145 Milano – Tel. +39 011 1972111 | Fax +39 011 1972150 |E-mail: info@worldinternationalschool.com
Data processor Officer
WINS has appointed a Data Protection Officer who can be contacted if you have any questions or concerns about the characteristics and methods of data processing. The DPO can be reached at the following contacts: dpowins@worldinternationalschool.com; dpo_wins@pec.it.
E-mail contacts:
– dpowins@worldinternationalschool.com;
– dpo_wins@pec.it
Data Subject Information
WINS collects primarily the following personal data:
– Personal data
-Data related to professional activity
– Educational data
– Contact details
-Image
Additionally, general information regarding the professional experiences provided by the Candidate in the form of a curriculum vitae and/or cover letter.
For the purposes of this Notice, the collection will only concern common data. Therefore, the Candidate should not provide data belonging to special categories (e.g., health data).
In any case, the Data Controller will process only the data that is relevant and strictly necessary for the establishment of any potential employment relationship.
If the job position offered by the Data Controller is directed at protected categories and/or the spontaneous application comes from an individual belonging to a protected category, the Data Controller may use data belonging to special categories of the Data Subject solely and exclusively for the purpose of establishing the employment relationship. Any special category data spontaneously provided by the Data Subject through the CV and/or during the interview will be processed only if necessary for the establishment of the employment relationship.
Purposes of Data Processing
Personal data will be processed for:
- a) Evaluating the application;
b) Initiating a work collaboration.
Data Retention Period
Personal data processed for purposes (a), (b) will be retained for the period strictly necessary to achieve the purposes for which they were collected.
However, the Data Controller may retain the personal data further if they believe that additional purposes related to personnel recruitment and selection interests still exist. In the case of:
- Spontaneous applications, the personal data of the Data Subject will be kept for 12 months from the receipt of the CV. After 12 months, the personal data will be deleted.
- Responses to specific job vacancies published by the Data Controller and/or on its behalf by third parties, personal data will be kept for as long as the offer remains valid. After six months from the expiration of the offer, the personal data will be deleted.
Legality of Processing
The processing is lawful because it is based on the following legal grounds:
- Execution of pre-contractual measures adopted at the request of the Data Subject.
Processing Methods
Personal data is processed both in paper and electronic formats (servers, cloud databases, application software, etc.).
The Data Controller may transfer personal data to the USA and/or Canada. In relation to this processing, the transfer will occur in accordance with the Guidelines for the Transfer of Personal Data adopted by the European Data Protection Board (EDPB). In this regard, the US companies to which the data may be transferred can be found in the Data Privacy Framework List. For non-adhering companies, the data transfer will occur in compliance with the additional safeguards outlined in Article 46 of the GDPR. It should be noted that the European Commission, in July 2023, issued a new declaration, recognizing the adequacy of the safeguards provided by US legislation, which corresponds to the level of protection offered by the GDPR.
Nature of Data Provision
The provision of data required under letter (a) of the “Purposes of Data Processing” is optional, and failure to provide such data will prevent WINS from evaluating the application.
Categories of Subjects to Whom Personal Data May Be Disclosed
The processing of personal data provided may be carried out, in compliance with the principle of strict necessity, by:
- WINS employees, who process the data under the authority and instructions of the Data Controller, as per Article 29 of the GDPR or employees designated by the Data Controller, pursuant to Article 2 quaterdecies of Legislative Decree No. 101/2018;
- Individuals or legal entities whose access to personal data is recognized by laws of the European Union or Italian law, such as, for example, competent authorities and/or supervisory bodies for the fulfillment of legal obligations, and public administrations for their institutional purposes.
- Individuals or legal entities that the Data Controller uses to carry out activities instrumental to achieving the purposes mentioned above (e.g., IT and application service providers, security services) or to whom WINS is required to communicate data due to legal or contractual obligations. Service providers appointed as external data processors will be subject to contractual and legal obligations to maintain the confidentiality of the data and will only have access to the information necessary for performing their functions.
Data Disclosure
The processed data will not be disclosed, sold, or exchanged with third parties.
Rights of the Data Subject
With regard to the processing of personal data, under the GDPR, the Data Subject has the following rights:
• Right of access: The Data Subject has the right to obtain a copy of the personal data held by WINS that is subject to processing.
• Right to rectification: The Data Subject has the right to rectify personal data held by WINS if it is outdated or inaccurate.
• Right to withdraw consent: The Data Subject may withdraw their consent for a specific processing activity at any time.
• Right to contact the Data Protection Authority if they have doubts about the processing of their personal data by WINS.
Additionally, the Data Subject may exercise the following rights in certain circumstances:
• Right to erasure: The Data Subject may request that WINS delete personal data if the purposes of the processing have been fulfilled, and no legitimate interests or legal provisions require its retention.
• Right to object to processing: The Data Subject may request that WINS cease a particular processing activity. This right does not apply when the processing is based on a contractual relationship.
• Right to data portability: The Data Subject has the right to receive personal data in a structured, commonly used, and machine-readable format and to transmit it directly to another data controller without hindrance.
• Right to restrict processing: The Data Subject has the right to request that WINS limit the processing of their personal data.
To exercise any of the above rights, the Data Subject can send an email or write to the following address, specifying the request and providing the necessary information to correctly identify the sender (including a copy of their ID):
• Via email, info@worldinternationalschool.com
• Via mail, World International School S.p.a. a socio unico, Via Michelangelo Buonarroti n. 39, 20145 Milan.
WINS will respond within one month. If, for any reason, WINS cannot respond, it will provide a detailed explanation of why it cannot fulfill the request.
This information may be subject to changes or updates, so we encourage you to periodically check the Data Controller’s website – https://worldinternationalschool.com/ – to stay up to date.
Last version: March 2025