Privacy policy for candidates

DATA CONTROLLER 

Gi Group AG, with registered office at avenue Edouard-Dubois 20, 2002 Neuchâtel,  (hereinafter also referred to as the “Controller” or the “Company”) wishes to provide, pursuant to and for the purposes of Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (hereinafter referred to as the “GDPR”), and pursuant to Article 19 of the Federal Data Protection Act (“FADP”), certain information about the purposes, methods and scope of communication and dissemination of personal data provided by adult candidates.  

DATA PROTECTION OFFICER  (“DPO”) 

InsAIde S.r.l.s., email address: ch.dpo@gigroup.com 

CATEGORIES OF PERSONAL DATA AND DATA SOURCES 

The Company will collect the following categories of common personal data, by way of example and not limited to: name, surname, password, date of birth, residence, email address and telephone numbers, educational qualifications, work experience and any additional data you include in your CV and/or provide during an interview at one of our branches. 

The Company will collect the aforementioned data from you and/or from websites managed by third parties or social networks through which the Company publishes advertisements (on behalf of client companies or on its own behalf) or through which it can consult candidate profiles. 

If you provide personal data worthy of special protection (Art. 5, para. 1, letter c of the LPD) or special categories of personal data pursuant to Art. 9 of the GDPR, such as in particular:  

• health data (e.g. certificates of absence due to illness, maternity, accident, membership of protected categories, as well as to determine suitability for certain jobs and compulsory training, etc.); 

• data revealing membership of a trade union (e.g. assumption of trade union office, request for deduction of trade union dues, etc.) or a political party (e.g. request for leave or sabbatical for elective public office, etc.), as well as religious beliefs (e.g. request for the statutory observance of religious holidays, etc.). 

This information will be processed in accordance with the applicable regulations.  

The legal basis applicable to the processing of special categories of personal data concerning you is your explicit consent pursuant to Article 9(2)(a) of the GDPR, Article 6(7)(a) and Article 31(1) of the LPD. 

If you do not give your consent, it will not be possible to process data relating to your membership of a protected category. Consent will be collected through a dedicated checkbox or written declaration during the registration process or interview 

Please do not include any special categories of data or data requiring special protection in your CV. 

If special categories of personal data concerning you are processed for the purposes described, the applicable legal basis is the establishment, exercise or defence of legal claims pursuant to Art. 9(2)(f) of the GDPR and Art. 31 of the LPD. 

NATURE OF THE PROVISION OF DATA AND CONSEQUENCES OF REFUSAL 

The provision of data marked with an asterisk in the registration form for the myGiGroup / myGrafton personal area is necessary to allow the Controller to complete your registration (purpose of Registration to the Portal); therefore, any refusal to provide the requested data will prevent the Controller from completing your registration to myGiGroup / myGrafton. 

The provision of data marked with an asterisk in the data collection form on the Website or requested by agencies is necessary to allow the Controller to pursue its research and selection purposes; therefore, any refusal to provide the requested data will prevent the Controller from carrying out its research and selection activities and will not allow your application to be considered.  

The provision of data for marketing purposes is optional. Any refusal to provide data or consent will not affect your registration with myGiGroup/myGrafton and will not prevent the Controller from carrying out its recruitment activities. 

DATA RECIPIENTS 

Your data may only be processed by employees of the company departments authorised to process it for the purposes indicated above. These employees have received adequate operating instructions in this regard. 

Your personal data may be disclosed by the Company, for the purposes set out in the previous paragraphs, to the following parties: 

• client companies or entities; 

• departments or bodies responsible for employment relations; 

• public bodies in the context of implementing active labour policy measures or programmes; 

• other market operators in the case of partnerships; 

• legal advisors; 

• Training institutions; 

• Group companies in Switzerland, Liechtenstein or abroad, only in countries that guarantee adequate protection in accordance with the criteria of the GDPR and the LPD.  

Your personal data may also be processed by parties expressly appointed as data processors who provide the Companies with: 

• Website management and maintenance services; 

• Candidate database management and maintenance services; 

• Archiving services; 

• Communication mailing services; 

• Market research services; 

• Assessment and training services; 

• Event organisation services; 

• Marketing services. 

The updated list of recipients is available at our registered office or by sending a communication to the Controller.  

The personal data provided by candidates will not be disclosed. 

Your data may be transferred abroad to recipients referred to in the previous points who are not located in Switzerland or in a country belonging to the European Economic Area (‘EEA’), and in particular to: 

• Argentina and the United Kingdom, whose level of data protection has been deemed adequate by the European Commission pursuant to Article 45 of the GDPR and Article 16 et seq. of the LPD; 

• Brazil, China, Colombia, Hong Kong, India, Montenegro, Russia, Serbia, Turkey, Ukraine and the USA, subject to the signing by the Companies with the data importer of the standard contractual clauses adopted/approved by the European Commission pursuant to Article 46(2)(c) and (d) of the GDPR and Article 16(2)(b) of the LPD. 

Any transfers to countries outside the EEA are permitted, in the absence of the adequate safeguards mentioned above, on the basis of the derogations provided for in Article 49(1)(b) and (c) of the GDPR and Article 17(1)(b) of the LPD. The data subject will be specifically informed of such transfers. 

RIGHTS OF DATA SUBJECTS 

Data subjects are entitled to the rights set out in Articles 15 to 22 of the GDPR and the rights set out in Articles 25 et seq. of the LPD and Articles 16 et seq. of the Data Protection Ordinance, where applicable.  

In particular, data subjects may request the Controller to access their data, delete it, correct inaccurate data, supplement incomplete data, and restrict processing in the cases provided for in Article 18 of the GDPR   and Articles 25 et seq. and 32 of the LPD. 

Data subjects have the right to object, at any time, in whole or in part, to the processing of data necessary for direct marketing purposes and for the pursuit of the legitimate interests of the Controller. 

Furthermore, if the conditions for exercising the right to portability pursuant to Article 20 of the GDPR and/or Article 28 of the LPD are met, data subjects have the right to receive the data provided to the controllers in a structured, commonly used and machine-readable format and, if technically feasible, to transmit them to another controller without hindrance. 

These rights may be exercised by writing to the address below or by email to the following email address: ch.privacy@gigroup.com 

It is understood that, where the request is submitted by electronic means, the information will be provided in a commonly used electronic format. The data subject may take action concerning the protection of personality by requesting the prohibition of a specific data processing operation, the prohibition of the disclosure of data to third parties, and the erasure or destruction of data, as provided for in Article 32(2) of the LPD. They may also lodge a complaint with the Federal Data Protection and Transparency Commissioner (IFPDT) and lodge a complaint with the competent Data Protection Authority (in particular in the Member State in which they habitually reside or work or in the State in which the alleged infringement occurred) and seek other remedies provided for by applicable law.