Information pursuant to art. 13-14 of EU Regulation 679/2016 (“GDPR”)

Pursuant to art. 13 and 14 of EU Regulation 679/2016 (hereinafter, “GDPR”), Siryo S.p.A. wishes to inform you that the personal data that you will provide us or that you have provided us through the sending/delivery of your application to the Data Controller or through your page on LinkedIn, or through dedicated recruiting agencies, or during the interview with personnel of our company, or even through the website of Syrio S.p.A., will be processed according to principles of fairness,  lawfulness and transparency, in compliance with its confidentiality and current legislation.

1. Data Controller

The data controller of your personal data is the company Siryo S.p.A., VAT 08335170729, with registered office in Piazza Massari n. 19 – 70122 Bari, e-mail: info@siryo.it (“Data Controller“).

2. Nature of the data

The personal data subject to processing include:

• your identification data (such as, by way of example, name, surname, age, gender, place and date of birth, private address, nationality, city and province of residence, e-mail address, mobile phone number, office telephone number, private home telephone number);
• data relating to your education and work career (such as, by way of example, current and previous employment, information on recruitment or professional training, curriculum vitae or work, the type of contract, the relevant national collective labour agreement and the role held in your current employment, references provided by third parties in your favour, professional skills, remuneration, the attribution of benefits, the presence of a non-compete agreement, the presence and term of notice);
• data relating to your health (information relating to your state of health or any disability, if relevant to your ability or willingness to work or the need for a tailor-made workplace, e.g. if you belong to certain protected categories);
• any additional personal information collected during the interview or requested in compliance with Model 231 and Code of Ethics adopted by the Data Controller.

The aforementioned types of personal data are processed by the Data Controller in compliance with current legislation on personal data.

3. Purpose and legal basis of the processing

The processing of your personal data, including that relating to special categories of personal data pursuant to art. 9 GDPR, is necessary to allow the Data Controller to evaluate your application for the purpose of your possible recruitment for a role for which you have applied or for roles that may become available in the future, in accordance with the provisions of art. 6.1 (b) GDPR.

      4. Processing methods

At all stages of processing, the Data Controller ensures full compliance with the binding requirements contained in the GDPR. The data is collected from you. The organization of the data takes place not only on computer support, but also in paper form.

In particular, it should be noted that your personal data are processed:

–        by means of manual and IT tools;

–        by persons duly appointed to carry out these tasks, constantly identified and/or appointed, suitably instructed and made aware of the constraints imposed by law;

–        with the use of security measures to ensure the protection of your privacy and to avoid the risks of loss or destruction, unauthorized access, processing that is not permitted or does not comply with the aforementioned purposes;

–        in compliance with the limits provided for by Law no. 300/1970 (so-called “Tax Decree”). “Workers’ Statute”).

5. Mandatory or optional nature of the provision of data and consequences of any refusal to respond

The provision of your personal data, as better indicated in paragraph 2 above, is mandatory and is functional to the pursuit of the purposes described in paragraph 3 above. Any refusal on his part to such processing would therefore make it impossible to follow up the process of assessing his position with a view to his possible recruitment.

6. Subjects to whom personal data may be communicated

Pursuant to recital (48) of the GDPR, the data may be communicated to the companies of the Group to which the Data Controller belongs for internal administrative purposes.

In addition, personal data may be processed by third parties, such as service providers, who process them as data processors and with whom agreements have been signed for the processing pursuant to Article 28 of the GDPR. The complete list of data processors is available upon request to the Data Controller at the addresses indicated above.

7. Rights of the data subject

We inform you that, in relation to the aforementioned processing, you may exercise the rights provided for by art. 15 et seq. GDPR. You have the right to obtain from the Data Controller an indication of the existence or otherwise of processing operations concerning you, as well as to access your data, request its rectification, integration, updating, correction or blocking; You will also have the right to obtain a copy of your data, the limitation of processing and/or, again, to object to the processing, as well as the right to data portability and to lodge a complaint with the competent supervisory authority under the conditions and within the limits provided for by art. 77 GDPR.

If you wish to exercise your right of access, you have the right to know whether your data is being processed, what the purpose of the processing is, what categories of data are processed, who are the recipients or categories of recipients to whom your data is disclosed (and, if they reside in a third country,  on the basis of which guarantees), the retention period of your data (or the criteria for determining the retention period), whether automated processing is underway (e.g. by means of profiling) and what is the logic of such processing, the origin of the data (if they are not initially collected by the Data Controller).

To assert your rights, please send a written request indicating “Privacy – exercise of Privacy rights” to the addresses indicated above.

8. Duration of processing and storage of personal data
   Your personal data will be processed by the Data Controller for the time necessary for its evaluation for the purposes of the possible establishment of the employment relationship. If you receive and accept a job offer from the Data Controller, the personal data collected in the period prior to your employment will become part of the personal archive concerning you and will be kept for the entire course of your employment for which, in any case, you will be provided with an independent information. If the Data Controller does not proceed with the recruitment of the Data Controller, his/her data will be immediately deleted.
   With your express consent, we may store and process your personal data for the purpose of evaluating your application for other profiles, for a maximum period of 24 months.

Version updated on 31/07/2025