Privacy Policy for candidates and potential candidates

March 2024 ('Privacy Policy')

Why am I seeing this Policy?

We are obliged to bring this Policy to your attention in accordance with Regulation (EU) 679/2016 (‘GDPR’), Italian privacy legislation (Legislative Decrees 196/2003 and 101/2018) and the national laws applicable to each branch. In accordance with this legislation, we are obliged to inform you of the ‘hows’ and ‘whys’ of the way in which we process your personal data related to you as a candidate for the roles advertised for our clients, on behalf of which we carry out selection and recruitment processes as the Reverse Group ('Group').

Who are ‘we’?

’We’ are a group of companies, comprising the Italian parent company Reverse S.p.A. and other subsidiaries (‘Subsidiaries’) incorporated in other EU countries: more information on our Subsidiaries is available in the footer of the various language versions of our website www.reverse.hr ('Site'). From a technical legal point standpoint and in GPDR terminology, we are the ‘Data Controller’, which means that we decide why and how your data is processed. More specifically, Reverse S.p.A. and each of the Subsidiaries are 'Joint Controllers' of the processing of your data. This is because although Reverse S.p.A. operates as the 'central hub' of the Group and establishes its general and specific directives and objectives on its behalf, each Subsidiary contributes to and supports the parent company in the pursuit of these common directives and objectives, without prejudice to the legal and administrative aspects by each Subsidiary is required to manage in accordance with its national laws. A specific co-ownership agreement on data processing is in place between the Group companies. For example, if you apply for a role that entails working in another country (e.g. Spain), Reverse S.p.A. and the 'local' Subsidiary (e.g. Reverse Espana S.L.) will process your data as Joint Controllers. 

How to contact us

Irrespective of the Subsidiary with which you have a relationship, you may use any of the addresses on the Site or, preferably, the account privacy@reverse.hr. In accordance with the joint control agreement agreement, you will be connected with the Joint Controller responsible for management of your data, which will be able to provide you with the information you need in relation to your enquiry.

How, why and for how long do we process your data… and which data do we process?

Processing methods – the Group operates on a paperless basis; therefore, you must complete the registration form and upload your CV online to the designated section of our Site. The selection process relies solely on IT and digital tools, such as video-call software and IT services for digital document management and archiving.

The common data we process – essentially falls into three categories: a) identification and contact information (such as name, surname, tax code, date of birth, marital status, residence, contact details, email, telephone numbers, photo, signature, etc.), b) data relating to education and professional experience (academic history, qualifications, previous employment, including training programmes attended, certificates, accreditations and references from third parties, etc.), c) any other relevant information/data that you choose to share with us, particularly in the course of interviews conducted to evaluate your application (such as personal interests, general skills and abilities, career ambitions, personal preferences for work arrangements; e.g. remote working, etc.). In addition to the details provided in your CV, if you are selected to participate in interviews or other assessments as part of the recruitment process (e.g. questionnaires), our Reverse team and/or Scouts (designated consultants, as indicated below, who are duly instructed and authorised to process your personal data in compliance with the applicable privacy regulations) may collect and analyse additional data/information about you, such as information about your soft skills and interpersonal abilities.

Our recommendation – we request your assistance: please do not include in your CV or otherwise provide any information that is not relevant to the position for which you are applying or for which you have been selected.

The sensitive data we process – in certain exceptional circumstances, and exclusively for the purpose related to the selection and assessment of professional requirements for an open position (e.g. for recruitment of protected categories), it is possible that we may process special categories of data (specifically, data that may disclose or potentially disclose information on health status). If the processing of such data is unnecessary, but you voluntarily include information in your CV or provide details that could indirectly lead to sensitive data or fall under specific categories as defined by the GDPR (such as affiliation with political groups or blood donation history), we will not use it and promptly delete or obscure it. 

The primary sources of our data collection – the majority of your data we collect will come from your CV and from the information you provide to us as part of the selection process. Reverse may also collect your personal data from publicly available sources, such as your professional profile as published on professional social networking platforms (as outlined in this Policy) and from third parties, with your consent, in relation to your prior work history. 

The principles that guide our processing – irrespective of the type of data we process and the sources of data collection, we consistently adhere to the principles set out in the GDPR, which are paramount to us. These include transparency, clarity, correctness and, most importantly, minimisation. This means we process your data only if and as necessary to evaluate your application and progress through the selection and recruitment process.

Purpose and legal basis of data processing – a) your data is processed in order to carry out the activities necessary to review your CV and determine whether your profile matches our requirements. Your consent is not required for these processing operations, since you provide the data of your own accord: therefore, this processing is based on the implementation of pre-contractual measures initiated at your request; b) ‘sensitive data’, which is classified as special categories of data, is processed only where required for the purposes of evaluation of your candidacy for specific job positions: in this case, the processing of your data is necessary – as provided for by the GDPR – to fulfil your obligations and exercise your specific rights in matters of labour law and social security and social protection, insofar as this is authorised by European Union or national law or by applicable collective agreements (in accordance with Art. 9.2 lit. b) GDPR); c) for the purposes of selection and recruitment, we may also process your common personal data – including, for example, your identification and contact data and data relating to your work, as specified above – from publicly available sources such as professional social networking channels. We take all necessary measures to ensure that your interests, fundamental rights and freedoms are properly balanced with our legitimate interest: in this case, the data processing is carried out in connection with our legitimate interest in management of selection and recruitment processes, in our role as recruiter and head hunter, d) finally, subject to your consent, we may process your data in order to obtain information on previous professional experience with previous employers. If necessary, we may share this information with clients on whose behalf recruitment is being carried out. 

Data retention –
we retain your data throughout the entire selection process. Please note that we reserve the right to keep your data for future job opportunities. This allows us to contact you again should your profile match other open positions or future vacancies. In any case, you may at any time request that we delete your data from our database by sending a specific request (Reverse data erasure request) to privacy@reverse.hr

When disclosure of your data is mandatory 

Please note that the provision of your data is compulsory in the context of selection and recruitment activities; thus, a refusal to provide the relevant data will prevent us from carrying out these activities and will not allow your application to be taken into consideration. In cases where consent is the legal basis, the related processing is optional. 

To whom your data is disclosed

Naturally, as part of the recruitment process, your data is
shared primarily with our clients, specifically the companies associated with the open job positions, which may receive your profile information in the course of these activities. 

In some cases, with a view to adequately assessing your skills (in particular technical skills), we may also collaborate with our Scouts, freelance professionals who are obliged to process your data in accordance with the Group's instructions.

Other than in these cases, except where required by law and/or requested by certain authorities, your data will not be disclosed to parties outside the Group, with the exception of limited situations governed by specific agreements such as: a) the collection of questionnaires, surveys or feedback regarding the Group’s activities, carried out on our behalf by specialist companies in order to collect and analyse the relevant data to generate reports and statistics; b) the use of IT services, such as for video calls and remote interviews or for the management of our databases, carried out by third-party providers, where your data may be transmitted or stored. You can always contact us at privacy@reverse.hr to request specific information on the recipients of your data. 

Where your data is transferred

As a general rule, your data will not be transferred outside the European Union or the European Economic Area (EEA). In the event this becomes necessary, it is in all cases transferred subject to verification of the provisions contained in Arts. 44 et seq. GDPR. In particular, where some of the above-mentioned external entities are based in the US, the relevant transfer is subject to the adequacy decision adopted by the European Commission. 

Privacy rights and protection

We inform you that you are able to exercise a number of rights regarding your data by sending a specific request to privacy@reverse.hr in order to obtain: access, correction, deletion, restriction or discontinuation or interruption of processing. Additionally, you may raise an objection to the processing of your data in cases where there is a legitimate interest (in application of Art. 21 GDPR) and make a portability request. If the legal basis for such processing is your consent, you have the right to revoke it at any time by contacting us in writing using the same method as described above. On receipt of your revocation, we will promptly take all necessary steps to comply with your request. However, this does not affect the lawfulness of processing based on your consent before revocation. If you believe that your rights are not being upheld or that the Group is violating personal data laws, you may contact us to seek an amicable resolution or to lodge a complaint with the Italian Data Protection Authority.

DPO contact details 

DPO stands for Data Protection Officer; this refers to a representative that assists us in ensuring that your personal data is processed in accordance with the GDPR. You may contact it by writing to this address: dpo@reverse.hr