Privacy notice for unsolicited applications — homacoop.it

What changes in this version: in section 2, the link to the CV that staff record during the selection can only be a link to a file in HOMA's Drive (addresses of other services are not accepted), accessible to the selection staff. In version 1.7: in section 2, during the selection authorised staff may also record the year of birth given by the candidate, the link to the CV kept by HOMA, the current role, the level of education, and the date and outcome of the first interview; the year of birth is not an assessment criterion.

This notice covers the data of people who apply to HOMA: data submitted through the “Work with us” page of homacoop.it and data entered by HOMA staff in the internal panel, for example when an application arrives through another channel (referral, Indeed, LinkedIn) or from a selection already under way. It supplements the website's general privacy notice.

1. Controller and contact details

The controller is HOMA Società Cooperativa per azioni, Via Orsini Ducas 8, 73100 Lecce (LE), Italy, tax code and VAT number 04579080757, email info@homacoop.it, certified email coop.ass@pec.it. The full identification details are set out on the Legal notice page.

Data Protection Officer (DPO): Mario Nobile, attorney-at-law, privacy@homacoop.it.

2. Data, purpose and legal basis

HOMA processes first and last name, email, telephone number (if given), city (for applications entered by staff, only the municipality of residence, where useful for the selection), role or area of interest, LinkedIn link (if given), where the job ad was seen (if given), personal introduction and CV for two distinct purposes. During the selection, authorised staff may also record the stage the application has reached, the availability stated by the candidate, working notes and a score from 0 to 5, and may keep the CV in the panel or in a restricted HOMA folder. They may also record the current role and the level of education given by the candidate, the date and outcome of the first interview, the link to the CV (the panel keeps only the link to the file in HOMA's Drive, accessible to the selection staff) and the year of birth, if the candidate has given it (for example in the CV). HOMA does not ask for the full date of birth and records only the year: it uses it to tell apart applications from people with the same name and to check age requirements set by internship programmes or hiring incentives, and does not use it as a criterion for assessing or excluding an application, in line with the prohibition of age discrimination in access to employment (Italian Legislative Decree no. 216 of 9 July 2003). If the application comes from another channel, the data is what the candidate gave to that channel and then passed on to HOMA.

The first is to assess the profile against open positions or positions about to open: the legal basis is taking steps at the candidate's request before entering into a contract under Article 6(1)(b) GDPR.

The second is to retain the profile for later opportunities, within the period set out below: the legal basis is HOMA's legitimate interest in holding a pool of applications for future needs under Article 6(1)(f) GDPR. The candidate may object at any time by writing to the contact details given, without having to give reasons and without prejudice to any assessment already under way; the objection is acted on without delay.

The form requires a CV, as a PDF or DOCX file of up to 5 MB; the system checks the actual file type and rejects any other. If the upload does not succeed because of a technical problem, the application is sent anyway, and the candidate can email the CV to recruiting@homacoop.it with their name and the role. Neither the form nor the CV should contain identity documents, health or disability data, trade-union membership, religious or political beliefs, ethnic origin or other special categories of data: under Article 8 of Italian Law no. 300 of 20 May 1970 and Article 10 of Italian Legislative Decree no. 276 of 10 September 2003, such information may not be requested or used for selection purposes, except in the cases expressly provided for by law. If such information is nevertheless present, HOMA disregards it in the assessment.

2-bis. Applications that do not come through the form

If HOMA receives the application through another channel (referral, Indeed, LinkedIn, direct contact) or takes it from a selection already under way, the data is what the candidate gave to that channel or to HOMA, and HOMA processes it for the same purposes and on the same legal bases as set out above. The candidate is informed of this processing, also by reference to this page, at the first contact or, if that does not happen, within one month of HOMA receiving the data. For applications coming from Indeed, Indeed is the channel the data comes from and processes candidates' data under its own rules; HOMA is the controller from the moment it receives the data into its own archive.

3. Provision, recipients and decisions

Name, email address, personal introduction and CV are required to assess the application and contact the candidate; other fields are optional. Data is reviewed by the authorised people of the Human Resources area (selection) and, for matters within their remit only, by the head of the position, and may be processed by technical providers, which must be governed by an agreement under Article 28 GDPR. If the application leads to an internship, the promoting body receives the data needed for the agreement; colleagues acting as tutors do not have access to the candidates' panel.

No automated scoring, ranking or exclusion systems are used, no decisions are made solely by automated means with legal or similarly significant effects on the candidate, and no profiling is carried out.

HOMA uses artificial intelligence tools on corporate accounts held by the cooperative, provided by Google (Gemini, within Google Workspace), Anthropic (Claude) and OpenAI, and does not use personal accounts. Those tools are not used to assign scores, produce rankings or exclude applications: the preceding paragraph applies. No automatic rankings are recorded in the internal archive of applications. The archive records the selection data listed in section 2, the stage of the selection the application has reached, the reason for closing it where applicable, chosen from a predefined list (for example “profile not in line with the position” or “withdrawn by the candidate”), the working notes of the authorised staff on contacts and interviews, with the name of the author and the date, and, where the person carrying out the selection finds it useful, a score from 0 to 5 written by that person as a summary of their own assessment. The score is not calculated by any system, is not used to exclude an application automatically and does not replace the assessment of the person who decides; the candidate may ask to know it and may challenge it like any other personal data. This information is visible only to the persons authorised for applications, is deleted together with the application, and the candidate may request access to it like any other personal data. Some of those providers are established in the United States: in that case HOMA relies on the standard contractual clauses approved by the European Commission and on the supplementary measures provided for in the agreements with those providers; for transfers to the United States the provider's adherence to the EU-US Data Privacy Framework is also relevant, where applicable and verified. Where these providers process data on HOMA's behalf, they must be governed by an agreement under Article 28 of the GDPR.

4. Retention

Anyone submitting the form automatically receives, at the email address provided, an acknowledgement of receipt containing a summary of the data entered; the acknowledgement is sent once only and contains no marketing communications.

Data, including the CV, is retained in HOMA email inboxes and in an internal archive. In the archive the application and its CV are retained for 12 months from receipt and on expiry they are deleted automatically by the system. The period runs from receipt and does not restart: consulting the application and adding internal management notes do not extend it. For email inboxes the 12-month period is applied through periodic organisational reviews, at least every six months.

The CV is uploaded to encrypted storage in the European Union that is not publicly accessible. The CV undergoes an automatic antivirus check before it is attached or archived; a file that fails the check is neither attached nor archived and is deleted automatically within 48 hours. A CV uploaded without the application then being sent is deleted automatically within 48 hours. The CV of a sent application is attached to the email that notifies the authorised persons and can be downloaded from the archive; every download is recorded with the authorised person and the time. A CV sent by email to recruiting@homacoop.it is kept in that mailbox for the same 12-month period.

If the file fails the antivirus check, the application is not accepted. To prevent further submissions, the email address and the IP address from which the attempt was made are kept for 30 days for security purposes, on the basis of HOMA's legitimate interest in protecting its systems, and then deleted automatically.

The system records consultations and exports carried out on the archive, indicating the authorised person and the time. Where an application is included in a list extracted from the archive for management purposes, that list is kept within HOMA's working tools and deleted within six months of extraction: the automatic deletion that applies to the individual record does not apply to it.

The archive is accessible only to the persons authorised for job applications. Applications entered by staff or taken from pre-existing working lists are kept for the same 12-month period, which runs from the date of the application and not from the date of entry in the panel; the working lists they were taken from are set to read-only and deleted within the same period. If an employment relationship begins, the necessary data is transferred to HOMA's ordinary systems and processed under the notice applicable to that relationship; if an internship begins, the notice for interns applies.

5. Rights

Candidates may request access to their data, its rectification or erasure, restriction of processing and data portability, and may object to the processing based on the legitimate interest set out above. Requests should be sent to privacy@homacoop.it or, if preferred, to coop.ass@pec.it, or to the Data Protection Officer's contact details. This address is for exercising data protection rights; to apply, please use the form on the website. HOMA replies without undue delay and in any event within one month of receipt, with a possible two-month extension in the cases provided for, of which notice is given. Exercising these rights is free of charge. Candidates may also lodge a complaint with the Italian Data Protection Authority through www.garanteprivacy.it or seek a judicial remedy.

6. Previous versions

Previous versions of this page are available on request by writing to privacy@homacoop.it.