PRIVACY STATEMENT PURSUANT TO ART. 13 OF EU GENERAL DATA PROTECTION REGULATION 2016/679 (GDPR)

UPMC Italy (“UPMCI”) is the Italian division of UPMC (University of Pittsburgh Medical Center) with offices in Rome, Palermo, and Mirabella Eclano (Avellino) and operating in the fields of patient care, biomedical research, telemedicine, new technological solutions, and support to areas directly and indirectly related to its medical and research institutional scopes.

Pursuant to art. 13, EU Regulation 2016/679 (“Regulation“), in its role of data controller, UPMCI provides you with the following information.

Personal data included in your CV and any other information obtained during the selection (e.g., certifications, documents, and candidate application form), including the on line form available at https://upmcitaly.it/lavora-con-noi/ will be processed for the sole purpose of assessing your potential collaboration with, or hiring by, UPMCI. Data will be processed using electronic tools and hard copy forms with appropriate modalities that guarantee its security and confidentiality, thus complying with the provisions of the Regulation. The legal basis of your data processing is described in art. 6.1(b) of the Regulation (“processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract“).

The conferment of your data is mandatory to evaluate your application. Failure to provide this data can preclude this evaluation. We ask you enter in your CV only data necessary to assess your professional profile, restraining from including any information defined by the Regulation as “special categories of personal data” (e.g., information on your state of health, political opinions, trade union membership), which requires your explicit consent as legal basis for its processing, art. 9.2(a) of the Regulation, “explicit consent of the data subject to processing“). If you are included in a so-called “protected category” and want to avail yourself of the benefits under Law 68/99, it is not necessary to obtain consent as the processing is carried out according to art. 6.1(b) of the Regulation (“Performance of a contract to which the data subject is party“) in connection with art. 9.2(b) of the Regulation (“Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the data subject in the field of employment”).

Therefore, should you deem it necessary to provide special categories of personal data, please agree to the processing of said information (by ticking the appropriate box below). Should you decide not to provide consent to the processing of the aforementioned data, you may nevertheless submit your application. Any special categories of personal data in the CV will be stored in accordance with the law only to preserve the integrity of the document containing the data, but will not be used by the data controller for further purposes.  In the event of spontaneous applications, your personal data will be stored for a maximum of 5 years from the date of receipt of your CV or  of its latest update.  In case of participation in a selection, the documentation (e.g., assessment forms, tests, CVs, candidate forms) will be stored by the data controller for participation in other selections, and for 10 years for any protection in court of the rights of UPMCI. In this case, the legal basis of the processing is art. 6.1(b) (“Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”) and, as regards the exemption from the prohibition of processing of special categories of personal data, by art. 9.2(f) of the Regulation (“Processing is necessary for the establishment, exercise or defense of a right in court”). This period will start from the end of the year in which the call for application was published. Your personal data will be processed by employees and consultants of the data controller in charge of staff selections, acting in compliance with specific instructions on objects and purposes of the data processing. Your data may also be shared with third parties appointed data processors (e.g., staffing agencies) and providing supporting or instrumental services to the data controller, or to other companies of the UPMC Group (the legal basis of the processing is art. 6.1(f) of the Regulation (“Legitimate interests pursued by the controller“). Collected data will under no circumstance be disclosed. Due to the collaboration with the UPMC Group in Pittsburgh (U.S.A.), we inform you that your data may be transferred to the United States of America. Due to the fact that legislation in the U.S.A. does not guarantee, according to EU regulations, an adequate level of personal data protection, by signing the Standard Contractual Clauses approved by the European Commission, the UPMC Group commits to enforce safety measures to protect transferred personal data. A copy of these contractual clauses can be obtained contacting the DPO at the addresses indicated below. Collected data will under no circumstance be disclosed.

The data controller is UPMC Italy, registered offices in Via Discesa dei Giudici 4, 90133, Palermo, Italy.

You may contact UPMCI’s DPO at the following addresses: UPMC Italy S.r.l. – Responsabile della Protezione dei dati, Via Discesa dei Giudici 4, 90133 Palermo; e-mail: DPO@upmc.it.

As a data subject, you have the right to obtain from the data controller authorization to access, rectify or delete, and to limit or deny the processing of your personal data (art. 15 et seq., Regulation). The request must be filed to the UPMCI Data Protection Officer (UPMC Italy S.r.l. – Responsabile della Protezione dei Dati, Via Discesa dei Giudici 4, 90133 Palermo, Italy; e-mail: DPO@upmc.it), or to the Data processing reference person – HR at the same address of the data controller or at the following e-mail address: rmaggio@ismett.edu. A form to exercise the rights is available on the Italian Data Protection Authority (“Garante”) website https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924.

Should you deem your personal data was processed in breach of the Regulation, you have the right to file a complaint to the Garante using this link https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524 pursuant to art. 77 of the Regulation, or to start judicial proceedings (art. 79 of the Regulation).

Last update: November 2022