Privacy Notice

Dear User,
We inform you that, pursuant to European Regulation 2016/679 (hereinafter, for the sake of brevity, the “Regulation” or “GDPR”), your personal data provided by you and/or acquired by us when you submit your application through the “JOB OPPORTUNITIES” section of our website will be processed, including by means of IT and electronic tools, by Grand Hotel Miramare S.p.A. which, as Data Controller, provides you below with the information referred to in Article 13 of the Regulation.
If an employment or collaboration agreement is entered into, a further privacy notice regarding the processing of your personal data will be provided.

Data Controller
The Data Controller is Grand Hotel Miramare S.p.A., VAT No. 00165480997, with registered office in Santa Margherita Ligure (GE), postal code 16038, Via Milite Ignoto 30, in the person of its legal representative pro tempore (hereinafter, for the sake of brevity, the “Hotel” or the “Controller”).

Contact details of the Data Protection Officer
The Data Protection Officer (DPO) can be contacted at the e-mail address [email protected] or by ordinary mail, writing to Grand Hotel Miramare S.p.A., Santa Margherita Ligure (GE), Via Milite Ignoto 30, postal code 16038, for the attention of the same.

Types of data processed
By way of example and without limitation, the Controller will process, including by means of IT and electronic tools, the following categories of your personal data:

• identification data (first name, last name);
• contact details (e-mail addresses and landline/mobile telephone numbers);
• data contained in the CV (e.g. work experience and qualifications, knowledge of foreign languages, levels of experience and certificates, possession of a driving licence, level of education and educational qualifications, work availability, etc.), including the image if present in the CV.

Purpose of processing
Your personal data will be processed for the following purposes:

1. to respond to employment requests and/or participation in personnel selection procedures;
2. to initiate and carry out the hiring procedure and the related assessments.

Legal basis for processing
The legal basis justifying the processing of your personal data for the above purposes is the pre-contractual phase of personnel selection.

Retention period of personal data
Personal data will be processed for the period strictly necessary to carry out the selection procedure, quantified as 24 (twenty-four) months from the date of acquisition.

Recipients of the data
Companies appointed by the Controller to assist it in personnel selection may have access to your data.
The company appointed to provide assistance and maintenance for the Controller’s IT systems may have access to your personal data, having been appointed by the Controller as data processor pursuant to Article 28 of EU Regulation 2016/679, limited to that purpose.
The complete list of appointed data processors, which by its nature is subject to change, is available in an always updated version upon request to the Data Controller by writing to the e-mail address [email protected] or, by ordinary mail, writing to Grand Hotel Miramare S.p.A., Santa Margherita Ligure (GE), Via Milite Ignoto 30, postal code 16038.
Your personal data may be disclosed to other third parties where this becomes necessary to protect the Controller’s rights (e.g. lawyers, consultants, judicial bodies).
The Hotel’s employees, designated as authorized persons for processing, may also have access to your personal data where required by their duties. Each authorized person is specifically identified, authorized and trained, and acts on the basis of specific instructions provided by the Controller regarding the purposes, methods of processing and the security measures to be adopted for the protection of personal data.

Transfer of data outside the EU
Your personal data are stored by the Controller within the European Union (“EU”) and will not be transferred to non-EU countries.

Rights of the Data Subject
The Controller informs you that, within the limits established by Regulation 2016/679, you have the right to:

• obtain data and information on the processing, in particular in relation to the type of personal data processed, the purposes for which the personal data are processed, the period of processing and the parties to whom the data are disclosed (so-called right of access);
• obtain the rectification or completion of inaccurate personal data concerning you (so-called right to rectification);
• obtain the erasure of personal data concerning you in the following cases: (i) the personal data are no longer necessary for the purposes for which they were collected; (ii) you have withdrawn your consent to the processing of personal data, where they are processed on the basis of such consent; (iii) you have objected to the processing of personal data concerning you where they are not processed for a legitimate interest of the Controller; (iv) the processing of personal data is not compliant with the law. However, the retention of your personal data by the Controller is lawful where necessary to enable it to comply with a legal obligation or to establish, exercise or defend a right in court (so-called right to erasure);
• obtain that personal data concerning you are only stored and no other use is made of them in the following cases: (i) you contest the accuracy of the personal data, for the period necessary to allow the Controller to verify the accuracy of such personal data; (ii) the processing of personal data is unlawful and you nevertheless oppose the erasure of the personal data by the Controller; (iii) the personal data are necessary for the establishment, exercise or defence of a right in court; (iv) you have objected to the processing and are awaiting verification as to whether the Controller’s legitimate grounds for processing prevail over yours (so-called right to restriction);
• object at any time to the processing of personal data (so-called right to object);
• receive, in a commonly used, machine-readable and interoperable format, the personal data concerning you, where they are processed on the basis of a contract or your consent, and/or request that the data be transmitted to another controller, where feasible (so-called right to data portability);
• not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

The above rights may be exercised by submitting a request to the dedicated e-mail address [email protected] or by writing by post to Grand Hotel Miramare S.p.A., Santa Margherita Ligure (GE), Via Milite Ignoto 30, postal code 16038.

Right to lodge a complaint
If you believe that the processing of your personal data carried out by the Controller is in breach of the provisions of EU Regulation 2016/679, you have the right to lodge a complaint with the Data Protection Authority, as provided for by Article 77 of EU Regulation 2016/679 (by e-mail, at: [email protected], or by post to the Italian Data Protection Authority, based in Rome (Italy), Piazza Venezia 11 Scala B, postal code 00187), or to bring proceedings before the appropriate judicial authorities, as provided for by Article 79 of EU Regulation 2016/679.

The Data Controller
Grand Hotel Miramare S.p.A.