UK – Applicant’s privacy notice and request for consent for the processing of personal data

Applicant’s privacy notice and request for consent for the processing of personal data

United Kindom

Dear applicant,

Pursuant to articles 13 and 14 of Regulation (EU) 2016/679, containing provisions for the protection of natural persons with regard to the processing of personal data and the free movement of such data (hereinafter also referred to as the “GDPR”) and the Data Protection Act 2018 and GDPR as it forms part of the law of England and Wales by virtue of section 3 of the European Union (Withdrawal) Act 2018 (here inafter also referred to as the “UK GDPR“) here by we provide you with the notice regarding the processing of your personal data that will be carried out by the Data Controller, as defined below, in relation to our recruitment selection process (the “Application Process”).

Personal data means “any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” and also pictures (Art. 4.1 of the UK GDPR).

1.Data Controller

The Data Controller of your personal data is Mail Boxes Etc. (UK) Limited (Company number 03107457), with registered office in 3a Tournament Court, Tournament Fields, Warwick, England, CV34 6LG (headquarters address: 1 Northumberland Avenue, Trafalgar Square, London, England, WC2N 5BW), Tel. +44 (0) 20 3535 0250, e-mail: people@mbe.uk (hereinafter also referred to as the “Company” and/or the “Data Controller”).

2.Categories of personal data processed

2.1. Personal data provided by you directly

Within the scope of the Selection Process, the following personal data provided by you directly at the time of the creation your personal account for taking part in the Application Process and for the presentation of your application via the submission of your curriculum vitae and, where appropriate, the letter of presentation and/or later on during the course of the Selection Process, may be processed:

identification data and other master data (first name and surname, address, telephone number, fiscal code, place and date of birth, country of residence, nationality and, where permitted by law, identity card, passport, driver’s license);
data concerning education and occupation (curriculum vitae, academic qualification, apprenticeship or professional training, professional skills, duties, department, job, remuneration, salary supplements, deductions, any company assets currently at disposal, language skills);
photographic/video pictures provided by you spontaneously (photos/videos).

2.2 Personal data not directly provided by you (sources)

Within the scope of the management of your application personal data may be processed as deriving from:

(i) public sources, such as Internet websites, social networks (data contained in your public profile of LinkedIn, etc.), newspapers/periodicals and journals including specialized, scientific publications or other documents or writings of public nature or in any case freely accessible;

(ii) previous employers and/or from public and/or private institutions you attended in the past as education/professional experiences.

2.3 Other special categories of personal data as per Art. 9 (so-called special categories of personal data) of the UK GDPR provided by you directly

Within the scope of the Application Process, the processing of personal data may refer to special categories of personal data which are suitable to reveal disabilities or other health status of the applicant or of the applicant’s family members (within the limits provided for by the law) and/or the being part of the so called protected categories (protected categories include people suffering from physical, psychic or sensory disability that cause a reduction in their ability to work and, in general, people with disabilities for whom the applicable law promotes integration into the labour market).

3.Purpose and legal basis of the processing of personal data

Your personal data may be processed by the Company for the following purposes.

Management of the application

(i) The personal data as per the preceding sections 2.1 and 2.2(i) will be processed for the management of the application and for the evaluation for hiring purposes of the professional profile of the applicant.

The legal basis of the processing of the personal data for the purposes as per the preceding Section 3.1(i) is the necessity for the hiring decision (Article 6 para 1 lit. b UK GDPR) in order to include the applicant in the Company’s staff.

(ii) Within the scope of the application, your personal data as per sections 2.1 and 2.2(ii), may also be verified using different sources to support the Application Process. Said pre-hiring checks will refer to the verification of whatever qualifications – in relation to your education and your previous professional background – as possibly gained via third parties (for example, your previous employers and/or public and/or private institutions where you obtained your high school and/or university qualification).

The legal basis of the processing of the personal data for the purposes as per the preceding Section 3.1(ii) is your prior specific consent (Art. 6 para 1 lit. a UK GDPR).

(iii) The so-called special categories of personal data relating to disabilities / other health status and affiliations to so-called protected categories, as per the preceding Section 2.3, will be processed if necessary for the management of the application and for the evaluation of the applicant to be possibly included in the Company’s staff, with particular reference to the placement of the so-called protected categories.

The legal basis of the processing of the personal data for the purposes as per preceding Section 3.1(iii) is the necessity of carrying out the obligations and exercising specific rights of the Company or the applicant in the field of employment, social security and social protection law (Art. 9 para. 2 lit. b UK GDPR).

3.3 Defence of our rights and interests

The personal data as per Sections from 2.1 to 2.4 are collected by the Company to exercise or defend its interests, also in the Courts.

The legal basis of the processing of the personal data for purposes as per the preceding Section 3.3 is the legitimate interest of the Company to defend its legal rights and interests. The Data Controller deemed that this processing does not override any prevailing right, interest or fundamental freedom of yours.

4.Mandatory or optional nature of the provision of your personal data – consequences of refusal

4.1 Failure to provide your personal data for the purposes as per the preceding Section 3.1(i) and 3.1(iii) will make it impossible for the Company to evaluate your application.

4.2 The provision of your personal data for the purposes as per preceding Section 3.1(ii) is optional; however, failure to do so will make it impossible for the Company to contact such third parties with whom or which you previously gained your professional experience and/or received training. The Company will in any case evaluate your application.

4.3 The provision of your personal data for the purposes as per the preceding Section 3.2 is optional; however, failure to do so will entail, consequently, the impossibility of having access to the Company’s premises.

4.4 The provision of your personal data for the purposes as per the preceding Section 3.3 is optional; however, failure to do so will entail, consequently, the impossibility for the Company to evaluate your application.

5.Modalities of the processing of personal data

The processing of your personal data will take place in a lawful, proper and transparent manner, for specific, explicit and legitimate purposes, as well as by means of IT and paper instruments in compliance with the laws, regulations, measures, as applicable, including those of the UK’s Information Commissioner’s Office (hereinafter “ICO”), in particular in the area of processing of particular categories of personal data, pursuant to Art. 9 of the UK GDPR, in the employment relation.

The personal data provided by you will not be subject to completely automated decision-making processes.

6.Recipients of personal data

6.1 The recipients of your personal data as per the preceding sections are:

(i) persons authorized to process personal data within the Company (in particular, employees operating in the human resources area and individuals operating in the area of reference for your application) to whom special instructions have been given in writing;

(ii) external providers processing personal data on behalf of the Company, appointed in writing as data processors pursuant to art. 28 of the UK GDPR:

companies that provide the service of maintenance, back-up and storage of the Company’s IT systems;
entities belonging to the same group of the Company, including Fineffe S.r.l., MBE Worldwide S.p.A., Sistema Italia 93 S.r.l, MBE Spain 2000 SL, MBE Deutschland GmbH, MBE France SARL and MBE Poland Sp. z o.o., U.S. Business Holdings Inc., PostNet International Franchise Corp., AlphaGraphics Inc.

(iii) other third parties processing personal data in the capacity of autonomous data controllers:

external recruiting consultants (as appointed by the Company);
subjects whose right to access the personal data is recognized by the law and other sources of law by instructions received by competent authorities;
previous employers and/or public or private schools and universities;

7.Retention of personal data

Your personal data will be retained for the management of your application: for a period of 6 months after the end of the Application Process.

8.Transfer of personal data outside the European Economic Area

The Data Controller reserves the right to transfer your personal data to third countries, including, for example, the United States of America and Australia. Transfers of data outside the European Economic Area and UK are subject to a special regime pursuant to the GDPR and UK GDPR and are only made in respect of countries that ensure an adequate level of personal data protection, on the basis of an adequacy decision of the Commission or UK Secretary of State or where adequate safeguards have been adopted (including the standard contractual clauses provided by the European Commission or UK government), provided that the data subjects have enforceable rights and effective judicial remedies.

9.Exercise of rights by the data subject

Pursuant to articles 15-22 of the UK GDPR:

you have the right to apply for access to your personal data together with information concerning the purposes of the processing, the category of the personal data processed, the subjects or categories of subjects to whom or which they have been or will be communicated (with an indication in the event that such subjects are located in other countries or are international organizations), as well as, when possible, the period of retention of the personal data or the criteria used for determining such period, the existence of your rights to rectification and/or erasure of the personal data, to limitation of the processing and to objection to the processing, your right to lodge a complaint with a supervisory authority, the origin of the data, and the existence and type of logic applied in the event of an automated decision-making process. Should you exercise the foregoing right and save your instructions to the contrary, you will receive a copy in electronic format of your personal data that form the object of processing.
Furthermore, you have the right to obtain:
1. the rectification of your personal data if they are incorrect or incomplete;
2. the erasure of your personal data if one of the circumstances as per Art. 17 of the UK GDPR applies (e.g. if your personal data are no longer necessary for the purposes for which they have been collected, if you decide to revoke your consent to processing – where this constitutes the legal basis thereof – and there is no other legal ground for such processing, if you object to the processing and some other legitimate interest of the Data Controller does not prevail, if your personal data have been processed unlawfully);

the limitation of the processing of personal data concerning you 1) for the time necessary for the Company to verify the accuracy of such data (if you have contested the same); or 2) if the processing of such personal data turns out to be unlawful and you request limitation of the pertinent processing rather than erasure of your personal data; or 3) when the Company no longer has need of your personal data but the same are necessary for you in order to verify, to exercise or to defend a right before a judicial authority; or, finally, 4) for the time necessary to assess the prevalence, if any, of the legitimate grounds of the Data Controller against your own if you have objected to the processing of your personal data pursuant to point c) below;

copy of your personal data in a structured format commonly used and readable by an automatic device, including for the purpose of transmitting them to some other data controller, in the event that the processing is contingent upon your consent or a contract and is done with automated means (the so-called right to portability of data). If interested, you may request that the Company transmit your personal data directly to another data controller, which request will be satisfied if technically feasible.

You also have the right to object to the processing of your personal data if such processing is done pursuant to Art. 6.1 letter f) (i.e. to pursue a legitimate interest of the Data Controller) of the UK GDPR, unless the Data Controller has cogent legitimate reasons to proceed with the processing, pursuant to Art. 21 of the UK GDPR.
You have the right to revoke consent at any time without prejudice to the lawfulness of the processing of your personal data based on consent and done prior to revocation.
If done, you have the further right not to be subject to a decision based solely on automated processing, including profiling, that produces legal repercussions affecting you or that in an analogous way bears significantly on your person, likewise having the right to obtain human intervention by the Data Controller, to express your opinion and to contest the decision.
If you are not satisfied with the processing of your personal data done by the Company, you may lodge a complaint with the Privacy Authority for the protection of personal data, following the procedures and instructions published on its official website (www.garanteprivacy.it).
Any rectification or erasure of your personal data or limitation of processing done at your request – unless this proves impossible or involves a disproportionate effort – will be communicated by the Company to each of whatever recipients to whom or which your personal data is transmitted in accordance with this Privacy Notice.

The exercise of the foregoing rights requires no further formalities and is free of charge. We may merely request to verify your identity prior to taking any further action following your request.

10. Contacts for the exercise of the rights of the data subject and for further information

For the exercise of your rights and/or to obtain any type of information you may need in relation to this Privacy Notice, you can send a written communication to the Data Controller, as identified in section 1 above, or call +44 (0) 20 3535 0250 or send an e-mail to people@mbe.uk.

CONSENT to the processing of PERSONAL data

I DECLARE that I have received complete informative notice, concerning the processing of personal data for the purposes specified in sections 3.1, 3.2 and 3.3 of the foregoing Privacy Notice, and that I have been informed of my rights in the capacity of Data Subject.

□ I agree / □ I do not agree

to the communication of my personal data to the subjects specified in the Privacy Notice for the verification of my professional and training references, as stated in Section 3.1(ii) – of the Privacy Notice.