Dear Candidate,

pursuant to EU Regulation 2016/679 on "Protection of individuals with regard to the processing of personal data and the free movement of such data" (hereinafter the “Regulation”) and to Legislative Decree no. 196/2003 as amended and supplemented (hereinafter the “Decree”), this is to inform you that, within the context of the selection process carried out by Fondazione Istituto Italiano di Tecnologia, (hereinafter "IIT"), the latter manages a series of personal data related to you.

1. Identity and contact details of the Data Controller

The Data Controller of your personal data is Fondazione Istituto Italiano di Tecnologia, based in Via Morego, 30 – 16163 Genova – Phone 010 28961.

2. Contact details of the Data Protection Officer

The Data Protection Officer can be contacted at the following email address:

3. Object of data processing

Within the framework of the selection process, IIT may process the following categories of data relating to you: • Common personal data such as, for example, name, surname, tax code, e-mail address, telephone number, nationality, institution of affiliation.

4. Purposes and Legal basis of data processing

The processing of your personal data by IIT will take place for the purpose of managing the Tenure Track Calls and Intermediate Assessments. In particular, the processing of personal data will take place using the following legal bases:
• the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures taken upon his/her request (Article 6, paragraph 1, point b) of the Regulation), with regard to common personal data and for the following purposes:

  1. Acquisition of data in the screening phase of your application;
  2. Evaluation of your Curriculum Vitae;
  3. Performing interviews;
  4. Reference checks;
  5. Refund of travel expenses incurred for participation in the selection process, if provided and requested.

5. Processing Method

Your data will be processed by computer and paper support, following the rules on protection of personal data, including those related to data security.
The processing of personal data carried out for the managing the Tenure Track Calls and Intermediate Assessments., in particular in the event that candidates provide data on their own initiative through the sending of CVs, will concern only the information strictly relevant and limited to what is necessary for these purpose. IIT will not process special categories of personal data eventually present into the documentation.

6. Categories of recipients of personal data

The communication of personal data is carried out on the basis of the obligations provided by law. In this regard, personal data are communicated to Italian Job Agency and Credit Institution, in the sole case of refund of travel expenses, so IIT will communicate your data to the Credit Institution, which will pay, and to any other bodies that can need those data, always within the limits of the law provisions.
The personal data you provide will be also released to non-IIT scientists whom IIT has appointed as Evaluators under the Tenure Track Call and Intermediate Assessments-
Furthermore, IIT’s obligation to communicate data to the Judicial Authority remains in place, whenever, in this regard, a specific request is sent.

7. Data storage

The storage of your personal data will take place in compliance with the security measures used by IIT on data protection, and access to them will be allowed only to the staff involved and duly appointed to process data.
Your data will be kept for the purposes referred to in paragraph 4) for the time necessary to fulfill the purposes and in any case for no longer than 18 months after the end of the selection process (except in case of your consent to the further data processing).

8. Transfer of personal data to a third country

Your personal data may be transferred outside the European Union for the purpose of managing of Tenure Track Calls and Intermediate Assessments.
In the absence of an adequacy decision by the European Commission concerning the country to which the data transfer takes place (Article 45 of the Regulation), IIT will apply the derogation provided by Article 49, par. 1, point c): “the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person”.

9. Rights of the data subject

You may exercise the rights provided in Articles 15, 16, 17, 18 and 20 of the Regulation at any time by contacting the Data Protection Officer, at the contact data at paragraph 2 of this information note.
In particular, as data subject, you can request:

  1. access to your personal data, as provided in Article 15 of the Regulation;
  2. correction of your personal data, as provided in Article 16 of the Regulation;
  3. cancellation of your personal data ("right to be forgotten"), as provided in Article 17 of the Regulation;
  4. restriction of personal data processing, as provided in Article 18 of the Regulation;
  5. portability of your personal data, as provided in Article 20 of the Regulation.

In the above cases, where necessary, the Data Controller will inform the third parties to whom your personal data are communicated of any exercise of your rights, except in specific cases (e.g. when this requirement proves impossible or involves a manifestly disproportionate to the protected right).

10. Complaint to the Supervisory Authority

Finally, pursuant to Article 77 of the Regulation, we remind you that you have the right to submit a complaint to the Supervisory Authority (Protection Authority for Personal Data Processing), if you believe that your data processing infringes the provisions of the Regulation and the Decree.

11. Nature of the processing and obligation of providing data

Many of the data required are necessary (even in fulfilment of obligations coming from legal rules) to selection process related to the eventual recruitment. In some cases, failure to provide these data may result in conclusion of the selection process.

12. Existence of automated decision-making processes in the data treatment

It is specified that for processing of the above data there is NOT any type of automated decision-making process, pursuant to Article 22 of the Regulation.