Whenever the legal basis for the processing is the legitimate interest of the Data Controller, the latter warrants that it has previously carried out an assessment (“balancing test”) aimed at ensuring the proportionality of the processing in order that the rights and freedoms of Data Subjects are not adversely affected, taking into account their reasonable expectations in relation to the specific processing activity performed.

Data Subjects may request further information on the above evaluation by sending an e-mail to the following address: privacy@txtgroup.com.

The Data Controller further informs the Data Subject that he/she has the possibility to object, at any time, to the processing of his/her personal data carried out on the basis of the legitimate interests of the Company.

In the event that the Company intends to use personal data for any other purpose incompatible with the Purposes for which such personal data were originally collected or authorised, the Company shall previously inform the Data Subject and, where required, request his/her consent for additional processing activities.

5.    HOW DO WE PROCESS PERSONAL DATA?
Regarding the aforementioned Purposes, the processing of personal data may consist in the activities indicated in Article 4(1)(2) of the GDPR, namely: collection, recording, organisation, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, interconnection, deletion and destruction of personal data.

Moreover, the personal data of Data Subjects will be:
- processed in accordance with the principles of lawfulness, fairness and transparency;
- collected for the legitimate Purposes identified above;
- adequate, relevant and limited to the extent necessary for the Purposes for which they are processed;
- stored in a manner permitting the Data Subject's identification for a period of time not exceeding the achievement of the Purposes and better defined in paragraph 4 above;
- processed in such a way as to ensure adequate security against the risk of destruction, loss, modification, disclosure or unauthorised access through technical and organisational security measures.

The processing may be carried out either by manual, computerised or telematic means with logic strictly related to the Purposes and, in any case, in such a way as to ensure the security and confidentiality of the data themselves, in addition to compliance with the specific obligations enshrined in the Privacy Legislation from time to time in force and applicable.

6.    TO WHOM DO WE DISCLOSE PERSONAL DATA?
The personal data of the Candidates will be processed by the employees and collaborators of the Company that are specifically designated as persons authorised to process such data pursuant to Article 29 GDPR and 2-quaterdecies of the Privacy Code, where necessary for the pursuit of the Purposes referred to in paragraph 4 above of this Privacy Notice.

Furthermore, the Data Controller informs the Candidates that their personal data may be shared for the pursuit of the Purposes with further recipients or categories of recipients, in their capacity of autonomous data controllers or, where necessary, data processors specifically selected and appointed pursuant to Article 28 GDPR, including but not limited to:
- TXT Group companies;
- specially appointed service providers engaged in personnel recruiting, selection and evaluation activities;
- service providers specifically appointed for the management and/or maintenance of the Company's websites and the electronic and IT tools used by the Company and/or the other companies of the TXT Group.

Candidates' personal data may also be communicated to third parties in the following cases:
(i) when communication is required by applicable laws and regulations in respect of legitimate third party recipients of communications, such as authorities and public bodies that process your data as autonomous data controllers for their relevant institutional purposes;
(ii) in the event of any extraordinary corporate operation (e.g. mergers, acquisitions, transfer of business, etc.).

The full list of recipients of personal data of the Data Subjects, including further details on the location of the recipients themselves, is kept at Data Controller's head office and is made available upon request to be transmitted to the contact details indicated in paragraph 8 below.

7.    DO WE TRANSFER PERSONAL DATA TO COUNTRIES OUTSIDE THE EU?
Personal data will be managed and stored on Data Controller's servers located within the European Union.

As part of an international group, Tlogos informs the Data Subjects that, in order to process the personal data of the Data Subjects for the Purposes pursuant to paragraph 4 hereinabove, some personal data may be transferred to TXT Group companies based outside the European Union (among the countries, we mention: Switzerland, United Kingdom, United States of America).

Considering that some of the aforementioned countries do not guarantee an adequate level of protection of personal data compared to the one provided in the European Union, the Data Controller has taken steps to ensure that the transfer of Data Subjects' personal data to such countries occurs exclusively in compliance with the conditions set forth under Articles 45/49 of the GDPR and, in particular:
- in Switzerland: COMMISSION DECISION of July 26, 2000
- in the United Kingdom: COMMISSION DECISION of June 28, 2021
- in the United States: COMMISSION DECISION of July 10, 2023
- in Canada: COMMISSION DECISION of December 20, 2000.

Should the Company intend to transfer the personal data of Data Subjects to countries outside the EU other than those mentioned above, such transfer will only take place in compliance with the conditions set forth under Articles 45/49 of the GDPR.

8.    WHAT ARE YOUR RIGHTS IN RELATION TO THE PROCESSING OF YOUR PERSONAL DATA, HOW CAN YOU EXERCISE THEM AND HOW CAN YOU CONTACT US?
The Data Controller informs the Data Subject that, in accordance with the law, he/she shall at any time be entitled to withdraw his/her consent, where given, as well as to exercise the following rights (collectively, the “Rights”):
1. the “right of access” and specifically to obtain confirmation of the existence or absence of personal data concerning him/her and to have them made available in an intelligible form;
2. the “right to rectification” that is, the right to request the rectification or, if he/she has an interest, the integration of personal data;
3. the “right to erasure ” that is, the right to request the deletion, transformation into anonymous form of data processed in breach of the law, including data whose storage is not necessary in relation to the purposes for which the data were collected or subsequently processed;
4. the “right to restrict processing” that is the right to obtain from the Data Controller the restriction of processing in certain cases provided for under the Privacy Legislation;
5. the right to request the Data Controller to specify the recipients to whom he has notified any rectification or erasure or restriction of processing ( carried out pursuant to Articles 16, 17 and 18 GDPR, in fulfilment of the obligation to notify except where this proves impossible or involves a disproportionate effort);
6. the “right to data portability” that is the right to receive (or to transmit directly to another data controller) personal data in a structured, commonly used and machine-readable format;
7. the “right to object” that is the right to object, wholly or partly:
- to the processing of personal data carried out by the Data Controller for its own legitimate interest;
- to the processing of personal data by the Data Controller for marketing or profiling purposes.

In the aforementioned cases, where necessary, the Data Controller shall inform the third parties to whom the Data Subject‘s personal data are transferred of the possible exercise of their rights, except in specific cases where this is not possible or would be too burdensome and, in any case, in accordance with the provisions of the Privacy Legislation.

It is expressly understood, as provided for under Article 21 of the GDPR, that in the event of exercise of the right to object by the Data Subject, the Data Controller shall refrain from further processing the personal data unless the Data Controller demonstrates the existence of compelling legitimate grounds for processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defence of a right in judicial proceedings.

The Data Subject may at any time exercise his or her rights as follows:
- by e-mail, to the address: privacy@txtgroup.com;
- by regular mail, to the address of the registered office of Tlogos S.r.l. in: via Antonio del Re 10/A, 0019 Tivoli (RM).

In any event, the Company - whenever it has reasonable doubts as to the identity of the Data Subject who submits the request referred to in Articles 15 to 21 of the GDPR - may request additional information necessary to confirm the identity of the Data Subject.

Please note that the Company undertakes to respond to your request at the latest within one month following receipt of your request. This deadline may be extended depending on the complexity or number of requests, and the Company will provide you with an explanation as to the reason for the extension within one month from your request. It should also be noted that should the Data Controller fail to comply with the request, it is obliged to provide feedback to the Data Subject as to the reasons for non-compliance and the possibility of lodging a complaint with a supervisory authority or judicial review within one month following receipt of the request.

9.    HOW CAN YOU LODGE A COMPLAINT BEFORE THE SUPERVISOR?
The Data Controller informs the User that, pursuant to the Privacy Legislation, he/she has the right to lodge a complaint to the competent supervisory authority (in particular in the Member State of his/her habitual residence, place of work or place of the alleged breach), if he/she considers that his/her personal data are being processed in a manner that would result in a breach of the GDPR.

In order to facilitate the exercise of the right to lodge a complaint, the name and contact details of the EU supervisory authorities are available at the following link: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.

Finally, should the User wish to lodge a complaint to the competent control authority for the Italian territory (i.e. the Italian Data Protection Authority), the complaint form is available at the following link: https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/4535524. 

10.    AMENDMENTS TO THE NOTICE
This Privacy Notice may be amended and supplemented over time. We invite Data Subjects to periodically check its contents. In any event, the Data Controller shall be responsible for duly notifying any significant changes made to this Privacy Notice.

Document updated as of 01/01/2024