Privacy Notice pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)
Version dated 09 October 2026
In accordance with the requirements of the General Data Protection Regulation (GDPR), the Data Controller provides the following information regarding the processing of personal data.
DATA CONTROLLER
Data Controller: Altenia s.r.l.
Registered Office: Via E. Galbani 70 – 00156 Roma (RM)
VAT Number / Tax Code: 09170680962 / 09170680962
Email: amministrazione@alteniaenergy.it
Legal Representative: Massimo La Gioia
Privacy Focal Point: Davide Stranieri (privacy@alteniaenergy.it)
Data Protection Officer (DPO): Italcomply Società per Azioni Consortile Email: dpo@italcomply.it
Joint Data Controllers: No Joint Data Controllers have been appointed.
For further information regarding the processing of your personal data or to exercise your rights, you may contact the Data Controller, the Privacy Contact Person, or the Data Protection Officer (DPO) using the contact details provided above.
DATA SUBJECTS
Categories of data subjects: Individuals submitting applications for employment opportunities.
PROCESSING ACTIVITY
Curricula Vitae Management
Description: Processing of personal data provided by applicants through the dedicated forms available on the Data Controller’s website.
SOURCE, PURPOSES, LEGAL BASIS AND NATURE OF THE DATA PROCESSED
Source of the Data: Personal Data are collected directly from the data subject.
Purpose of Processing: Recruitment and Personnel Selection – Personal data are processed for activities related to the management, evaluation, and selection of candidates. Please note that, in the case of an unsolicited curriculum vitae voluntarily submitted by the applicant, the provision of personal data for the purposes referred to in Article 6(1)(b) GDPR is optional and no consent is required, as provided for by the applicable Italian legislation implementing Regulation (EU) 2016/679. Failure to provide data strictly necessary for the evaluation of the application may prevent the Data Controller from considering the candidate within the recruitment and selection process.
Legal Basis: The processing is necessary in order to take steps at the request of the data subject prior to entering into a contract and/or for the performance of a contract to which the data subject is a party.
Categories of Personal Data processed:
- First name and surname;
- Tax identification number and other identification data;
- Date and place of birth;
- Telephone number;
- Declared profession;
- Educational qualifications;
- Professional certifications and qualifications;
- Salary-related information;
- Social security and welfare information;
- Image and/or video recordings, where provided;
Special categories of personal data as defined by Articles 9 and 10 GDPR may be contained in the curriculum vitae or otherwise disclosed during the recruitment process.
Special categories of Personal Data: 1. Special categories of personal data as defined by Articles 9 and 10 GDPR may be contained in the curriculum vitae or otherwise disclosed during the recruitment process. Such data may be processed only where necessary and in accordance with applicable legal requirements.
Legal basis for special categories of data: Article 9(2)(b) GDPR: Processing is necessary for carrying out obligations and exercising specific rights of the Data Controller or the data subject in the field of employment, social security, and social protection law.
RECIPIENTS OF PERSONAL DATA
Categories of recipients:
- Personal data may be disclosed, where necessary, to third parties on the legal bases provided by Article 6 GDPR, such as Subsidiaries and affiliated companies, IT and Internet service providers.
- Such entities, organizations, companies, and professionals may act either as Data Processors appointed by Altenia S.r.l. or as independent Data Controllers.
Personal data may be disclosed, where necessary, to third parties on the legal bases provided by Article 6 GDPR, such as Subsidiaries and affiliated companies, IT and Internet service providers.
Such entities, organizations, companies, and professionals may act either as Data Processors appointed by Altenia S.r.l. or as independent Data Controllers.
Personal data may also be shared with external service providers engaged by the Data Controller for the performance of activities related to the recruitment process. Only data strictly necessary for the relevant services will be disclosed.
An updated list of Data Processors may be requested from the Data Controller.
Employees, consultants, temporary workers, and any other individuals authorized to process personal data pursuant to Article 29 GDPR operate under specific instructions provided by the Data Controller.
Appropriate operational instructions and security measures are implemented to ensure confidentiality and data protection.
Data subjects are invited to promptly report any circumstances that may result in a potential personal data breach so that appropriate evaluations and corrective measures can be undertaken.
The Data Controller may also disclose personal data to public authorities where required by law or upon official request.
INTERNATIONAL DATA TRANSFERS
Transfers of Personal Data to third countries (outside the European Union) or international organisations: No transfer of personal data to non-EU countries or international organizations is currently envisaged.
METHODS OF PROCESSING AND DATA RETENTION PERIOD
Data Retention Period: Personal data submitted within a spontaneous job application shall be retained only for the period strictly necessary to achieve the purposes for which they were collected and in accordance with the principle of data minimization under Article 5 GDPR.
Curricula vitae will be stored within the Human Resources and Training database for a maximum period of 12 months from receipt of the CV or from the date of its last update communicated by the applicant.
Upon expiry of the retention period, personal data will be securely deleted unless otherwise requested by the data subject.
rsonal data are processed by means of manual, electronic, and computerized tools using procedures strictly related to the purposes described above and in a manner that guarantees their security and confidentiality.
NATURE OF DATA PROVISION
The provision of personal data for recruitment and personnel selection purposes is voluntary.
Processing Purposes That Do Not Require Consent: The provision of personal data for recruitment and personnel selection purposes is voluntary.
However, failure to provide the data necessary for evaluating the application may prevent the Data Controller from carrying out recruitment and selection activities.
No consent is required when processing is necessary for pre-contractual measures, contractual obligations, compliance with legal obligations, or the legitimate interests pursued by the Data Controller.
Purposes Requiring Consent:
For data collected and processed for purposes related to the performance of activities connected with the contractual relationship and compliance with the applicable legal obligations, your consent is not required.
Failure to provide the aforementioned personal data will make it impossible to establish or continue the relevant relationship.
For data collected and processed on the basis of the Data Controller’s legitimate interests, your consent is not required (Article 6(1)(f) GDPR).
The provision of the above-mentioned personal data is optional; however, it is necessary for the performance of the services provided by the Data Controller. Any refusal to provide such data may result in the impossibility of providing, in whole or in part, the requested services.
DATA SUBJECT RIGHTS
(Items. 15-22 GDPR)
- Right of Access: To obtain confirmation as to whether personal data concerning him or her are being processed and access such data.
- Right to Rectification: To obtain the correction of inaccurate personal data and the completion of incomplete personal data.
- Right to Erasure: To request the deletion of personal data where one of the grounds provided for by the GDPR applies.
- Right to Restriction of Processing: To obtain the restriction of processing under the conditions laid down by the GDPR.
- Right to Object: To object to the processing of personal data under the conditions established by applicable law.
- Right to Data Portability: To receive personal data in a structured, commonly used and machine-readable format and to transmit such data to another controller where applicable.
- Right to Withdraw Consent: Where processing is based on consent, the data subject may withdraw such consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
- Right to Lodge a Complaint: The data subject has the right to lodge a complaint with the competent supervisory authority pursuant to Article 77 GDPR.
You may exercise your rights by contacting the Data Controller or, where applicable, the Data Protection Officer (DPO) using the contact details provided above.
AUTOMATED DECISION-MAKING
Automated decision-making process: No
Profiling activities: Not applicable
Legal basis: Not applicable
The Data Controller reserves the right to amend or update this Privacy Notice at any time where necessary due to regulatory changes or organizational requirements. Any material changes will be communicated through appropriate channels.
Data Controller
Altenia s.r.l.
09 October 2026