HR privacy policy

1. Purpose

This GDPR policy outlines the obligations of Space Products and Innovation S.r.l (“the Company”) regarding the collection, use, storage and processing of personal data of employees, job applicants and other individuals associated with the Human Resources Office. The Company is committed to protecting the privacy and data of all individuals in accordance with the General Data Protection Regulation (GDPR).

2. Scope

This policy applies to all employees, contractors, consultants and any other parties working with or on behalf of the Company who have access to personal data processed by the HR Office. It covers all personal data handled by the Company, including data on job applicants, current and former employees, and contractors.

3. Key definitions

Personal Data: any information relating to an identified or identifiable natural person (data subject), including name, address, date of birth, identification numbers, employment details and contact information.
Processing: any operation performed on personal data, including collection, storage, use, alteration or destruction.
Data Subject: any individual whose personal data is being processed.
Data Controller: the entity that determines the purposes and means of processing personal data.
Data Processor: the entity that processes personal data on behalf of the Data Controller.
Consent: freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they signify agreement to the processing of their personal data.

4. Data collection

The HR Office collects personal data for purposes including recruitment and selection, employment records management, payroll processing, performance management, employee benefits administration and compliance with legal obligations.

Data will only be collected for specified, explicit and legitimate purposes. The Company will ensure that the data is accurate and kept up to date.

5. Lawful basis for processing

Personal data will be processed by the HR Office only when there is a lawful basis to do so: consent, where the data subject has given explicit consent; contract, where processing is necessary for the performance of a contract with the data subject; legal obligation; or legitimate interests pursued by the Company, except where these are overridden by the rights and freedoms of the data subject.

6. Data subject rights

The Company recognises and upholds the following rights of data subjects under the GDPR.

Right to access: individuals can request access to their personal data held by the Company.
Right to rectification: individuals can request correction of inaccurate or incomplete personal data.
Right to erasure: individuals can request deletion of their data when it is no longer necessary or if they withdraw consent.
Right to restrict processing: individuals can request to limit the processing of their data under certain circumstances.
Right to data portability: individuals can request to receive their data in a structured, commonly used and machine-readable format.
Right to object: individuals can object to processing based on legitimate interests or direct marketing.
All requests will be handled promptly and, in any event, within one month of receipt.

7. Data security

The Company implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or damage. This includes encryption of sensitive data, secure storage solutions, access controls and authentication procedures, and regular data protection training for HR personnel.

8. Data retention

Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal, regulatory or internal policy requirements. The Company regularly reviews the personal data it holds and erases or anonymises data that is no longer needed.

9. Data breach notification

In the event of a data breach, the Company follows its Data Breach Response Plan, which includes notifying the relevant supervisory authority within 72 hours of becoming aware of the breach where required. Affected data subjects are informed without undue delay if the breach is likely to result in a high risk to their rights and freedoms.

10. Data transfers

The Company ensures that any transfer of personal data outside the European Economic Area is conducted in compliance with the GDPR, using appropriate safeguards such as standard contractual clauses, Privacy Shield certification or binding corporate rules.

11. Third-party processors

The Company may engage third-party service providers (data processors) to handle personal data on its behalf. The Company ensures that any such processors are GDPR-compliant and provide adequate guarantees to protect the data.

12. Responsibilities

HR Office: responsible for ensuring that all HR-related data processing activities comply with this policy and the GDPR. Data Protection Officer: overseeing the Company’s data protection strategy and ensuring compliance. All employees: required to adhere to this policy and report any potential data protection issues to the HR Office or the DPO.

13. Training and awareness

The Company provides regular GDPR training to all employees involved in the processing of personal data. The training covers GDPR principles, data subject rights, and the Company’s data protection policies and procedures.

14. Review and updates

This policy will be reviewed regularly and updated as necessary to reflect changes in legislation, regulatory requirements or business practices.

15. Contact information

For any questions or concerns regarding this GDPR policy or data protection practices, please contact the Data Protection Officer at hr@spinintech.com.