Template — Privacy notice for candidates

Version 1.0 — 31 October 2026

This text is a draft prepared with the assistance of artificial intelligence and should be reviewed by a lawyer before relying on it.

This template is available in Italian, English and Russian. In case of any discrepancy between the versions, the Italian version prevails.

Instructions for the user (delete before sending). This is a template to be completed and adapted. Replace the text in square brackets, delete the options that do not apply to you and have the content checked by an adviser. Provide the notice when the data are collected or, for unsolicited CVs, at the first useful contact (Article 111-bis of Italian Legislative Decree 196/2003); for data collected from portals or third parties, within one month (Article 14 GDPR). You are the data controller, not the author of CvRadar.

Information notice for candidates under Articles 13 and 14 of Regulation (EU) 2016/679

1. Data controller

[Company name / Full name], [address], [tax code / VAT number], email [email], telephone [telephone].

[If appointed] Data Protection Officer (DPO): [name], [DPO email].

2. What data we process

The data contained in your CV and in the documents you send us or that we have collected: identification and contact details, education and career history, skills, languages, [other]. Please do not include unnecessary data in your CV, such as a photograph, health status, religious or political beliefs, trade union membership, ethnic origin or sexual orientation. If present, such data are not used in the assessment.

3. Where the data come from

• directly from you (email, Telegram bot [bot name], hand delivery or other channel);
• [if applicable] from the job portal [portal name], on which you published your profile or application;
• [if applicable] from [other source].

4. Purposes and legal basis

• Assessing your application for the position [position name] or, if you sent your CV unsolicited, for positions matching your profile. Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR); for unsolicited CVs consent is not required (Article 111-bis of Legislative Decree 196/2003).
• [If applicable] Keeping your profile for future recruitment. Legal basis: our legitimate interest in identifying suitable candidates (Article 6(1)(f) GDPR); you may object at any time.
• Protecting our rights in the event of disputes. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
• [If applicable] Complying with legal obligations, for example on compulsory employment of persons with disabilities (Article 6(1)(c) and Article 9(2)(b) GDPR).

5. Use of an automated support tool

To review applications we use software installed on our computers (CvRadar) which:

• extracts the text of the CV;
• using an artificial intelligence model run locally, computes the similarity between the CV and the job description;
• checks for the required skills and roughly estimates years of experience;
• [if applicable] uses a statistical model trained on assessments previously made by our recruiters for the same position;
• produces a score with an explanation (skills found and missing, degree of similarity).

The score is only a support. Every decision on your application is taken by a person, [recruiter's role], who reviews the CV and can depart from the score. We do not take decisions based solely on automated processing. The software is not used to infer emotions or protected personal characteristics.

[If the Telegram bot is used] When you send your CV to our Telegram bot you receive an automatic acknowledgement-of-receipt message.

You have the right to obtain information about the logic of the assessment, to express your point of view, to request review by a person and to contest the decision.

6. Where and how the data are processed

The data are stored on the controller's computers, protected by [measures: passwords, disk encryption, restricted access]. The software does not transmit CV data to its producer or to external analysis services. The data may pass through the providers of the channels you use to send them to us (for example the email provider [name] or Telegram), which process them under their own privacy policies.

7. Who may access the data

Authorised and instructed staff of the controller involved in the recruitment: [roles]. [If applicable] Suppliers acting as processors: [e.g. IT consultant, recruitment agency]. The data are not disseminated.

[If applicable] Transfer outside the European Economic Area: [country, safeguard adopted].

8. How long we keep the data

[retention period]. For example: until the recruitment closes and for the following [6] months; for unsolicited CVs, [12] months from receipt. If you are hired, the data become part of the employee file. In the event of a dispute, for as long as necessary to protect our rights.

9. Whether providing data is mandatory

Providing the data is optional, but without them we cannot assess your application.

10. Your rights

You may request access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest (Articles 15-22 GDPR), by writing to [email]. You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, https://www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you live or work.

Date: [date]

[Company name / Full name]