Privacy Policy
Table of Contents
Pursuant to art. 13 and 14 of the General Data Protection Regulation – (EU) 2016/679 (“GDPR”):
The personal data provided by candidates on the website “career.costacrociere.it” (the “Portal”), and all personal data included in the documents uploaded on the Portal (for example, the candidate’s CV) will be processed in compliance with the applicable data protection regulations by Costa Crociere S.p.A., (“Costa”) or by Cruise Ships and Services International NV (“CSCS”) as follows.
Candidates are required to provide only true and accurate information and to inform Costa or CSCS of any changes to their details.
1. Data controller
Costa Crociere S.p.A., with registered office in Piazza Piccapietra 48, 16121 Genova, is the data controller regarding the applications for Costa’s job positions.
Cruise Ships and Services International NV, with registered office in Kaya Flamboyan 9, Willemstad, Curaçao, makes business in Italy through its permanent establishment with registered office in Piazza Piccapietra 48, 16121 Genova. CSCS is the data controller regarding the applications for CSCS’s job positions.
2. Data protection officer
The data protection officer (both for Costa and CSCS) can be contacted by e-mail at privacy@costa.it.
3. Categories of personal data, purposes of data processing and legal basis
The personal data that you have voluntarily provided to Costa or to CSCS by uploading it to the Portal (e.g., personal data contained in your CV such as biographical details, contact details, your previous experience etc. or in other documents you upload to the Portal) will be processed for the recruitment activity. In particular, in order to enable you to participate in the selection of personnel for Costa or for CSCS (legal basis: Article 6(1) lett. b of the GDPR).
Costa and CSCS invite candidates not to include in their CVs or otherwise communicate to Costa or CSCS any personal data revealing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organizations of a religious, philosophical, political or trade union nature, as well as personal data revealing health or sex life (so-called special categories of personal data) and, if voluntarily entered or communicated, will be erased unless their use is strictly necessary for the pursuit of the purposes of research and selection of personnel and the establishment of the employment relationship (e.g., in the case of membership of certain protected categories – in such case, the voluntary provisions with special data represents your consent to processing activities by Costa or CSCS; (legal basis: Article 6(1) lett. a) of the GDPR)), within the limits and in compliance with the express provisions of the law.
We also process your personal data where we are required to by law for example, to comply with record keeping, auditing, tax or other employment law obligations (legal basis: Article 6(1) lett. c of the GDPR ), or when it is in Costa/CSCS’s legitimate interests and when these interests are not overridden by your privacy and data protection rights, such as to protect the security of our facilities and our legitimate business interests and legal rights, including, but not limited to, use in connection with legal claims, compliance, regulatory, auditing and investigative (legal basis: Article 6(1) lett. f of the GDPR).
Moreover, for operation and maintenance purposes, the Portal and any third-party services used by it may collect system logs, i.e., files that record interactions and which may also contain personal data, such as IP address; in addition, for further purposes, information may be collected at an aggregate level, for example relating to user behavior on the Portal, through the use of tracking tools; for more information, please click on “Show details” in the banner below or on “Cookie settings” in the bottom left-hand corner.”.
4. Nature of the provision of the data and consequences of refusal
Your personal data is collected and processed if you voluntarily provide it. Therefore, the provision of personal data is facultative but is necessary for staff selection procedures. Any refusal to provide the data will make it impossible to participate in these selection procedures for any job position and / or will make it impossible to adequately assess your professional profile.
5. Categories to which the data may be communicated
Your personal data will be processed by internal staff, which operates within Costa or CSCS Human Resources department, by managers who have an interest in the selection of candidates, as well as by IT service providers involved in the management and maintenance of the Portal (such as Alliance Software S.r.l.), and by agents who carry out certain activities in the area of recruitment and employment relationship. For the needs of the various organizational units of Costa or CSCS or other companies of the group both in Italy and abroad – which will act as autonomous data controllers – your personal data may be communicated and transferred abroad, even in countries outside the European Union, to the above-mentioned companies and to other companies for the purpose of evaluation your application and possibly entering into a contractual relationship.
Your data may be disclosed to third parties, professionals and employees of service companies, supporting Costa or CSCS in its personnel selection activities.
The complete list of data processors or autonomous data controllers can be obtained by writing at privacy@costa.it.
6. Transfer of personal data outside the EU
Your personal data may be transferred abroad to third-party companies (e.g., Carnival Group Companies) within or outside the European Union for the purposes set out above.
When data is transferred to countries outside the European Union, those countries shall ensure an adequate level of protection, based on an adequacy decision by the European Commission or, alternatively, the recipient shall have a contractual obligation to safeguard personal data adopting an adequate and comparable level of protection to that provided under the GDPR (e.g., by signing standard contractual clauses).
7. Data retention
Costa or CSCS may retain your data for as long as necessary to achieve the purposes for which it was collected, but for no longer than 24 months from the date of collection if you do not successfully complete the recruitment phase. However, if you for any reason you consider that the purpose of the processing is no longer valid, you should notify Costa or CSCS in writing at the address below. Upon receipt of such notification, Costa or CSCS will immediately authorize the erasure of the data provided from its archives and databases.
8. Rights of the data subject
At any time, in accordance with Articles 15 to 22 of the GDPR, you have the right at any time, including in relation to profiling, to:
- access your personal data;
- request the rectification of your personal data;
- withdraw, at any time, your consent to the use and disclosure of your personal data;
- request that your personal data be erase;
- obtain the personal data in a structured, commonly used and machine-readable format, as well as the right to send data to another data controller;
- oppose the processing of personal data concerning you for marketing or profiling purposes;
- obtain restriction on the processing of personal data;
- lodge a complaint with a supervisory authority;
- receive a notification whenever there is a personal data breach; and
- request information about:
- the purpose of processing;
- the categories of personal data processed;
- the recipients or categories of recipients to whom personal data have been or will be disclosed, in particular, whether data have been disclosed to recipients in third countries or international organizations and the existence of adequate guarantees;
- the period for which personal data shall be retain;
- where the personal data are not collected from the data subject, any available information regarding its source.
You may exercise these rights and/or obtain further information regarding the processing of your personal data processing, by sending an email to privacy@costa.it
9. No automated individual decision-making
We do not use your personal data for automated individual decisions in the sense of Article 22(1) of the GDPR.
10. Links to other websites
The Portal contains links to other websites. Please note that this privacy notice does not apply to these other websites.