IT DE EN

Privacy Notice for Job Applicants (Art. 13 Regulation (EU) 2016/679 – GDPR)

This privacy notice applies exclusively to personal data collected through the job application form on the driver recruiting page and to the processing of curricula vitae (CVs). It is separate from the company's general privacy policy.

1. Data Controller

The Data Controller is DIBIASIBUS SRL — Via dell'Adige 12, 39040 Cortaccia (BZ), Italy — VAT No. IT02842510212 — Privacy & general contact email: info@dibiasibus.it — Recruitment contact email: autisti@dibiasibus.it.

Applications are managed exclusively by DIBIASIBUS S.r.l.

2. Personal Data Processed, Technical Data and IP Addresses

Through the application form, only data strictly necessary for recruitment are collected:

identification and contact details: full name, phone number, email address, area/city of residence;
professional and application information: selected position/job offer, possession of Category D driving licence, possession of Driver CPC for passenger transport (CQC Persone / Code 95), years of experience (1 year, 2 years, 3–5 years, Over 5 years) and work availability;
attached curriculum vitae (optional; PDF, DOC, DOCX formats; maximum 5 MB);
selected language and system-generated application reference code;
technical anti-abuse data and IP addresses: the application form never stores raw IP addresses, converting them immediately into an irreversible cryptographic hash (SHA-256 with a secret key) solely to prevent automated or repeated submissions. Standard web server access and security logs are managed by the EU-based hosting provider for IT security purposes.

3. Purposes of Processing

Personal data are processed exclusively in order to:

receive job applications and contact applicants;
evaluate professional profiles against open positions and manage potential hiring within DIBIASIBUS S.r.l.;
comply with applicable legal obligations;
protect and defend corporate legal rights where strictly necessary.

4. Legal Basis

Processing is based on the performance of pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR) for evaluating the application, compliance with legal obligations (Art. 6(1)(c) GDPR), and the Controller's legitimate interest in defending legal claims where applicable (Art. 6(1)(f) GDPR).

This form does not collect consent for marketing or profiling purposes.

Providing the data marked as mandatory is necessary to evaluate the application; submitting a CV is optional.

5. Special Categories of Data Included in CVs

The Controller does not request sensitive information or special categories of personal data (Art. 9 GDPR) that are not necessary for recruitment.

Should such information be voluntarily included by the applicant in their CV, it will be managed with strictly restricted access limited to authorised personnel and deleted when no longer necessary, in accordance with applicable law.

6. Application Management and Security Measures

Applications are managed exclusively by DIBIASIBUS S.r.l. and are accessible solely to Executive Management and authorised company personnel responsible for recruitment and HR administration.

Processing is carried out electronically with appropriate security safeguards: HTTPS encryption, strict file type and integrity validation, anti-abuse rate limiting, delivery exclusively to dedicated corporate mailboxes (autisti@dibiasibus.it and consulting@dibiasibus.it), and storage within the restricted WordPress HR management module featuring an encrypted CV Vault (SHA-256 verification outside public web directories with zero direct URLs).

7. Recipients and External Service Providers

Internal recipients are exclusively Executive Management and personnel authorised for recruitment. Applications are not shared with third parties.

For website hosting (EU/Italy server infrastructure) and corporate email services, the Controller relies on qualified IT service providers bound by Data Processing Agreements under Art. 28 GDPR.

Personal data are never publicly disclosed.

8. Place of Processing and International Transfers

Data processing and application storage take place on servers and corporate email accounts located within the European Union / European Economic Area (EEA). No transfers of personal data to third countries outside the EU/EEA are envisaged for recruitment purposes.

9. Automated Decision-Making

Candidate selection is carried out exclusively through human assessment and never through solely automated decision-making processes or profiling (Art. 22 GDPR).

10. Data Retention (12 Months) and Automatic Deletion

Applications and CVs of non-hired candidates are retained for a maximum period of 12 months from receipt of the application, unless specific documented legal requirements apply.

The management system enforces an automatic deletion procedure for applications and attached CVs upon reaching 12 months from receipt. Non-relevant applications are also deleted earlier as soon as they are no longer needed.

11. Data Subject Rights

You may exercise your rights under Arts. 15–21 GDPR (access, rectification, erasure, restriction of processing, data portability, and objection) at any time.

Privacy requests may be sent to info@dibiasibus.it. A response will be provided within one month of receipt of the request, subject to the extensions permitted under the GDPR.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or your local supervisory authority.

12. Approval and Updates

Notice updated on 29/10/2026. The Controller may update this privacy notice; the version in force is always the one published on this page.

The general corporate privacy policy of Dibiasibus S.r.l. remains available here: Corporate Privacy Policy

Informativa privacy candidature