Privacy notice

This notice describes how DID S.r.l. processes the personal data of people who use the platform, apply for a position, or act as contact persons for the companies we work with.

If we contacted you without you ever registering or sending us a CV, your data comes from public sources: the notice for candidates and professionals applies.

Data controller

Roles: when we are controller and when we are not

The platform is used by several organisations, each with its data separated from the others.

• We are the controller of data we collect for our own purposes: our users' accounts, candidates we manage for our own searches, and business contacts we have a commercial relationship with.
• We are a processor — not the controller — of data that a client organisation uploads into its own space on the platform. In that case the controller is the client organisation, which determines purposes and means; we process the data only to provide the service to them, under an agreement pursuant to Art. 28 GDPR. If your data was uploaded by a company using the platform, exercise your rights with that company: if you write to us, we forward the request and tell you so.

What data we process, for what purpose and on what basis

If you have a platform account

Data: first name, surname, e-mail, password (stored only as a hash, never in clear text), organisation, role and permissions, preferences, profile picture if you upload one, and a log of actions taken on the platform (who did what and when, for security and traceability).

Purposes: providing the service, authenticating you, keeping access secure, and invoicing.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) for the service; legal obligation (Art. 6(1)(c)) for invoicing and accounting retention; legitimate interest (Art. 6(1)(f)) for the action log, which exists to reconstruct possible misuse.

If you apply or send us your CV

Data: identifying and contact data (first name, surname, e-mail, phone, address, city, country), the CV and attachments you upload, and the information the CV contains: work experience, education and qualifications, skills and technologies, languages and proficiency levels, availability, expected rate or salary, willingness to travel and to work remotely. If the CV states a date of birth, the system derives your age from it.

We also process the status of your application, our staff's internal notes and — if used — feedback received from clients.

Purposes: assessing your application, proposing you for matching positions, and managing our relationship with you.

Legal basis: pre-contractual measures at your request (Art. 6(1)(b) GDPR); for positions other than the one you applied for, your consent (Art. 6(1)(a)), which you may withdraw at any time.

Special categories of data. We do not ask for data on health, membership of protected categories, ethnic origin, religious, political or trade-union beliefs or sexual orientation, nor criminal-offence data, and we do not use such data to select. If it appears in a CV you upload of your own accord, we do not extract it into structured fields and do not use it in the assessment. Please do not include it.

If you send us your CV from the public site (spontaneous application). From the opportunities page you can send us your CV without applying for a specific position. We then process the same data listed above and your profile goes into our candidate database, where our team can consult and search it.

Legal basis: pre-contractual measures at your request (Art. 6(1)(b) GDPR) to assess the application you sent us; your consent (Art. 6(1)(a)) to keep the profile and to propose future positions to you and — if you tick the box — to present your profile to the client companies that ask us to find professionals. The two boxes are separate and optional: you may withdraw them at any time by writing to info@did.srl, without affecting the lawfulness of the processing carried out beforehand.

What we record about your consent: the version of the notice we showed you, the language you read it in, the date and time, and a cryptographic fingerprint of your IP address. This lets us prove that consent was given and on which text.

For how long: 24 months from the last meaningful contact, as stated in the retention table. Deletion is automatic: once the term expires, a periodic process removes the profile and the uploaded CV, including the copy held by our storage provider. You do not have to ask for anything; you may of course ask for deletion earlier.

What happens after you send it: you receive an acknowledgement of receipt by email straight away. If the CV cannot be read or the format is not supported, we tell you by email. After that we contact you only if your profile fits one of our searches: we do not promise a reply within a set time.

If you are a company contact person

Data: name, role, business e-mail and phone, company, sector, technologies used by the company, website and public profiles, and our team's notes.

Purposes: offering our services and managing the business relationship.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) for first contact in a professional context; performance of the contract once the relationship begins. You may object at any time by writing to info@did.srl.

If you ask to receive the supplier newsletter

This section concerns IT companies, consultancies and agencies that fill in the public "Work with DiD" form to receive our supplier newsletter.

Data: company name, first and last name of the contact person, business e-mail, city of the head office, and the types of collaboration and technologies you indicate. As proof of consent we also keep the date and time, the version of the notice we showed you, an encrypted (non-reversible) fingerprint of your IP address and the browser type.

Purposes: sending you the newsletter for potential suppliers of DID S.r.l. and assessing a collaboration.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by ticking the box in the form.

How it works: before subscribing you, we check the data you sent; until the check is complete we do not write to you. If the request is approved, we add you to the list on Intuit Mailchimp and you receive an e-mail to confirm the subscription (double opt-in): without your confirmation you do not receive the newsletter. If the request is not approved, we do not subscribe you and do not write to you. Requests that are not verified within 6 months of being sent are deleted automatically.

Withdrawal: you can withdraw your consent at any time through the link in every e-mail or by writing to info@did.srl, without affecting the lawfulness of earlier mailings. A withdrawal made with the link in the e-mails is also recorded in our systems, which from that moment no longer subscribe you to the newsletter.

If the request is approved, the contact person's business data stays among our business contacts even after you withdraw consent to the newsletter, under the conditions of the section "If you are a company contact person": legitimate interest (Art. 6(1)(f) GDPR), with the right to object by writing to info@did.srl.

Providers and transfers: the newsletter is sent through Intuit Mailchimp, which processes the data in the United States as a processor (see "Providers" and "Transfers").

Retention: until you withdraw consent. Requests that are not approved are kept for 24 months from the decision, as proof of the decision taken. Requests that are not verified are deleted 6 months after being sent.

How we use artificial intelligence

We use AI models at specific points in the service. Here they all are.

No automated decision-making. None of these functions determines the outcome of an application on its own. CV extraction is editable: automatically derived fields can be corrected and the original document remains available. Ranking only sets the reading order. Assessment and choice are always made by a member of our team. We therefore do not fall under Art. 22 GDPR, which concerns decisions based solely on automated processing.

You are nevertheless entitled to ask which fields were extracted automatically from your CV and what compatibility index was calculated: we will tell you and correct it if it is wrong.

Your data does not train models. The provider supplying the language models acts as a processor and, under the business terms we have entered into, does not use the content we send it to train its models.

Providers

These providers process personal data on our behalf as processors appointed under Art. 28 GDPR.

The list is current as at the date shown at the top of this document. You may ask us for the current version at any time by writing to info@did.srl.

Besides these, we share your data:

• with the client company we propose you to, subject to your consent and telling you who they are;
• with partners involved in a specific search, on the same conditions;
• with advisers, accountants and lawyers and with public authorities, where required by law.

We do not sell personal data and do not disclose it for third-party marketing.

Transfers

Some of the providers listed above process data in the United States: in particular, CVs and uploaded files are stored in a US region of Amazon S3, and the language models are supplied by a US provider.

These transfers take place on the basis of:

• the European Commission's adequacy decision of 10 July 2023 for providers certified under the EU–U.S. Data Privacy Framework; and, in addition or alternatively,
• the standard contractual clauses adopted by the European Commission (Decision 2021/914), supplemented by the additional measures set out in our contracts with each provider.

As regards transfers to Switzerland: the European Commission has recognised Switzerland as providing an adequate level of protection, so no further safeguards are required.

You may request a copy of the safeguards applied by writing to info@did.srl.

How long we keep data

Once these periods expire, data is deleted or irreversibly anonymised.

Security

Passwords are stored only as hashes. Access to the platform requires authentication and each organisation's data is separated from the others. Communications between your browser and our servers are encrypted in transit. We apply internal access controls on a least-privilege basis and log operations carried out on data.

No measure removes risk entirely. In the event of a data breach involving a high risk to your rights, we will inform you and notify the authority within the statutory deadlines.

Your rights

You have the right to:

• access your data and obtain a copy of it;
• request rectification of inaccurate or incomplete data;
• request erasure;
• request restriction of processing;
• object to processing based on legitimate interest, including first commercial contact;
• receive your data in a machine-readable format (portability);
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Write to info@did.srl. We reply within 30 days. Exercising your rights is free of charge.

You may lodge a complaint with the Italian Garante per la protezione dei dati personali (garanteprivacy.it), the Swiss FDPIC (edoeb.admin.ch) or the authority of your EU country of residence.

Providing your data

Providing the data needed to create an account or assess an application is optional, but without it we cannot provide the service or consider the application. Everything else is voluntary.

Cookies

The use of cookies and local storage is described in the cookie policy.

Changes

We update this notice when processing operations, purposes or providers change. The version in force and its date are at the top of the document; we notify registered users of substantial changes.