← Documenti legali

Privacy Notice Templates for the Customer

CONSOO S.R.L.S. — hice

Edition: English master (international)

Last updated: 3 July 2026

Usage note — read before using the templates

This page collects editable privacy notice templates that the Customer may provide to the natural persons whose personal data it processes within the hice Service: in particular candidates (recruiting) and employees/collaborators managed in the platform.

Before using them, it is essential to be clear about the roles and limits that follow.

  1. The Customer is the Data Controller; hice is the Data Processor. For the Customer Data — including the personal data of candidates, employees, collaborators and contacts — the Data Controller is the Customer (Article 4(7) GDPR). hice acts as Data Processor (Article 28 GDPR) on behalf of the Customer, under the Data Processing Agreement (dpa-trattamento-dati.md). These notices are therefore the Customer's notices to its own data subjects, NOT notices of hice. hice appears in them solely in its capacity as processor.

  2. They are templates, not ready-to-use documents. The texts that follow are starting outlines to be customized and validated by the Customer. As a minimum, the Customer must: select and adapt the purposes, legal bases and retention periods to its own organization, sector and country of operation; remove any parts that are not relevant; add any further processing activities, categories of data or recipients that concern it (e.g. other providers, agencies, specific transfers); indicate, if it considers it useful, its own contact details in addition to those already communicated to its own data subjects.

  3. The Customer is autonomous and solely responsible for compliance. The choice, completeness, accuracy and lawfulness of the notice actually provided to data subjects rest exclusively with the Customer as Data Controller. It is for the Customer to verify the legal basis of each processing activity, to ensure that the notice is provided before or at the time of data collection (Articles 13–14 GDPR) and to keep evidence that it has been provided.

  4. hice does not provide legal advice. These templates are intended merely as operational support and do not constitute legal, tax or compliance advice. hice does not warrant that they are exhaustive or suitable for the Customer's specific case. The Customer is invited to have the texts validated by its own lawyer or Data Protection Officer (DPO) before use, in particular for the processing of candidates and in the context of personnel selection.

  5. Why hice makes these templates available. Helping the Customer to be compliant also protects hice: an informed and compliant Controller reduces the risk for the entire processing chain. It remains the case that the Customer warrants that it has a legal basis to upload, and have hice process, the personal data of third parties (see _foundation.md §4.5 and the General Terms of Service, condizioni-generali-servizio.md).

  6. How to adapt the templates. Any remaining parts in [SQUARE BRACKETS] (e.g. retention periods, date and version) are indicative values to be confirmed or replaced. The blocks in «angle brackets» indicate alternative choices or portions to be included/removed depending on the case. The notes in italics in parentheses are instructions for the person completing the document and must be removed from the final version. The full list of items to review is at the end (§4, «To be completed»).

1. Template A — Privacy notice for candidates (recruiting)

When to use it. To be provided to the persons who submit an application or whose data (CV, contact details) the Customer enters into hice for the purposes of personnel selection. The notice must be provided at the time of collection of the data (e.g. in the application form, in the job advertisement, in the first communication) or, where the data are collected from third parties (e.g. databases, referrals), within one month and in any case upon the first communication with the data subject (Articles 13–14 GDPR).

Adaptation notes specific to Template A.

  • The retention section reflects the default values applied by hice's candidate retention function (see §1, item 6 of the template). These are prudential product defaults, not legal advice: the Customer confirms or amends them according to its own assessment and the practice of its country/sector.
  • The section on automated matching tools must be kept only if the Customer uses hice's candidate↔opportunity matching feature. If it does not use it, the section must be removed.

PRIVACY NOTICE ON THE PROCESSING OF CANDIDATES' PERSONAL DATA

(pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 — the «GDPR»)

1. Data Controller

The Data Controller of your personal data is the Customer to which you submitted your application, i.e. the entity (company or professional) that made this notice available to you. The Data Controller's contact details (registered office, VAT/Tax Code, e-mail and, where available, PEC) are provided to you directly by the Customer, including through the job advertisement or the communications relating to your application.

«(Include if appointed:) The Data Protection Officer (DPO) of the Customer, where appointed, can be contacted through the same channels.»

2. What data we process (categories of data)

We process the personal data that you provide to us when applying or that we collect in the context of the selection process, in particular:

  • identification and contact data (e.g. first name, surname, e-mail, telephone, contact details);
  • data contained in your curriculum vitae and its attachments (professional experience, education, skills, languages) and any information you spontaneously include in your application or that emerges during the interviews;
  • any assessment notes drawn up during the selection process.

«(Include ONLY if relevant — see note below:) We ask you not to include special categories of data (Article 9 GDPR: racial or ethnic origin, political opinions, religious beliefs, data concerning health, sexual orientation, etc.) or data relating to criminal convictions, unless they are strictly necessary and expressly requested by us for the specific position. Should such data emerge, they will be processed only within the limits permitted by law and, where necessary, subject to your consent.»

3. Why we process your data (purposes)

Your data are processed in order to: a) manage your application and carry out the selection and assessment process for personnel for the position you are interested in; b) assess your profile against open positions, including positions other than the one you applied for, «(if provided for:) within the limits set out in point 6 (retention)»; c) contact you for communications relating to the selection process; d) «(if provided for:) comply with legal obligations connected with the selection and, in the event of a positive outcome, initiate the activities preparatory to hiring».

4. The legal basis on which we process your data

Depending on the purpose, the legal basis is:

  • the performance of pre-contractual measures taken at your request (Article 6(1)(b) GDPR), for the management and assessment of your application;
  • our legitimate interest (Article 6(1)(f) GDPR) in identifying profiles suited to our organizational needs, «(if provided for:) including assessing you for different positions and retaining your application for future opportunities»; this interest is balanced against your rights and freedoms;
  • your consent (Article 6(1)(a) GDPR) where required, for example «for the retention of your CV beyond the specific selection for the purposes of future personnel searches» «and for the processing of any special categories of data»; consent is optional and may be withdrawn at any time, without affecting the lawfulness of the processing carried out before the withdrawal;
  • compliance with legal obligations to which we are subject (Article 6(1)(c) GDPR), where applicable.

(Note for the person completing the document: choose the legal basis/bases actually applicable to your organization and remove the others. If relying on legitimate interest, retain the outcome of the balancing test.)

5. Automated tools supporting the selection

«(Include ONLY if hice's matching feature is used; otherwise remove the whole of point 5.)

To organize and speed up the selection, within the management platform we use (see point 8) we employ an automated matching support tool that compares the information in your profile (e.g. skills, experience) with the requirements of the open positions and proposes a ranking of profiles to make it easier for our recruiters to review them.

This tool has a purely supporting function: it does not make decisions in an automated way about your application. The assessment and the final decision are always left to a person on our team. Consequently, there is no solely automated decision-making process producing legal effects or significantly affecting you in a similar way (Article 22 GDPR).

In any event, you have the right to obtain human intervention on our part, to express your point of view, to contest the outcome and to receive meaningful information about the logic of the support tool and about the consequences of the processing. To exercise these rights you may contact us at the contact details in point 1.»

6. How long we keep your data

We keep the data of your application for as long as is necessary for the selection and, thereafter, for a period oriented towards future opportunities, according to the following maximum retention periods, which run from the date the application is entered:

  • [24] months if we operate in the European Union or the European Economic Area (EEA);
  • [12] months if we operate in the United Kingdom;
  • [24] months in other countries.

Upon expiry, the data are deleted or anonymized, unless a legal obligation or the exercise/defense of a right in legal proceedings requires their further retention. You may ask us at any time to delete your data early (see point 9).

(Note for the person completing the document: the periods indicated are the default values applied by the platform on the basis of the country; verify them and adjust them to your own assessment, your sector and the guidance of the competent authority. Indicate a single period if you operate in a single country.)

7. To whom we disclose your data (recipients)

Your data may be processed by the authorized staff of our organization and disclosed to entities that provide us with services instrumental to the selection, appointed as Data Processors where the relevant conditions are met, including the provider of the management platform indicated in point 8. «(Add any other recipients: e.g. group companies, employment agencies, advisers.)» Your data are not disseminated or transferred to third parties for marketing purposes without your consent.

8. Management tool used and its processor

For the management of the selection process we use the hice platform, provided by CONSOO S.R.L.S. (VAT/Tax Code IT13823860963, REA MI-2745733), with registered office at Piazzetta Umberto Giordano 2, 20122 Milan (MI), Italy, certified e-mail (PEC) consoo@pec.it, e-mail info@hice.ai, which acts as Data Processor on our behalf, under an agreement pursuant to Article 28 GDPR.

9. Transfers of data to non-EEA countries

«(Include/adapt according to your own situation.) The data are processed as a priority within the European Union/EEA. Should individual providers entail a transfer to non-EEA countries, this takes place subject to appropriate safeguards pursuant to Articles 44 et seq. GDPR (e.g. the European Commission's Standard Contractual Clauses or an adequacy decision). You may ask us for a copy or details of these safeguards at the contact details in point 1.»

10. Your rights

As a data subject, you have the right, within the limits of the law, to:

  • access your data and obtain a copy thereof (Article 15);
  • request their rectification (Article 16) and erasure (Article 17);
  • obtain the restriction of processing (Article 18);
  • object to processing based on legitimate interest (Article 21);
  • request the portability of the data you have provided to us (Article 20), where applicable;
  • withdraw any consent given, at any time, without affecting the lawfulness of the prior processing (Article 7);
  • obtain human intervention and exercise the rights set out in point 5, where relevant.

To exercise your rights you may write to us at the contact details in point 1. We will respond within the time limits set by law.

11. Complaint to the supervisory authority

You also have the right to lodge a complaint with the competent supervisory authority. In Italy this is the Garante per la protezione dei dati personali (the Italian Data Protection Authority, www.garanteprivacy.it). «(If you operate in another country, indicate the competent national authority.)»

12. Nature of the provision of data

The provision of the data necessary to manage the application is optional, but failure to provide it may make it impossible to assess your application.

Date last updated: [DATE]. Version: [VERSION].

2. Template B — Privacy notice for employees and collaborators

When to use it. To be provided to the natural persons whose employment or collaboration relationship the Customer manages within hice (employees, collaborators, consultants, including freelancers), with reference to the processing carried out through the platform (master data, timesheet, expenses, projects, org chart, calendar, etc.). It is normally provided at the establishment of the relationship or upon the first entry of the data into the platform.

Adaptation notes specific to Template B. This template covers the processing typically carried out in hice. The employment relationship, however, entails many other processing activities (payroll, social security, health surveillance, etc.) that fall outside the platform: the Customer must supplement the notice with such processing or refer to its own general notice for workers. In addition, where applicable, national labour-law rules must be complied with (in Italy, among others, Article 4 of the Workers' Statute regarding work tools and remote monitoring).

PRIVACY NOTICE ON THE PROCESSING OF THE PERSONAL DATA OF EMPLOYEES AND COLLABORATORS

(pursuant to Article 13 of Regulation (EU) 2016/679 — the «GDPR»)

1. Data Controller

The Data Controller is the Customer, as the employer or principal for whom you carry out your work or collaboration activity. The Data Controller's contact details (registered office, VAT/Tax Code, e-mail and, where available, PEC) are provided to you directly by the Customer, including through your contract or ordinary company communications. «(If appointed:) The Data Protection Officer (DPO) of the Customer, where appointed, can be contacted through the same channels.»

2. Scope of this notice

This notice concerns the processing of your personal data carried out through the hice management platform (see point 7) for the management of your employment/collaboration relationship. «(If applicable:) For the further processing connected with the relationship (e.g. payroll processing, social security and tax obligations, health surveillance), please refer to the general notice for personnel [REFERENCE/ANNEX].»

3. What data we process (categories of data)

Within the platform we process, depending on your role:

  • identification and contact data (first name, surname, company e-mail, telephone, role, job classification);
  • data relating to the organization (position in the org chart, team, managers and reports);
  • activity reporting data: hours worked and attendance (timesheet), assignment to projects and tasks;
  • expenses and the related supporting documents, data for reimbursement;
  • data relating to absences/leave/holidays «(if managed in the platform)»;
  • calendar and communications data «(if synchronization or the internal chat is enabled)»;
  • any access data and technical logs of use of the platform.

«(Include only if actually processed:) Any special categories of data (e.g. data capable of revealing health status connected with absences) are processed only where necessary and within the limits permitted by labour-law rules and Article 9 GDPR.»

4. Why we process your data (purposes)

The data are processed in order to: a) manage the employment/collaboration relationship and organize the activity; b) record and manage hours and attendance (timesheet) and report on projects; c) manage expenses and the related reimbursements; d) manage the org chart and internal authorization/approval processes; e) «(if applicable:) manage absences, leave and holidays, calendar and internal communications»; f) comply with legal obligations connected with the relationship and ensure the security of the information systems.

5. The legal basis on which we process your data

Depending on the purpose, the legal basis is:

  • the performance of the contract of employment/collaboration to which you are a party, or of pre-contractual measures (Article 6(1)(b) GDPR);
  • compliance with legal obligations to which we are subject (Article 6(1)(c) GDPR), including labour, tax, accounting and security obligations;
  • our legitimate interest (Article 6(1)(f) GDPR) in the proper organization of the activity, in internal reporting and in the security of the systems, balanced against your rights;
  • for any special categories of data, the conditions of Article 9 GDPR, in particular the obligations and rights in the field of employment law and social protection (Article 9(2)(b)).

6. To whom we disclose your data (recipients)

The data are processed by authorized staff (e.g. managers, administration, human resources) and may be disclosed to entities that provide us with instrumental services, appointed as Data Processors where the relevant conditions are met, including the provider of the platform indicated in point 7, «(add any others: e.g. labour consultant, group companies, social security/tax bodies as required by law)».

7. Management tool used and its processor

For the management we use the hice platform, provided by CONSOO S.R.L.S. (VAT/Tax Code IT13823860963, REA MI-2745733), with registered office at Piazzetta Umberto Giordano 2, 20122 Milan (MI), Italy, certified e-mail (PEC) consoo@pec.it, e-mail info@hice.ai, which acts as Data Processor on our behalf pursuant to Article 28 GDPR.

8. Transfers of data to non-EEA countries

«(Include/adapt.) The data are processed as a priority within the European Union/EEA. Any transfers to non-EEA countries take place subject to appropriate safeguards pursuant to Articles 44 et seq. GDPR (e.g. Standard Contractual Clauses or an adequacy decision). You may ask us for information at the contact details in point 1.»

9. How long we keep your data

We keep the data for the duration of the relationship and, thereafter, for as long as is necessary to comply with legal obligations (e.g. tax, social security, accounting) and to establish or defend a right in legal proceedings, in accordance with the applicable time limits set by law. «(Indicate, if defined, the specific periods: e.g. accounting/tax data [10] years; timesheet and expenses [period]; technical logs [period].)»

10. Your rights

Within the limits of the law, you have the right to access your data (Article 15), to request their rectification (Article 16) and erasure (Article 17), to obtain the restriction (Article 18) or to object to processing based on legitimate interest (Article 21), as well as to portability where applicable (Article 20). To exercise your rights you may write to us at the contact details in point 1.

11. Complaint to the supervisory authority

You have the right to lodge a complaint with the competent supervisory authority. In Italy this is the Garante per la protezione dei dati personali (the Italian Data Protection Authority, www.garanteprivacy.it). «(If you operate in another country, indicate the competent national authority.)»

12. Nature of the provision of data

The provision of the data necessary to manage the relationship is mandatory in order to perform the contract and comply with legal obligations; failure to provide it may make it impossible to manage the relationship.

Date last updated: [DATE]. Version: [VERSION].

3. Final disclaimer

3.1 The templates contained on this page (Template A and Template B) are provided by way of example and on a non-exhaustive basis. They do not take into account the specific features of the individual Customer, of the sector, of the country of operation, of the actual configuration of the Service, or of any sector-specific or national legislation in addition to the GDPR.

3.2 It is the Customer's exclusive responsibility, as Data Controller, to adapt, supplement, complete and validate the templates before providing them to its own data subjects, ensuring their compliance with all applicable legislation and their adequacy for the specific case. Review by a lawyer or a DPO is recommended.

3.3 hice (CONSOO S.R.L.S.) makes the templates available solely as operational support and does not thereby provide legal advice. hice assumes no liability for the Customer's use of the templates, for their completeness or adequacy, or for the compliance of the notices actually provided to data subjects, which remain the Customer's exclusive responsibility.

3.4 The provisions of the General Terms of Service (condizioni-generali-servizio.md), the Privacy Notice (informativa-privacy.md), the Data Processing Agreement (dpa-trattamento-dati.md) and the AI and Algorithmic Transparency Notice (informativa-ai-trasparenza.md) remain in force and are referred to for the rules governing the relationship between hice and the Customer and their respective privacy roles.

4. Completion Guide for the Customer

The following items are for the Customer, which completes them in its own templates:

Items still for the Customer (in both templates):

  1. [DATE] and [VERSION] — date and version of the Customer's notice.
  2. Choice and adaptation of the legal bases, purposes and recipients actually applicable; removal of the «alternative» blocks that are not relevant.
  3. Any national supervisory authority other than the Italian Garante.

Items specific to Template A (candidates):

  1. [24] months EU/EEA, [12] months United Kingdom, [24] months other countries — retention periods: these are hice's product defaults for the candidate retention function (mig 0159, candidate_retention_months), running from the date of entry; the Customer confirms or amends them.
  2. Inclusion or removal of point 5 (automated matching tools) depending on actual use of the feature.
  3. Inclusion or removal of the block on special categories of data.

Items specific to Template B (employees/collaborators):

  1. Specific retention periods (accounting/tax data, timesheet, expenses, logs) — point 9.
  2. Supplementation with the off-platform processing activities (payroll, social security, health surveillance) and reference to the general notice for personnel.