Candidate Privacy Notice
Candidate Privacy Notice
Last updated: 29/09/2026
This notice explains how LANIKAI S.r.l. (“MC2 Saint Barth”, “we”) processes your personal data when you apply for a job or send a spontaneous application through the “Work With Us” section of our website, in accordance with Article 13 of Regulation (EU) 2016/679 (“GDPR”).
1. Data controller
LANIKAI S.r.l., trading as “MC2 Saint Barth”, with registered office at Via Francesco Nullo 1, 24128 Bergamo (BG), Italy — VAT number / Tax Code 03294840164, Business Register (REA) No. BG-366093.
Contact for privacy matters: careers@mc2saintbarth.com
2. What data we collect
• Contact details: email address and, depending on the application form, first name, last name, phone number, LinkedIn profile.
• Application content: your CV, portfolio, cover letter or other attachments, and your answers to the questions in the application form (e.g. availability, location preferences, experience, departments and roles of interest).
• Technical data: the language of the website you used and the date and time of your application and consent. To protect the form against automated abuse we use Cloudflare Turnstile, which processes technical information about your browser and IP address.
Please do not include in your CV or attachments special categories of personal data (e.g. health data, religious or political beliefs) unless strictly necessary or required by law — for example, to document membership of a protected category under Italian Law No. 68/1999 on the employment of persons with disabilities. Where you do provide such data for this reason, we process it only to the extent necessary to comply with obligations and exercise specific rights in the field of employment and social security law, in accordance with Article 9(2)(b) GDPR and Article 2-septies of Italian Legislative Decree No. 196/2003.
3. Purposes and legal basis
|
Purpose |
Legal basis |
|
Evaluating your application for the specific position you applied for, contacting you and managing the selection process. |
Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR). |
|
Evaluating spontaneous applications you submit for current or future open positions. |
Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR). |
|
Protecting the website and the application form against spam, fraud and abuse (Cloudflare Turnstile). |
Our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR). |
|
Complying with legal obligations applicable to the recruitment process. |
Legal obligation (Art. 6(1)(c) GDPR). |
|
Establishing, exercising or defending legal claims. |
Our legitimate interest in protecting our rights (Art. 6(1)(f) GDPR). |
Providing your data is necessary to evaluate your application: fields marked as mandatory are required to submit the form.
4. How long we keep your data
Your application and attachments are automatically and permanently deleted 12 months after you submit them, unless a longer retention is needed because an employment relationship starts (in which case a separate employee privacy notice applies) or to establish, exercise or defend a legal claim. You can ask us to delete your data earlier at any time (see Section 7).
5. Who can access your data
• Our Human Resources team and, where relevant, the managers involved in the selection for the position concerned, all bound by confidentiality obligations.
• Service providers acting as data processors under Art. 28 GDPR:
• Railway Corporation — hosting of the application database and file storage, located in the European Union (Amsterdam, the Netherlands);
• Cloudflare, Inc. — anti-spam and security protection of the form (Cloudflare Turnstile);
• Shopify International Limited — provides the e-commerce platform on which our website is built, including the page on which the application form is displayed.
We do not sell your data, do not use it for marketing purposes, and do not disclose it to any third party other than those listed above.
6. Transfers outside the EU
Your application data and attachments are stored within the European Union. Cloudflare, Inc. and Railway Corporation are companies established in the United States; in connection with the services described above, limited technical or support data may therefore be processed outside the European Economic Area. Any such transfer is based on the European Commission's Standard Contractual Clauses and/or, where applicable, the relevant company's certification under the EU–U.S. Data Privacy Framework, together with any additional safeguards required by applicable law.
7. Your rights
You have the right to: access your data (Art. 15 GDPR); request rectification of inaccurate data (Art. 16 GDPR); request erasure of your data (Art. 17 GDPR); request restriction of processing (Art. 18 GDPR); receive your data in a structured, commonly used and machine-readable format (Art. 20 GDPR); and object to processing carried out on the basis of our legitimate interest (Art. 21 GDPR).
To exercise these rights, write to careers@mc2saintbarth.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), or with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement, if different.
8. Automated decisions
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).