Privacy notice for candidates and freelancers
Last updated: October 1, 2026
Introduction and purposes
RelyBytes, as data controller, informs you under Article 13 of Regulation (EU) 2016/679 (GDPR) that your personal data will be processed for the purposes and in the ways described below.
This notice applies specifically to candidates who send their curriculum vitae or take part in selection processes for job positions, whether for employment contracts or freelance collaborations.
The processing of your data is based on the principles of lawfulness, fairness, transparency and purpose limitation. We invite you to read this notice carefully before providing us with any personal data.
Categories of personal data processed
Identification and contact data
The data you introduce yourself with and we can contact you through:
- Full name
- Email address
- The address of your LinkedIn profile or portfolio, if you give it
Data about the collaboration you are looking for
The answers you give in the application form:
- The main role you are applying for
- The type of collaboration: self-employed with a VAT number, employment or through a company
- The work mode: full remote, hybrid or on site
- The daily rate or the target gross annual salary, if you give them
- The area where you can work on site, if you choose this mode
- The message you write to us
Curriculum vitae
If you choose to attach it, the file and its content:
- Educational qualifications and certifications
- Work experience
- Skills
- Any other information you decide to include
Special category data (special categories under Article 9 GDPR)
The application form does not ask you for special category data. If you include any in your CV or in your message on your own initiative, we process them only to the extent strictly necessary for the selection; otherwise we delete them.
The only data of this kind we process on purpose is membership of protected categories (Italian Law 68/1999), and only if you tell us about it: we process it to carry out the obligations and exercise the specific rights in the field of employment law (Art. 9(2)(b) GDPR).
Purposes of processing and legal basis
Management of the selection process
Assessment of your application for current or future job positions, within 24 months of its receipt
Legal basis: performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR). Consent is not required for CVs sent on your own initiative (Art. 111-bis of the Italian Privacy Code, Legislative Decree 196/2003).
Disclosure to client companies
Sending your professional profile to client companies for positions compatible with your skills
Legal basis: performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR), because by applying you ask us to put you forward for positions at client companies
Legal and contractual obligations
Compliance with legal obligations on employment and social security
Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR)
Providing your data is optional, but without it we cannot assess your application (Art. 13(2)(e) GDPR).
Data retention period
Your personal data will be kept for the time strictly necessary to achieve the purposes for which it was collected, in line with the principles of data minimization and storage limitation:
- CV and application data
- Kept for 24 months from the date of receipt and then deleted, unless you ask us to delete them earlier
- Data of hired candidates
- Kept for the time required by legal obligations on employment, tax and social security
- Special category data (sensitive data)
- Processed only if necessary for the selection and kept with the application for the same period; otherwise deleted
Rights of the data subject
As a data subject, you have the right to exercise the following rights under the GDPR at any time:
- Access (Art. 15 GDPR)
- Obtain confirmation as to whether data concerning you exists and access its content
- Rectification (Art. 16 GDPR)
- Request the correction of inaccurate data or the completion of incomplete data
- Erasure (Art. 17 GDPR)
- Obtain the erasure of data concerning you when it is no longer necessary
- Restriction (Art. 18 GDPR)
- Request the restriction of the processing of your data in certain circumstances
- Portability (Art. 20 GDPR)
- Receive your data in a structured format and transmit it to another controller
How to exercise your rights
You can exercise your rights by sending a written request to dpo@relybytes.com, specifying your request. If we have reasonable doubts about the identity of the person making the request, we may ask you for the information needed to confirm it (Art. 12(6) GDPR). We will reply within 30 days of the request; in complex cases this period may be extended by two months, in which case we will tell you within the first 30 days, giving the reasons (Art. 12(3) GDPR).
You also have the right to lodge a complaint with a supervisory authority under Art. 77 GDPR: in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or the authority of the Member State where you habitually reside or work, or where the alleged infringement took place.
Automated decision-making
We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Every final decision about your application is always taken by qualified staff.
Data security and sharing with third parties
Security measures in place
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, under Art. 32 GDPR.
Recipients of the data
Your data may be disclosed to the following categories of recipients:
- IT service providers that process the data on our behalf as processors (Art. 28 GDPR), for email, hosting and contact management
- Client companies, limited to your professional profile, for positions compatible with your skills
- Public authorities and the company's employment and tax advisers, where the law requires it
If your data is transferred outside the European Economic Area, the transfer takes place only with the safeguards provided for in Art. 44 et seq. GDPR.
Data controller and contacts
RelyBytes S.r.l.
Registered office: Via Vetta d'Italia 23, 28041 Arona (NO), Italy
VAT number: 02687640033
Certified email (PEC): relybytessrl@pec.it
+39 371 427 3345