Privacy notice for candidates

What we do with your data when you send us a CV or talk to us. The law does not require your consent for us to show your profile to a client; we ask for it anyway.

This is an English translation provided for convenience. In case of any difference, the Italian version prevails.

Who processes your data

HR Strategy S.r.l., trading under the BravoTime brand, with registered office at Via dell'Artigianato 14, 12038 Savigliano (CN), VAT number and tax code 04230450043, registered with the Cuneo Companies Register (Registro delle Imprese), REA CN-345537, as data controller. Contact details: info@bravotime.it, PEC hrstrategy@legalmail.it. We have not appointed a data protection officer (DPO).

We process your data as controller, not on behalf of a client: the decisions on how to keep it and who to show it to are ours, and we are accountable for them. When we pass your profile to a company, that company in turn becomes an independent controller for what it does with it: from that point on it is accountable for its own processing, and we forward to it any requests that concern it.

What data we process

Data you give us. CV, contact details, professional and educational experience, technical skills, rate, availability, and what you tell us when you talk to us.

Data we collect during the process. The outcome of the identity check, the language tested at interview with the level assessed, the interview notes, the agreed rate.

Data we find on a professional network. If we contact you on our own initiative, we use only data from networks of a professional nature, and only if it is relevant to the work we are writing to you about. The fact that a profile is public does not in itself authorise us to process it: we tell you about it from our first message, before the selection begins, and if nothing comes of it we delete that data.

We do not keep the CV as a document. When you upload a file, the platform extracts your skills profile from it and the document is then deleted. What remains is the structured profile, which you can see and correct.

We do not ask for, and we ask you not to send us, data on political, religious or trade union opinions, health, sex life, ethnic origin or membership of protected categories. If a CV contains any, we do not use it. Art. 10 of Legislative Decree 276/2003 prohibits employment agencies from investigating personal opinions and from any discriminatory processing, and Art. 8 of the Workers' Statute (Statuto dei lavoratori) says the same for employers.

There are only two exceptions, and they are narrow. We process a special category of data only if it is strictly necessary for the employment or working relationship under discussion — for example, membership of a protected category when the position is reserved for that category (Art. 9(2)(b) GDPR). We process data relating to criminal records only in the cases provided for by Art. 2-octies of the Italian Privacy Code (Codice privacy), such as the criminal record certificate required by Art. 2 of Legislative Decree 39/2014 for people who work in direct and regular contact with minors.

Why we process it, and on what legal basis

Assessing your application, building your profile, proposing you to a client, managing the assignment — Art. 6(1)(b) GDPR: pre-contractual measures taken at your request and performance of the contract. This is the main legal basis for our search and selection activity.

Keeping your profile available for later searches — Art. 6(1)(b), because it is part of the service we offer you: we verify you once and the result stays yours. You can object at any time, and if you do, we stop.

Passing to a client information gathered from a previous employer of yours — your explicit consent, which we ask for each time. We do not actively carry out reference checks unless you ask us to.

Recording or transcribing an interview — your consent, obtained before the recording starts. You can refuse, and your application is not affected in any way.

Legal, accounting, tax and supervisory obligations — Art. 6(1)(c).

Something we do by choice, not because the law requires it

The Code of Conduct for employment agencies approved by the Italian Data Protection Authority (Garante per la protezione dei dati personali) establishes that your consent is not required to disclose the data in a CV to a client: the contractual basis is enough.

We ask for it anyway. No profile goes to a company without your agreement for that client and that position. This is a commitment we make to you, and it stands even if one day you decide to stop giving us that agreement: in that case we simply do not propose you, and the rest of the relationship does not change.

How long

Forty-eight months from the last activity concerning you — an interview, a profile update, an application, a completed assignment. This is the maximum period set by the Code of Conduct for employment agencies, and each new activity restarts the count.

Before the period ends, we write to ask whether you want to stay: if you do not reply, the profile is deleted.

The exception is documents that the law requires us to keep for longer — contracts, invoices and tax records — for the period set by the rules that apply to them.

You can ask for erasure at any time, even while a search is in progress, and we carry it out.

Who receives it

The clients for which you have given your agreement, limited to the data needed to assess that application. The client is an independent controller, not acting on our behalf.

The suppliers we need in order to work, appointed as data processors under Art. 28 GDPR:

• Google (Google Workspace) — email and office tools;
• Manatal — the system in which we manage applications;
• Hetzner Online GmbH (Germany) — the servers on which BravoFinder runs, located in Germany: this data stays in the European Union;
• Netlify, Inc. (United States) — site hosting and contact form;
• our accountant and labour consultant (consulente del lavoro), for the part that concerns them.

Transfers outside the European Economic Area. Some of these suppliers process data in the United States:

• Google and Netlify participate in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission in its decision of 10 July 2023, and their data processing agreements also include the standard contractual clauses approved by the Commission;
• Manatal stores data in the United States, on Amazon Web Services servers; the transfer takes place on the basis of the standard contractual clauses approved by the European Commission.

We do not transfer profiles to third parties, we do not sell them, we do not exchange them, and we do not use them for commercial purposes. We never disseminate data — that is, make it available to unspecified parties.

Automated decisions

No decision about you is made by a machine.

The platform sorts, filters and compares profiles, and this helps you appear in relevant searches. But the decision to propose you to a client, not to propose you, or to turn down an application is always made by a person who looks at the whole profile. We do not assign overall scores and we do not rank people: we compare differences, and the assessment is made by the person reading.

Even outside the cases covered by Art. 22 GDPR, if an outcome does not convince you, you can ask us to review it, give us your view and contest it: we respond to all three.

Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time (Arts. 15-22 GDPR). Withdrawal does not affect what we lawfully did before.

Just write to info@bravotime.it. We reply within one month, and if the request is complex we tell you within that month, explaining why more time is needed.

If a request concerns data we have already passed to a client, we forward it to the client with what it needs to act on it.

You can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it) or bring proceedings before the judicial authorities.

Providing your data is optional

Giving us your data is your choice. Without it, however, we cannot assess your application, and that is the only consequence.

Updates

Every substantial change to this page is dated, and the previous version remains available on request. Version of 1 October 2026.