Data Controller
Yellow Tech S.R.L.
Via Carlo Boncompagni 3B, 20139 Milano
Email: info@yellowtech.it
PEC: yellowtech@pec.it
C.F. / P.IVA: 10568721210
Data Protection Officer (DPO)
Avv. Francesco Angelo Lorusso
Email: lorusso@legalelorusso.it
PEC: lorussofrancesco@milano.pecavvocati.it
Tel: +39 02 55199206
What we collect
When you send an application through the form on this site we collect:
- Contact details: your name, your email address and, if you write it, your phone number.
- Professional profiles: your LinkedIn and GitHub addresses, if you provide them. Both are optional.
- Your CV, in the PDF file you upload, with everything you chose to put in it.
- Your answers to the form's questions: availability, the level of experience you declare on the areas of the role, and any open answers.
- The language you filled the form in and the role you are applying for.
Nothing else from the form. On the site we use analytics and marketing cookies only if you accept them from the banner: they are described in the Cookie Policy.
Special category data in a CV
We do not ask for, and do not want, data in the special categories of Article 9 of the Regulation: health, trade union membership, religious or philosophical beliefs, political opinions, racial or ethnic origin, sex life and sexual orientation. No question in the form asks about any of them.
They can still appear in a CV, because you are the one writing it: membership of a protected category, association work, volunteering. We ask you not to include them unless they are necessary; if they are there, we do not use them to assess your application, unless you ask us to take them into account: for example if you belong to a protected category under Italian law (Law 68/1999) and want to be considered for the roles reserved to it. In that case we process them for that purpose only, as employment law allows (Art. 9.2.b of the Regulation). In no case do we extract them into a separate record.
Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Assessing your application for the role you answered, contacting you and running the selection process | Steps taken at your request prior to entering a contract (Art. 6.1.b) |
| Keeping your application available for similar roles that open within the retention period | The Controller's legitimate interest in not starting from scratch at every search (Art. 6.1.f) |
| Writing to you when we open roles that may interest you | Your consent, optional and withdrawable at any time (Art. 6.1.a) |
The box about future roles is optional: leaving it unticked has no effect on the application you are sending.
If you do not provide the data
Your contact details, your CV and the required answers are necessary to assess an application: without them we cannot consider it. Everything else is optional.
Who sees the data
Inside Yellow Tech the data is visible to the people who run selections and to those who lead the team of the open role, all of them authorised to process it. In our applications archive access to CVs is limited by role: whoever works on commercial enquiries cannot see them.
To work on the selection, the team may share your application and CV in the company's work tools: email, document storage and internal messaging. There they stay in spaces restricted to the people running the selection.
Outside, the data is processed by the following suppliers, appointed as data processors:
- Vercel Inc. (San Francisco, USA): hosting of the site the form runs on
- Neon Inc. (USA): the PostgreSQL database where the application and the CV are stored
- Resend Inc. (USA): sending the email that tells us internally that an application has arrived. The CV is not attached to that email
- Google (Google Workspace): company email, where that email arrives, and document storage
- Slack: the team's internal messaging
The data is not disclosed, not sold, and not used for profiling or automated decision-making: applications are assessed by people.
How long it stays
Your application and your CV are kept for 24 months from the moment you send them, and are then deleted automatically: not archived, not hidden, deleted, and the CV file with them.
Copies shared in the company work tools described above are deleted within the same period.
An application is kept beyond that only while a selection is still running, and in that case the reason is recorded. If you consented to hearing about future roles, that consent lasts until you withdraw it and in any case no longer than the same period.
Transfers outside the European Union
Some of the suppliers listed above are based in the United States or process data there, and processing may involve a transfer of data outside the European Union. Such transfers take place under the EU-US Data Privacy Framework or under Standard Contractual Clauses approved by the European Commission.
Your rights
At any time you can ask to access your data, to correct it, to have it deleted, to restrict its processing, to receive it in a machine-readable format, and you can object to processing based on legitimate interest. If you consented to hearing about future roles you can withdraw that consent whenever you want, without affecting what was done before.
To exercise them, write to info@yellowtech.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
If anything here is unclear, ask us
To exercise your rights or to ask a question about this notice, write to info@yellowtech.it. We reply within 30 days, as the GDPR requires.