Dear User of BE YOU XP (hereinafter, the 'App'),
With the present document, BE YOU S.r.l., as owner of the App, wishes to provide you with some information regarding the methods, purposes and security of the processing of personal data (hereinafter, the 'Processing') carried out through the App and about any activity and web channel related to the App.
For further information concerning the functioning of the App and the rights and obligations of the App Users, please refer to the Terms and Conditions of the App.
Anyone who uses the relevant software via mobile app and/or other web channels is to be considered a User of the App.
Note: this Information is provided pursuant to art. 13 of Regulation (EU) 2016/679 for the protection of personal data (hereinafter, 'GDPR'), including subsequent amendments and additions, and pursuant to Legislative Decree 196/2003, as amended and supplemented by Legislative Decree 101/2018.
Who is the Data Processor?
The Data Processor is BE YOU S.r.l.. The Data Processor is the subject in charge of processing the data collected by BE YOU XP and ensuring the proper functioning of the App and its modules.
Who is the Data Controller?
The Data Controller is the company that makes the App available to its employees and collaborators (hereinafter, the 'Data Controller'). The Data Controller is the subject who determines the purposes and means of data Processing.
What is the purpose of Data Processing? In other words, why are the data processed?
The data are processed in order to allow the following activities to be carried out:
For the purposes of the module named MyVoice, the distribution of questionnaires (so-called survey) relating to: engagement of workers with respect to the company; organization of activities and initiatives within the company; management of company teams; feedback regarding company initiatives; company welfare programs; on boarding of workers with respect to the company’s environment and initiatives.
It is understood that:
the questionnaires, according to the single case, are anonymous or nominative;
it is User who decide, on a voluntary basis, whether or not to take part in the surveys.
it is the User who decide whether or not to disclose his/her participation in a survey.
the system of permissions and data visibility levels set up for the App respects the principle of minimization and proportionality of data Processing;
the data in clear text are processed in this form for the duration of the initiative to which they refer; at termination, they are anonymized or deleted;
For the purposes of the module named Rewards, the implementation of People Management programs (such as, by way of example, Reward & Recognition projects) carried out as part of the company's initiatives and aimed at developing the individual skills of employees and the growth of the company.
For the purposes of the module named Growth, the implementation of challenges assigned, within the company's initiatives, to workers and collaborators by their own managers aimed at improving their skills and working competences. It is understood that the participation in the challenges by employees and workers is not mandatory.
For the purposes of the module named MyProfile, the ability to report, for each user, the skills and assignments that he/she has within the company, the photo (optional), first name, last name, company email and job position.
In the case of an upload, by the User, of a profile photo, the same can be used by the Data Controller for purposes of participation in internal company initiatives.
For more information, please also refer to the Terms and Conditions of the App.
What data are processed through the App?
User's personal data: first name, last name, profile picture (optional), job position, company e-mail address.
These data are already in the possession of the Data Controller, who is also the User's employer (or a contracting party of a collaboration relationships); for this reason, it is possible that the User may find his/her data already inserted in the App, when he/she will access his/her personal section.
Behavioral data regarding the use of the App and interactions through it.
Such data originate from the User's use of the App (by way of example but not limited to: interactions generated, pages visited, functions used).
In any case, by giving his/her consent to what is described in the present Privacy Policy, the User accepts that his/her data, both personal and behavioral, may be used by the Data Controller for the purposes set out in this document (including what is described in the section entitled "What is the purpose of the Data Processing? In other words, why are the data processed?" and, in general, according to the terms and conditions contained in the present document).
All personal data will be properly encrypted and made available, in the forms and according to the limitations described and due, only to the App Users, to the company's HR Department and to company team managers.
What does the Data Processing consist of? In other words, how are data processed through the App?
The processing may be carried out either through IT systems and automated processes, or manually.
In order to achieve the purposes described above, the data will be subjected to the following activities, which constitute the Processing:
collection, recording, organization, structuring, storage, consultation, communication through transmission, comparison.
Specifically, the Processing also envisages that these data will be elaborated (organized, structured, compared) by means of classification and statistical models.
The collection, registration and consultation are carried out through the App.
The storage is carried out through an IT infrastructure.
The communication by means of transmission is carried out starting from the infrastructure or, in general, from the information system available to the subjects who, in line with the provisions of this Privacy Policy, perform the Processing.
Each activity related to the Processing is carried out according to appropriate security measures, specifically identified according to the single case at issue and in line with regulatory provisions and market standards.
Data are processed as outlined in detail in the present document. It should be noted that the Processing takes place during the course of the initiative to which the data refer, in order to allow its implementation, and even afterwards, for analysis purposes. The data are deleted or anonymized when the User is removed from the App upon request of cancellation or due to the interruption of the employment relationship or collaboration with the Data Controller.
With regard to the MyVoice module, the data are processed in clear text by the HR company team in order to improve the engagement of workers within the company, the organization of activities and initiatives within the company, the management of company teams, to have feedbacks concerning company initiatives, to implement company welfare programs and on boarding of workers with respect to the company's environment and initiatives.
With regard to the Rewards module, the data are processed in clear text by the HR company team in order to be able to follow and manage the projects listed in the purposes, in particular with regard to the awarding of company prizes and awards and retention programs. The data are then also processed, for statistical purposes, in pseudonymized form, by third parties who process them through statistical and classification models with the purpose of correlating the use of the App with corporate engagement measures and to obtain information to be used by the corporate HR team, for the programs set out in the purposes. This information does not contain direct references to the parties to whom the original data refers. Therefore, these third parties do not have access to the data in clear text. The data are anonymized/pseudonymized during processing and incorporated into the abovementioned models. Such processed information is then used by the Data Controller for the initiatives described in the purposes.
With regard to the Growth module, the data collected through the User's participation in the challenges (such as, by way of example, the answers to the questions asked at each "check-point" or the final comments on their impressions of the challenges), will not be processed in clear text by the HR team, which will have access only to aggregated data. The manager will be able to see the aggregated data regarding his team (for example, he will see the average of the assessments that the Users who have participated have given to the challenge).
With regard to the MyProfile module, the data collected through the filling in of the required fields such as name, surname and email address, will be processed in clear text by the HR team in order to open an account within the App for the worker and will be visible to all users of the App. All other data entered (such as, for example, profile image, skills and assignments in the company, awards received that can be viewed as "badges", scores) will be visible to all users of the platform only and exclusively if the user decides to disclose them.
Who performs the Data Processing?
The Data Processing is carried out by the Data Controller, who avails himself, within his own organization, of persons in charge of the Processing, who carry out the activities according to the directives given to them by the Data Controller.
The Processing is also carried out, on behalf of the Data Controller, by one or more Data Processors, who, in accordance with the provisions of art. 28 of GDPR, perform the related activities under a contract of appointment in which is detailed the scope of the Processing performed by them.
By way of example, the subjects in charge of the management and maintenance of the IT infrastructure, the anonymisation and/or deletion of data, the development and updating of the App are appointed as Data Processors.
The person in charge of the management and maintenance of the App and the IT infrastructure, as well as of the development and updating of the same, has access to the Data only in an anonymized form.
With regard to the User, the subject of reference for the exercise of rights and the lodging of complaints is the Data Controller, who may be contacted by certified or ordinary e-mail at the addresses provided.
What are the User's rights with regard to Data Processing?
The User has the right to access data concerning him/her at any time, in accordance with Articles 15-22 GDPR.
In particular, he or she may request the rectification, cancellation, restriction of data processing in the cases provided for in Article 18 of the GDPR, the withdrawal of consent, as well as lodge a complaint with the competent supervisory authority (Personal Data Protection Guarantor) pursuant to Article 77 of the GDPR.
The User may exercise his/her right at any time, including in particular:
ask the Data Controller for access to his/her data and/or their correction or deletion and, where permitted, the portability of the same;
obtain the limitation of or oppose the Processing of data concerning him/her;
lodge complaints to the Guarantor Authority for the protection of personal data.
Where can one find more information on the policies of the Data Controller regarding the protection of confidentiality (privacy) and data security (data protection)?
Any information, also with regard to security measures and appointed Data Processors, may be requested by writing to the Data Controller at the addresses provided.
***
I give my consent to the processing of my personal data for the purposes and in the manner described in the above Privacy Policy.
[√] THE USER
***
TERMS AND CONDITIONS OF USE OF THE APP BE YOU XP (hereinafter, the App)
1. – What is the App for.
The App, thanks to its functionalities, available in the different modules (hereinafter, the 'Modules') of which it consists (namely, the Modules called My Voice, Rewards, Growth and MyProfile), allows the users to benefit from what is described as follows.
MyVoice: consists in the distribution of questionnaires (so-called survey) concerning workers' engagement with the company; organization of activities and initiatives within the company; management of company teams; feedbacks concerning company initiatives; company welfare programs; on boarding of workers with respect to reality and company initiatives.
It is understood that:
The questionnaires, depending on the single case, are anonymous or nominative.
It is the workers who decide, on a voluntary basis, whether or not to take part in the surveys.
It is the workers who decide whether or not to disclose their participation in a survey.
In any case, the principle of minimization and proportionality of data processing remains respected.
Clear text data are processed in this form for the duration of the initiative to which they refer; at termination, they are anonymized or deleted.
This module allows the worker to express his/her own ideas and make hisher own suggestions also through the "suggested ideas" function. Similarly to what happens for surveys, also for suggested ideas, the worker is free to decide whether or not to suggest them and whether or not to publish them.
Rewards: allows the users to take part in people management programs. These programs allow the participants to express and receive scores and mentions from other participants and may consist of award programs that provide for the awarding of prizes to the most voted employees. It is up to the user to decide whether or not to publish the rewards received as well as their own scores, which are also calculated on the basis of the rewards received.
Growth: allows the users to improve their skills and competences through participation in specific "challenges". These challenges can be requested directly by the user to his manager, if the user wants to improve a specific competence, or they can be assigned by the manager to the team managed by him or to an single individual. These challenges include a path of a few weeks filled with some "check-points" in which the user will be asked to answer three questions, which will always be repeated unchanged, to evaluate the usefulness and efficiency of the challenge at issue; the only check-point that will differ from the model described so far is the final one, where in addition to the usual three questions, the user will be given the possibility to provide some comments. The conclusion of a challenge may or may not be made public according to the user's discretion. The participation in the challenge is left to the choice of the worker or collaborator.
MyProfile: consists of the section in which are reported, for each user, their skills and assignments in the company, the awards received displayed in the form of "badge"; photo (optional); name, surname, company email and job position.
It is the user who decides what information to show to other users, the only information visible to all, regardless of a specific choice of the user, are the first and last name of the user.
With respect to all the modules hereby described, any form of discrimination and disparity is excluded and equal visibility to all subjects is guaranteed.
2. - Who uses the App.
List of persons authorized to use the App:
The user (hereinafter, the 'User' and/or the 'Users'), i.e. any person who, by virtue of agreements between his/her employer and BID Company S.r.l., as owner of the App (hereinafter, the 'Owner of the App'), is able to benefit from the services available on the App.
The Human Resources department (hereinafter, the 'HR Department') and the department to which the user belongs within the employer company of the user, who view the information and data resulting from the use of the App for the purposes of conducting and achieving the purposes indicated in paragraph 1 in correspondence with the description of each of the Modules.
The manager (hereinafter, the Manager and / or Managers) of the department to which the user belongs within the employer company of the user, who views the information and data resulting from the use of the App for the sole purpose of carrying out the purposes indicated in paragraph 1 in correspondence with the description of each of the Modules. Specifically, the Manager is not able to see the data concerning the surveys while he is able to present the challenges provided by the Growth module and to see, in the form of aggregated data relating to the entire team he manages, the reactions that his team has expressed in relation to the effectiveness and appropriateness of the proposed challenge.
The Owner of the App, as the entity that manages its maintenance.
With regard to the Rewards module, the third parties that process the data obtained from the use of the App by users, for statistical purposes and in pseudonymized or anonymized form, using statistical and classification models, obtaining information that is used by the company's HR teams for the purpose of the above-mentioned people management programs. These information do not contain direct references to the interested subjects to whom the original data refer. Therefore, such third parties do not have access to the clear text data.
3. – How does the App work.
The User accepts the privacy policy and the present terms and conditions (hereinafter also 'T&C').
The User installs the App on her/his mobile device, or accesses it from a web interface. The User enters her/his access credentials, provided by her/his HR Department and for which she/him is responsible. The password provided by the HR Department is subject to reset by the User after the first access.
The User will then have access to his personal page where he/she will find his/her first name, last name, company email and job position, pre-entered by the HR Department.
The User may also upload his/her profile picture at his/her own discretion.
The User may take part in and benefit from what is described in point 1 in correspondence with the description of each of the Modules (for detailed information, please refer to the descriptions provided through the App and/or any information supports transmitted to users by the respective employer companies).
The activity carried out by the Users (i.e., participation and use of what described in point 1) will be visible: to the User himself within his own personal page, exclusively in relation to his own activity; to the persons in charge of company teams, exclusively in relation to the contents of the App, deriving from the functionalities indicated in point 1 and pertaining to the specific team; to the HR Department, for the purposes of taking care of the organizational performance connected to the initiatives object of the Modules.
The interactions between users are visible anonymously both to the HR department of the company and to the third parties described above (who use only pseudonymized or anonymous information to perform statistical analysis in delegated form).
4. – Rules of conduct. Supervision of the App.
The Users, company team managers, HR departments and third parties listed above commit themselves to use the App exclusively for the purposes set forth in the present T&Cs.
The App Owner retains the right to contact and warn, directly and/or through its appointees, anyone who makes an incorrect or improper use of the platform, acting either on its own initiative or following up any reports from other Users. The same right belongs, with respect to Users and company team managers, to the HR Department of reference.
5. - Amendments to the T&C and/or the privacy policy.
The Owner of the App retains the right to amend the present T&C. In the event that these terms and conditions or the privacy policy concerning the App should be amended, the user will be informed through the web or mobile application, in a suitable form allowing him/her to have access to the changes introduced and to be able - mandatory, in order to continue to use the App - to accept them.
6. - Technical functioning of the platform.
The Owner of the App undertakes to promptly resolve any malfunctions and inconveniences attributable to him that may occur on the App. In no case the App Owner should be considered liable for network failures or inefficiencies attributable exclusively to suppliers.
7. - Jurisdiction.
For any dispute arising from the present T&C, the Court of Milan shall have exclusive jurisdiction.