Privacy Notice
Brave New Jobs Connector and Platform — pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Version 1.0 – Effective as of 1 July 2026
Introduction
Brave New Jobs S.r.l. (“BNJ”, the “Company” or the “Controller”), by means of this notice (the “Notice”), intends to provide the individual user (the “User”, the “Data Subject” or the “Candidate”) with the information required by Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter “GDPR”) in relation to the processing of personal data carried out through the free software tool made available by BNJ (the “Connector”) and through the digital platform managed by BNJ (the “Platform”).
The User is informed that, in the context of the service: (i) BNJ processes the User's personal data as an autonomous controller for the purposes of managing the Connector, the account, the Platform, and producing the Report in anonymised form; (ii) where the User authorises a Business Client to access their identifying personal data following a spontaneous application, that Business Client becomes an autonomous controller of the User's personal data for its own personnel-selection purposes, on the basis of a separate privacy notice that the Business Client is required to provide to the User. BNJ and the Business Client are therefore autonomous and independent controllers, each for its own scope of processing.
1. Data Controller
The Controller for the processing described in this Notice is:
| Company name | Brave New Jobs S.r.l. |
|---|---|
| Registered office | Via Carloforte 60, 09123 Cagliari (CA) |
| Tax Code/VAT No. | 04221210927 |
| REA Registration No. | CA - 372894 |
| Certified email (PEC) | brave.newjobs@facilepec.com |
| Privacy contact email | privacy@bravenewjobs.com |
| Website | www.bravenewjobs.com |
2. Data Protection Officer (DPO)
The Controller will, where necessary, appoint a Data Protection Officer (DPO), who can be contacted at: privacy@bravenewjobs.com
3. Categories of personal data processed
In the context of the service, BNJ processes the following categories of the User's personal data:
- Identification and contact data: first name, last name, email address, and any further contact details voluntarily provided by the User;
- Access credentials: username, password (in encrypted form), session tokens;
- Professional data (CV): the content of the curriculum vitae uploaded by the User, including educational background, professional experience, skills, languages known, and any certifications;
- Application data: positions to which the User independently decides to apply, answers to any screening questions, and application status;
- Self-curated data relating to AI interactions: only those portions of conversations with third-party artificial intelligence systems that the User, on their own initiative, selects and expressly confirms wishing to transfer to the Platform to supplement their application. Under no circumstances does the Connector transfer entire conversations with third-party AI systems in full or automatically;
- Technical and browsing data: IP address, device identifiers, system logs, and data relating to the operation of the Connector and interaction with the Platform;
- Data generated by the AI Features: structured Reports generated by the Platform on the basis of the professional data voluntarily provided by the User, in anonymised form and, upon the User's authorisation, in de-anonymised form.
The User is invited not to enter or transfer to the Platform data belonging to special categories within the meaning of Art. 9 GDPR (for example: data concerning health, political opinions, religious or philosophical beliefs, sexual orientation), nor personal data of third parties, unless strictly necessary for the purpose of the application and supported by an appropriate legal basis.
4. Sources of personal data
The personal data subject to processing are collected:
- (a) directly from the User, when installing the Connector, registering on the Platform, uploading the CV, and submitting applications;
- (b) through the Connector, exclusively for the data that the User, on their own initiative, decides to channel to the Platform, including the Self-Curated Data;
- (c) automatically, through system logs and the Platform's technical operating tools (cookies and similar technologies, covered by a dedicated cookie policy).
Pursuant to Art. 14 GDPR, where certain data reach the Company through the Connector without having been directly provided by the User on the Platform (for example, structured data resulting from the parsing of the CV uploaded to the Connector), the source of such data is the Connector itself, fed by the User's own actions.
5. Purposes of processing, legal bases and retention periods
The User's personal data are processed for the purposes indicated below, on the basis of the corresponding legal bases and within the limits of the specified retention periods.
| Purpose of processing | Legal basis | Retention period |
|---|---|---|
| Creation and management of the User's account; provision of the Connector and Platform service; technical support | Performance of a contract to which the Data Subject is party (Art. 6(1)(b) GDPR) | Duration of the contractual relationship and for a further 12 months following termination, for the Controller's protection purposes |
| Transmission of the Report (anonymised version) to the Business Client for the specific position to which the User has applied | Performance of pre-contractual measures at the Data Subject's request (Art. 6(1)(b) GDPR) | 12 months from transmission of the Report, unless the User requests otherwise |
| Processing of Self-Curated Data relating to interactions with third-party AI systems, for the purpose of supplementing the application | Specific consent of the Data Subject (Art. 6(1)(a) GDPR), revocable at any time | 12 months from transmission, unless consent is revoked earlier |
| Transmission of identifying personal data to the Business Client, following the specific authorisation granted by the User | Specific consent of the Data Subject (Art. 6(1)(a) GDPR), revocable at any time | The time necessary to complete the transfer; thereafter, the Business Client's autonomous controllership entails a separate regime |
| Compliance with legal obligations incumbent on the Controller (for example, retention of accounting or security documentation) | Legal obligation (Art. 6(1)(c) GDPR) | Periods set by applicable law (typically 10 years for accounting documentation) |
| Exercise or defence of a right in legal proceedings | Legitimate interest of the Controller (Art. 6(1)(f) GDPR) | The time necessary to exercise or defend the right, until the final decision becomes res judicata |
| Improvement of services, statistical and functional analysis, using aggregated and anonymous data | Legitimate interest of the Controller (Art. 6(1)(f) GDPR) | Anonymous data: no time limit |
| IT security, fraud prevention and misuse prevention on the Platform | Legitimate interest of the Controller (Art. 6(1)(f) GDPR) | Duration of the relationship and for a further 24 months |
| Any sending of service or promotional communications (newsletters, updates) | Specific consent (Art. 6(1)(a) GDPR), revocable at any time | Until consent is revoked |
The legal bases founded on consent (Art. 6(1)(a) GDPR) presuppose that the User has given free, specific, informed and unambiguous consent, collected through dedicated, distinct flags for each purpose when installing the Connector or carrying out the relevant processing. Consent may be revoked at any time, without prejudice to the lawfulness of processing based on consent before its revocation.
6. AI Features and automated decision-making
The Platform incorporates artificial-intelligence-based features that support the User's process and any analysis carried out by the Business Client. On the basis of the professional data provided by the User, these features produce a structured Report that the Business Client for the position concerned may consult to support its own independent assessment.
BNJ does not take decisions producing legal effects or similarly significant effects on the User on the basis of processing that is solely automated within the meaning of Art. 22 GDPR. Decisions concerning the User's application (for example: access to identifying personal data, contact, interview, possible hiring) are taken exclusively and independently by the Business Client, through qualified human intervention.
The User has the right to receive, upon request, meaningful information about the logic used by the AI Features and the envisaged consequences of the processing, pursuant to Art. 13(2)(f) and Art. 15(1)(h) GDPR, as well as Articles 26(11) and 86 of Regulation (EU) 2024/1689 (AI Act). Such requests may be addressed to BNJ at the contact details indicated and/or, to the extent within the Business Client's competence, directly to the Business Client.
Where the User believes they have been adversely affected by a decision taken by the Business Client on the basis of automated processing of their data, the User may exercise against the Business Client the rights recognised by applicable law, including those under Art. 22 GDPR (in particular: obtaining human intervention, expressing their own point of view, and contesting the decision).
7. Nature of the data provided
The provision of identification and contact data, credentials, professional data (CV), and application data is necessary to allow the User to use the Connector and the Platform. Any refusal to provide such data results in the impossibility of accessing the service.
The provision of Self-Curated Data relating to interactions with third-party AI systems, the authorisation to transmit identifying personal data to the Business Client, and data for marketing purposes are optional. Failure to provide such data does not affect access to the basic service, but may limit certain advanced features (for example: the Business Client will not be able to learn the Candidate's identity in the absence of the Candidate's authorisation).
8. Recipients and categories of recipients of the data
The User's personal data may be disclosed to the following categories of recipients:
- Business Clients: companies and duly authorised labour-market intermediaries to whom the User has independently decided to send their spontaneous application. The Report in anonymised form is transmitted to the Business Client for the specific position; identifying personal data are transmitted only following the User's specific authorisation. With respect to such data, the Business Client acts as an autonomous controller within the meaning of Art. 4(7) GDPR, and processes the User's personal data on the basis of its own separate privacy notice, which it is required to provide to the User before processing begins;
- Technical service providers: parties that provide BNJ with hosting, cloud, technical maintenance, Connector management, support, IT security, anti-fraud, analytics and email services, appointed as processors within the meaning of Art. 28 GDPR;
- Consultants and professionals: legal, tax and accounting consultants, auditing firms, and parties carrying out control functions, appointed as processors where the relevant conditions apply;
- Competent authorities: Public and judicial authorities, in compliance with legal obligations or in execution of lawful requests.
BNJ does not sell or transfer the User's personal data to third parties for third-party marketing purposes without the User's specific consent.
9. Transfers of data outside the European Economic Area
The User's personal data are, as a rule, processed within the European Economic Area. Where certain technical service providers are established in third countries outside the EEA, the Controller adopts the appropriate safeguards provided for by Articles 44 et seq. GDPR, including: (i) adequacy decisions of the European Commission; (ii) standard contractual clauses adopted by the European Commission; (iii) supplementary technical and organisational measures where necessary.
The User may request information on the specific safeguards adopted, and obtain a copy thereof, by contacting the Controller at the contact details indicated.
10. Processing methods and security measures
Personal data are processed by IT and telematic tools, with appropriate technical and organisational measures aimed at ensuring data security, in accordance with Articles 25 and 32 GDPR, and in such a way as to minimise the risks of destruction, loss, unauthorised access and processing not in keeping with the purposes of collection.
In particular, the Controller adopts technical measures such as encryption of data in transit and at rest (where applicable), access control, system monitoring, and retention of security logs, in addition to organisational measures such as staff training, the designation of persons authorised to process data, and the execution of accountability agreements with suppliers.
11. Rights of the Data Subject
The User, as a Data Subject, may exercise at any time the rights recognised by Articles 15 to 22 GDPR, and in particular:
- Right of access (Art. 15 GDPR): to obtain confirmation that processing is taking place, and to receive a copy of their own personal data;
- Right to rectification (Art. 16 GDPR): to obtain the correction or completion of inaccurate or incomplete data;
- Right to erasure (the “right to be forgotten”, Art. 17 GDPR): to obtain the erasure of their own personal data, in the cases provided for by law;
- Right to restriction of processing (Art. 18 GDPR): to obtain restriction of processing, in the cases provided for by law;
- Right to data portability (Art. 20 GDPR): to receive their own personal data in a structured, commonly used and machine-readable format, and to transmit them to another controller;
- Right to object (Art. 21 GDPR): to object, on grounds relating to their particular situation, to the processing of their data based on legitimate interest;
- Rights relating to automated decision-making (Art. 22 GDPR): to obtain human intervention, express their own point of view, and contest the decision (to be exercised, where the decision is taken by the Business Client, directly against the latter);
- Right to withdraw consent (Art. 7 GDPR): to withdraw, at any time, consent given, without affecting the lawfulness of processing carried out before the withdrawal;
- Right to lodge a complaint (Art. 77 GDPR): to lodge a complaint with the competent Supervisory Authority, in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it).
12. How to exercise these rights
The User may exercise the rights listed above by sending a written request to the following contact details:
| privacy@bravenewjobs.com | |
| Certified email (PEC) | brave.newjobs@facilepec.com |
| DPO | privacy@bravenewjobs.com |
| Postal address | Brave New Jobs S.r.l. – viale La Plaia 15, 09123 Cagliari (CA) |
The Controller responds to the Data Subject's request without undue delay and in any event within one month of receipt, in accordance with Art. 12(3) GDPR. This period may be extended by two months, where necessary, taking into account the complexity and number of requests.
The exercise of these rights is generally free of charge, except in cases of manifestly unfounded or excessive requests, where the Controller may charge a reasonable fee or refuse to act on the request, pursuant to Art. 12(5) GDPR.
13. Transfer to the Business Client and autonomous controllership
The User's attention is drawn to the following point, which is of essential importance. Where the User, after submitting their spontaneous application and after the Business Client has expressed interest in learning the identifying personal data, grants specific authorisation to transfer their personal data to the Business Client, the Business Client becomes an autonomous controller of the User's personal data within the meaning of Art. 4(7) GDPR.
From that moment, the processing of the User's personal data by the Business Client is governed exclusively by a separate privacy notice, which the Business Client is required to provide to the User before processing begins, pursuant to Articles 13 and 14 GDPR. That separate notice sets out: the autonomous controller (the Business Client), the data protection officer (where appointed), the purposes of processing pursued by the Business Client, the legal bases, the retention periods applied by the Business Client, the recipients, any transfers outside the EU, and how to exercise these rights.
BNJ and the Business Client do not act as joint controllers within the meaning of Art. 26 GDPR, but as autonomous and independent controllers, each with its own scope of processing, purposes and responsibilities.
The User may, at any time, withdraw the authorisation to transfer for the future, by contacting BNJ at the contact details indicated. Withdrawal does not affect processing already carried out and does not affect personal data already acquired by the Business Client, with respect to which the User may exercise their rights directly against the Business Client, as an autonomous controller.
14. Cookies and similar technologies
The use of cookies and similar technologies on the Platform is governed by a dedicated cookie policy, accessible on the website www.bravenewjobs.com and on the Platform itself, which the User is invited to consult.
15. Changes to this Notice
The Controller reserves the right to update this Notice to reflect regulatory changes, developments in the service, or the evolution of processing activities. Changes are notified to the User with at least 15 (fifteen) days' notice before they take effect, by publication on the Platform and/or communication to the User's email address. The User is invited to periodically consult the current version of this Notice.
16. Competent court
Disputes relating to this Notice and to the processing of personal data governed by it are subject to the jurisdiction of the court of the place where the User resides or is domiciled, if the User qualifies as a consumer within the meaning of Legislative Decree No. 206/2005. In all other cases, the Court of Cagliari has exclusive jurisdiction, without prejudice to the competence of the Garante per la protezione dei dati personali for matters within its remit.
Last updated: 1 July 2026
Brave New Jobs S.r.l. – The Data Controller