$ cat refer/privacy.md

Referral privacy notice

Art. 13 GDPR · applies to the referral request form

controller

Lorenzo Germano, private individual, Milan, Italy. Contact: lorenzogermano1@outlook.it. I run this referral page on my own initiative; it is not operated by or on behalf of any employer.

data

The form asks for three things: the job posting link, a few lines on why you fit, and your LinkedIn handle. Tally also processes technical data needed to run the form, such as your IP address and browser details. Only if there's a fit do I ask you, in a LinkedIn message, for your CV and the contact details the referral needs. Please leave out anything sensitive (health, religion, political views and similar) and anything a referral doesn't need, like a photo, date of birth or home address.

purpose

Only to assess whether I can refer you for the role you picked, to contact you about it, and, if there's a fit, to submit the referral. No newsletters, no marketing, no selling or sharing for any other purpose, no automated decision-making or profiling.

legal basis

Reviewing and answering a request you chose to send me: my legitimate interest in responding to it (Art. 6(1)(f) GDPR). You can object at any time and I'll delete it. Sharing anything with the hiring company: only with your explicit consent, asked on LinkedIn before I submit a referral (Art. 6(1)(a) GDPR). You can withdraw it at any time; withdrawal doesn't affect processing that already happened.

recipients

Tally BV (Belgium) hosts the form and stores submissions in the EU as my processor, under its data processing agreement. Its subprocessors are listed at tally.so/help/gdpr; transfers outside the EU, such as for email delivery, rely on appropriate safeguards like the EU standard contractual clauses.My mailbox receives a notification for each new request.LinkedIn carries our conversation and any CV you send there, under LinkedIn's own terms and privacy policy.The hiring company, only if you say yes: I submit your name, contact details, CV and the role through its referral process. From then on the company processes that data as an independent controller under its own privacy policy.

retention

I delete my copies within 6 months of your submission (form entry, notification email, any CV you sent), or sooner if you ask. The copy the company receives when you're referred follows its own retention rules.

your rights

Access, rectification, erasure, restriction, portability and objection (Arts. 15–21 GDPR), plus withdrawing consent at any time. Email lorenzogermano1@outlook.it; I reply within one month.

complaints

You can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority in the EU country where you live or work.

updated

30 September 2026