Privacy notice for recruitment candidates
According to Section 13 of EU Regulation no. 679/2016, concerning the protection of individuals with regard to the processing of personal data, Reply S.p.A., Reply AG, Reply LTD (hereinafter, “Reply”), hereby provides you with the Privacy notice regarding the processing of your personal data.
Reply together with one or more Reply group companies are the Joint Controllers of this processing activity, as specified by Art. 26 of the GDPR Process. You may require details on Reply group companies contacting Reply as specified hereinafter.
We may obtain your personal data either directly from you or from third parties for recruitment purposes. Such third parties may include recruitment agencies, job boards and publicly available websites such as Linked-In, as well as specialist companies that facilitate the entrance of recent graduates into the working life. The data we collect may include your contact details, employment and education history, skills and professional qualifications, as well as records of any interactions with us including interviews and tests.
1. Purpose and processing activity. Legal basis
Your data are stored and processed solely for the following purposes:
a) carry out the necessary evaluations in order to possibly establish a job or contract relationship with one of the companies in the Reply group. Legal basis for the processing: execution of pre-contractual activities.
b) following a successful evaluation, arrange any documentation needed to establish the job or contract relationship, such as passport, work permit, driving licence, etc. Legal basis for the processing: execution of pre-contractual activities.
c) comply with specific obligations required by law or other binding regulations (e.g. fiscal legislation, social security and social protection law, health and safety at work, protection of health, public order and public security law). Legal basis for the processing: legal obligations.
To achieve the abovementioned purposes, it may be necessary to collect and process data defined as “particular” by GDPR art. 9 comma 2.b. In particular, this may include information about health status and disability, subject to any relevant employment legislation.
2. Provision of data
If you are unwilling to provide sufficient data to support the recruitment and evaluation process, we shall be unable to consider you for setting up the job or contract relationship.
3. Method of processing activity. Data retention period
Your data are stored electronically and will be subject to strict information security measures to protect your privacy. Your data will only be accessed by those directly involved in the evaluation and recruitment process.
If you subsequently join Reply, as an employee or as a freelance, you will be given a separate Privacy Notice to cover our storage and use of your personal data during your employment.
Otherwise, your data will be held for up to three years from the most recent update unless you specifically request deletion.
4. Data Recipients
The personal data collected to achieve the purposes indicated in section 1, could be used by any of the Reply companies as Joint Controller of the processing activity according to art. 26 GDPR.
Within the organization of each Joint Controller, personal data will be processed by subjects specifically appointed and interested to the applicant’s profile and that intend to conduct an evaluation of the applicant, or by all subjects to whom the communication is due in base of specific law obligations.
In some cases, we may share an anonymized profile with a potential Reply client as part of your evaluation.
The Joint Controllers may use external companies to provide services for the achievement of the purposes on point 1. Any such company will be designated as a Data Processor according to art. 28 of GDPR.
If you are being considered for a position with a Reply group company outside the European Union, please be aware that these companies may be subject to different data protection legislation, and this may require additional protections and consents. We will inform you of these if necessary.
Whenever personal data are transferred from an EU member state to a third country, this transfer will be protected by standard contractual clauses according to Art. 46 par. 2.c of GDPR.
5. Dissemination of data
Apart from the third parties identified above your data will not be subject to any wider dissemination.
6. Data subjects’ rights
You have the right to require to each Joint Controller the access to your personal data and, where the conditions are met, to require the amendment or erasure of the same or restriction of the processing that refer to You, or to oppose to the processing.
Where the conditions are met, You have the right to data portability.
For the abovementioned communications, you may use the contact details reported in section 8 below.
You have the right to lodge a complaint to the competent Supervisory Authority.
7. Data Controller. Data Protection Officer and Privacy Lead
The Reply Group Companies are Joint Controllers of the processing ex art. 26 GDPR.
Reply together with one or more Reply group companies are the Joint Controllers of this processing activity, as specified by Art. 26 of the GDPR Process.
The contact details of the Data Protection Officers are:
8. Other Contact Details for data subjects’ rights
Data Subjects can send an email to firstname.lastname@example.org, or a mail by postal service, to Reply S.p.A., Corso Francia 110, Turin.
Data Subjects can send an email to email@example.com or a mail by postal service to the HR Department, Reply Ltd, 38 Grosvenor Gardens, London SW1W 0EB.
Data Subjects can send an email to DSB@reply.de, or a mail by postal service to Reply AG with registered office at Bartholomäusweg 26 D-33334 Gütersloh
Data Subjects can send an email to firstname.lastname@example.org or a mail by postal service to Hermes Reply Polska Sp. z o.o. with registered office at Ul. Gliwicka 6/2 44-079 Katowice
Document update date: 10 July 2020