Document update date: November 2022
According to Section 13 of EU General Data Protection Regulation and UK General Data Protection Regulation (hereinafter, “GDPR”), concerning the protection of individuals with regard to the processing of personal data, Reply S.p.A., Reply Deutschland SE, Reply LTD (hereinafter, “Reply”), hereby provides you with this Privacy notice regarding the processing of your personal data.
Reply together with one or more Reply Group Companies are the Joint Controllers of this processing activity, as specified by Art. 26 of the GDPR. You may require details on Reply Group Companies contacting Reply as specified hereinafter.
We may obtain your personal data either directly from you or from third parties for recruitment purposes. Such third parties may include recruitment agencies, job boards and publicly available websites such as Linked-In, as well as specialist companies that facilitate the entrance of recent graduates into the working life. The data we collect may include your contact details, employment and education history, skills and professional qualifications, as well as records of any interactions with us including interviews and tests.
1. Purpose and Processing Activity. Legal Basis
Your data are stored and processed solely for the following purposes:
a) carry out the necessary evaluations in order to possibly establish a job or contract relationship with one of the Companies in the Reply Group. Legal basis for the processing: execution of pre-contractual activities.
b) following a successful evaluation, arrange any documentation needed to establish the job or contract relationship, such as passport, work permit, driving license, etc. Legal basis for the processing: execution of pre-contractual activities.
c) comply with specific obligations required by law or other binding regulations (e.g. fiscal legislation, social security and social protection law, health and safety at work, protection of health, public order and public security law). Legal basis for the processing: legal obligations.
To achieve the abovementioned purposes, it may be necessary to collect and process data defined as “particular” by GDPR art. 9 comma 2.b. In particular, this may include information about health status and disability, subject to any relevant employment legislation.
2. Provision of Data
If you are unwilling to provide sufficient data to support the recruitment and evaluation process, we shall be unable to consider you for setting up the job or contract relationship
3. Method of Processing Activity. Data Retention Period
Your data are stored electronically and will be subject to strict information security measures to protect your privacy. Your data will only be accessed by those directly involved in the evaluation and recruitment process.
If you subsequently join Reply, as an employee or as a freelance, you will be given a separate Privacy Notice to cover our storage and use of your personal data during your employment.
Otherwise, your data will be held for up to three years from the most recent update unless you specifically request deletion.
4. Data Recipients
The personal data collected to achieve the purposes indicated in the above section 1, could be used by any of the Reply Companies as Joint Controller of the processing activity according to art. 26 GDPR.
Within the organization of each Joint Controller, personal data will be processed by subjects specifically appointed and interested to the applicant’s profile and that intend to conduct an evaluation of the applicant, or by all subjects to whom the communication is due in base of specific law obligations.
In some cases, we may share a pseudonymized profile with a potential Reply client as part of your evaluation.
The Joint Controllers may use external companies to provide services for the achievement of the purposes on point 1. Any such company will be designated as a Data Processor according to art. 28 of GDPR.
If you are being considered for a position with a Reply Group Company outside the EU/UK, please be aware that these companies may be subject to different data protection legislation, and this may require additional protections and consents. We will inform you of these if necessary.
Whenever personal data are transferred from an EU/UK member state to a third country, this transfer will be carried out in line with applicable legal requirements.
5. Dissemination of Data
Apart from the third parties identified above your data will not be subject to any wider dissemination.
6. Data Subjects’ Rights
You have the right to require to each Joint Controller the access to your personal data and, where the conditions are met, to require the amendment or erasure of the same or restriction of the processing that refer to You, or to oppose to the processing.
Where the conditions are met, You have the right to data portability.
For the abovementioned communications, you may use the contact details reported in section 8 below.
You have the right to lodge a complaint to the competent Data Protection Authority.
7. Data Controller. Data Protection Officer and Privacy Lead
Reply S.p.A. (with registered office at Corso Francia 110, Turin), Reply Deutschland SE (with registered office at Bartholomäusweg 26 D-33334 Gütersloh), Reply LTD (with registered office at 38 Grosvenor Gardens, London SW1W 0EB) together with one or more Reply Group Companies are the Joint Controllers of this processing activity, according to Art.26 of GDPR.
The contact details of the Reply Data Protection Officers are:
DPO Italy: dpo.it@reply.it
DPO Germany, Poland: dpo.de@reply.de
DPO UK: dpo.uk@reply.com
8. Other Contact Details for Data Subjects’ Rights
Data Subjects can also contact the Joint Controllers by emailing to hr.privacy@reply.com or to DSB@reply.de for Reply Deutschland SE.