Privacy Notice for
Candidates

Document update date: October 2026

According to Section 13 of EU General Data Protection Regulation and UK General Data Protection Regulation (hereinafter, “GDPR”), concerning the protection of individuals with regard to the processing of personal data, Reply S.p.A., Reply Deutschland SE, Reply LTD (hereinafter, “Reply”, “we”, “us”), hereby provides you with this Privacy notice regarding the processing of your personal data. 

1. Purpose of the processing and legal basis 

Your personal data may be processed for the following purposes and on the following legal bases:  

a) Recruitment and selection: to carry out the necessary evaluations in order to possibly establish a job or contract relationship with one of the Companies in the Reply Group.
Legal basis: execution of pre-contractual activities. 

Where you choose to provide your consent, your data will be processed to include you in the Reply Talent Pool, to contact you about future job opportunities that we believe match your skills and experience, and send you invitations to recruiting-related events (e.g., Open Days, Reply Challenges, Hackathons and similar initiatives). Provision of consent for this purpose is optional and does not affect the recruitment process.  
Legal basis: your consent, which may be withdrawn at any time without affecting the lawfulness of prior processing. 

b) AI-enabled support to recruiters for candidate matching: to assist recruiters in assessing how closely your application and resume/CV align with the requirements of a specific job position, by analysing information provided by you during the application process, such as your skills, professional experience, location and education. 
The AI tool is an in-house application and not a decision-making tool. It is not used to make, replace or substantially assist discretionary employment decisions. Trained human recruiters always remain involved in the assessment, are responsible for reviewing the relevant information and are the sole decision makers regarding your recruitment. The AI tool has been assessed against applicable responsible AI requirements. Your personal data is not used to train the AI tool. 
Legal basis: legitimate interests in managing and supporting part of the recruitment and selection process. 

c) Interactive experience on the Career Page: to enable you to search and identify available career opportunities in line with your preferences provided during the online gamification session on our Career Page. 
Gamification output and artifacts are provided for your use only. Therefore, they are not accessible to our recruiters and won’t affect the selection process. At the end of the gamification, you may decide to proceed by applying to one of the presented vacancies. Reply will only receive data regarding the latter application to pursue the purposes indicated at the above point a). Your use of the tool is optional, and the gamification does not make use of AI. 
Legal basis: your consent. 

d) Recruitment enquiries: to respond to your enquiry about recruitment topics when you submit a Reply contact form outside the Career Page on reply.com. Providing your personal data is necessary to process your request; failure to do so may mean we are unable to respond.
Legal basis: execution of pre-contractual activities. 

e) Pre-employment documentation: following a successful evaluation, to arrange any documentation needed to establish the job or contract relationship, such as passport, work permit, driving license, etc. 
Legal basis: execution of pre-contractual activities. 

f) Legal obligations: to comply with specific obligations required by law or other binding regulations (e.g.  fiscal legislation, social security and social protection law, health and safety at work, protection of health, public order and public security law).
Legal basis: legal obligations.

2. Personal Data Collected 

We may obtain your personal data either directly from you or from third parties for recruitment purposes. Such third parties may include recruitment agencies, job boards and publicly available websites such as Linked-In, as well as specialist companies that facilitate the entrance of recent graduates into the working life.  

The personal data we collect may include your contact details, employment and education history, skills and professional qualifications, as well as records of any interactions with us including interviews and tests. 

If you are unwilling to provide sufficient data to support the recruitment and evaluation process, we shall be unable to consider you for setting up the job or contract relationship. 

Where necessary for the above purposes indicated in the Section 1, your personal data may also include special categories of data pursuant to Article 9 of the GDPR, in particular, information about health status or disability, subject to applicable employment legislation. 

3. Method of processing activity 

Your data is stored electronically and will be subject to strict information security measures to protect your privacy. Your data will only be accessed by those directly involved in the evaluation and recruitment process. 

4. Data retention period  

Reply will retain your personal data for the period necessary to manage and complete the recruitment process, in line with applicable data retention requirements.
Where you have provided your consent for the inclusion in the Reply Talent Pool or receiving information about recruiting-related events, your personal data may be retained for a longer period, in line with applicable retention period requirements.
Personal data provided through the ‘Interactive Experience on the Career Page’ is deleted at the end of the session and is not retained by Reply.
Personal data collected through a contact form, outside the Career Page on reply.com, to respond to your recruitment-related enquiry will be retained up to 3 months from the date of the request.
Personal data may also be retained for a longer period where necessary to comply with legal obligations or to establish, exercise or defend legal claims. 


5. Data Recipients  

The personal data collected to achieve the purposes indicated in the above Section 1 may be accessed and processed by any of the Reply Companies as Joint Controller of the processing activity according to Article 26 GDPR. 

Within the organization of each Joint Controller, personal data will be processed by specifically authorized persons who are involved in the recruitment process, or by subjects to whom the communication is due in base of specific law obligations.  

In some cases, we may share a pseudonymized profile with a potential Reply client as part of your evaluation process. 

The Joint Controllers may use external companies to provide services for the achievement of the purposes indicated in Section 1. Such companies will be designated as Data Processors according to Article 28 of GDPR, where applicable. 

If you are being considered for a position with a Reply Group Company outside the EU/UK, please be aware that these companies may be subject to different data protection legislation, and this may require additional safeguards. We will inform you of these if necessary.  

Whenever personal data is transferred from an EU/UK member state to a third country, this transfer will be carried out in line with applicable legal requirements. 

Apart from the third parties identified above, your personal data will not be subject to any further dissemination. 


6. Data subjects’ rights  

You have the right to request to each Joint Controller the access to your personal data and, where the applicable conditions are met, to require the amendment or erasure of the same or restriction of the processing concerning you, as well as to object to the processing.  

Where the applicable conditions are met, you also have the right to data portability.  

To exercise the above rights, you may use the contact details reported in Section 8 below.  

You also have the right to lodge a complaint to the competent Data Protection Authority. 


7. Data Controller and Data Protection Officer 

Reply S.p.A. (with registered office at Corso Francia 110, Turin), Reply Deutschland SE (with registered office at Bartholomäusweg 26 D-33334 Gütersloh), Reply LTD (with registered office at 38 Grosvenor Gardens, London SW1W 0EB) together with one or more Reply Group Companies are the Joint Controllers of this processing activity, according to Article 26 of GDPR. 

The contact details of the Reply Data Protection Officers are:   

8. Other Contact Details for data subjects’ rights 

Data Subjects can also contact the Joint Controllers by emailing to hr.privacy@reply.com or DSB@reply.de for Reply Deutschland SE.