Privacy Policy

What to Include in the Privacy Policy

Information on the processing of personal data of candidates

Information on the processing of candidates’ personal data (“Information”) made pursuant to Articles 13 and 14 Regulation (EU) 2016/679 (“GDPR”)

1. Data controller and data protection officer

Greci Industria Alimerntare S.p.A. company based in Parma, Strada Traversante Ravadese 58, P.iva and C.F. 00726380348.

For the exercise of your rights, listed in Article 7 below, as well as for any other request related to the same and/or this Policy, you may contact the Controller at the following contact details:

• telephone:

• email:

1. Personal data processed

For the purposes indicated in Article 3 below, the Controller will process your personal data that you directly provide, including through the dedicated areas on the Controller’s website, or collected from third parties (e.g., temp agencies, social networks or other recruiting portals) such as, but not limited to:

• Master and contact information;

• data on his educational qualification and professional qualification;

• Data on your marital status and family situation;

• financial data (e.g., his income);

• data of a particular nature ex art. 9 GDPR, where you have included it within your curriculum vitae (such as, for example, your belonging to protected categories).

1. Purpose of processing and legal basis

Personal data will be processed by the Owner for the purpose of carrying out the recruitment process, including but not limited to receiving and registering your resume within the Owner’s databases, evaluating the information within your resume in order to determine your potential suitability for establishing an employment relationship with the Owner, arranging interviews and related fulfillments.

The legal basis for the processing of your data is the performance of activities of a pre-contractual nature at the request of the data subject, pursuant to Art. 6(1)(b) of the GDPR; therefore, your consent is not necessary to authorize the processing.

Your personal data of a particular nature ex art. 9 GDPR, where spontaneously entered by you within your curriculum vitae, will be processed by the Data Controller only where strictly necessary for the personnel selection process and, in any case, subject to your explicit consent pursuant to art. 9(2)(a) of the GDPR.

1. Nature of provision, data retention period, and processing methods

For the purpose mentioned in Article 3 above, the provision of your personal data of a common nature is mandatory; your refusal to provide such data will make it impossible for the Controller to evaluate your application during the selection process.

Failure to provide your special data or to give explicit consent for its processing will prevent the Owner from considering and evaluating such data in connection with the personnel selection process.

For the purpose referred to in paragraph 3 above, your personal data will be kept for 12 months starting from the termination of the selection process, unless the employment/collaboration relationship is contracted and consequently stored for the time related to it.

Processing is carried out in compliance with the requirements of the GDPR, according to the principles of fairness, lawfulness and transparency and the protection of your rights described therein. Personal data are processed by means of computer, telematic and/or paper-based tools, as well as with the use of security measures to ensure the confidentiality of personal data and to prevent undue access by unauthorized parties.

The Controller does not carry out automated decision-making on your personal data, including profiling as referred to in Article 22(1) and (4) of the GDPR.

1. Disclosure of data

For the pursuit of the purposes described in Article 3 above, the personal data processed will be known to the employees, assimilated personnel and collaborators of the Controller, who will act as authorized persons for the processing of personal data.

In addition, your personal data may be processed by third parties belonging to, but not limited to, the following categories:

• Service providers for information systems management;

• Providers of legal and consulting services;

• recruitment agencies;

• other service providers;

• companies that are part of the Group to which the Holder belongs, for the performance of instrumental activities related to or in support of that of the Holder.

The subjects belonging to the above categories operate, in some hypotheses, as data controllers specifically appointed by the Data Controller in compliance with Article 28 GDPR, in other hypotheses in total autonomy as separate data controllers, it being understood that, in the latter case, the communication of your personal data to such autonomous data controllers would take place solely for the purpose of pursuing the purposes referred to in Article 3 above.

A complete and up-to-date list of the parties to whom your personal data may be disclosed can be obtained by contacting the Data Controller at the address given in Article 1 of the Notice.

Your personal information will not be disseminated.

1. Transfer of personal data outside the European Union

The Holder does not intend to transfer your personal data outside the European Union.

Should this circumstance become necessary due to technical-organizational needs, such a transfer will in any case be preceded by the prior verification of the existence of the conditions of legitimacy and adequate guarantees prescribed by Articles 44 et seq. of the GDPR. If this circumstance occurs, you may request information from the Data Controller about the transfer of your personal data outside the European Union and obtain a copy of the protection measures taken by making a specific request to the Data Controller via the e-mail address

1. Rights of data subjects

In connection with the processing operations described in this Notice, as a data subject, you may, under the conditions set forth in the GDPR, exercise the rights enshrined in Articles 15 – 21 of the GDPR, in particular:

• Right of access: right to obtain confirmation as to whether or not personal data concerning you are being processed and, if so, to obtain access to your personal data – including a copy thereof – and communication of, among others, the information referred to in Art. 15 of the GDPR;

• Right of rectification: the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the supplementation of incomplete personal data pursuant to Art. 16 of the GDPR;

• Right to deletion (right to be forgotten): right to obtain, without undue delay, the deletion of personal data concerning you, in the cases indicated in Art. 17 of the GDPR; the right to erasure does not apply to the extent that the processing is necessary for the performance of a legal obligation or the performance of a task carried out in the public interest or for the establishment, exercise or defense of a right in court;

• Right to limitation of processing: right to obtain limitation of processing, in the cases indicated in Art. 18 of the GDPR;

• right to data portability: the right to receive, in a structured, commonly used and machine-readable format, personal data concerning him or her that have been provided to the Controller and the right to transmit them to another controller without hindrance, if the processing is based on consent and is carried out by automated means, as set out in Art. 20 of the GDPR. In addition, the right to have your personal data transmitted directly from the Data Controller to another data controller if this is technically feasible;

• Right to object: the right to object to the processing of personal data concerning you, unless there are legitimate grounds for the Controller to continue the processing, pursuant to Art. 21 of the GDPR;

• Right to revoke consent at any time without affecting the lawfulness of the processing based on the consent given before revocation;

• Right to file a complaint with the Garante per la protezione dei dati personali, Piazza Venezia no. 11, 00187, Rome (RM).