Information notice pursuant to Article 13 of the Regulation EU 2016/679 (hereinafter “GDPR”)

Pursuant to Article 13 of the GDPR, Italfarmaco S.p.A., as data controller (hereinafter also, “Data Controller”), provides you with this information notice related to the processing of your personal data provided through the form available on the SUBMIT YOUR CV webpage of the website www.italfarmaco.com (hereinafter, “Website”).

A. Categories of personal data and source of personal data

We collect your name, contact details (such as address, e-mail, phone numbers) and other relevant information directly from the abovementioned form or your CV. Such personal data can include data related to work and education history. We may process, in accordance with GDPR provisions, certain sensitive personal data (known as special category data in GDPR) where you include it in information you send to us e.g. if you include information about your health, religion or ethnic origin in the CV you send to us.

B. Purposes and legal basis of the processing

The personal data you provide to us are processed for the purposes related to the examination of your application (by way of example only, and not limited to: evaluation of personal details, qualifications, knowledge of foreign languages, previous professional experiences, etc.) and/or to match your details with job vacancies and/or to assist us in finding a position that is most suitable for you and/or to retain your details and notify you about future job opportunities other than the specific role for which you have contacted us.

The legal basis of the processing of your personal data is the performance of a contract to which you, as data subject, are party or in order to take steps at your request, as data subject, before entering into a contract (Article 6, paragraph (1), letter (b) of the GDPR).

C. Methods of processing and communication of personal data

The processing of your personal data will be carried out by authorized persons using appropriate tools to ensure security and confidentiality and may be carried out manually or with the support of manual, computerised and electronic tools to memorize, organize and transfer personal data.

Your personal data will be accessible only to authorized persons, who are expressly in charge and instructed by the Data Controller with regard to the processing of personal data pursuant to Article 29 of the GDPR.

Furthermore, other trusted companies will carry out, as data processors, the processing of your personal data. These companies perform technical and organizational tasks on behalf of the Data Controller (i.e. companies responsible for the technical management and maintenance of the Website or third parties, with whom the Data Controller collaborates in business services). The Data Controller has appointed the aforementioned companies as external Data Processors pursuant to Article 28 of the GDPR.

An updated list of Data Processors is available, on request, sending a communication to the addresses below.

Moreover, in addition to the aforementioned subjects, your personal data might be communicated, when required or provided by applicable laws, to competent supervisory authorities, tax authorities and other authorities, within the respective area of competence.

As to the potential transfer of personal data to non-EU countries, included countries that could not guarantee the same level of data protection provided for by the GDPR, the Data Controller informs you that the processing will be carried out in compliance with GDPR, i.e. through gathering your consent, by the adoption of standard clauses approved by the European Commission, participating to international programs for the free movement of data (i.e. EU-USA Privacy Shield) or working in countries deemed safe by the European Commission.

Personal data will not be disclosed in any way.

D. Data retention period

Your personal data shall be stored for 2 years from collection and, in any cases, not beyond the achievement of the purposes for which they have been collected (principle of the storage limitation, article 5 of GDPR), and in compliance with a legal obligation or with an order of a legitimated authority.

After the expiry of the retention period, personal data will be erased, destroyed or anonymised, without prejudice to potential data retention period provided by the law.

E. Your rights

According to articles 15 to 22 of the GDPR, you have the right to access to a copy of the information comprised in your personal data, object to processing that is likely to cause or is causing damage or distress, object to decisions being taken by automated means, obtain the limitation of the process (in certain circumstances), have (in certain circumstances) your personal data rectified, integrated, blocked, erased or destroyed, obtain the portability of your personal data and the right to propose a claim to the Supervisory Authority. For a complete list please visit: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679.

You are entitled to exercise the rights according to Articles from 15 to 22 of the GDPR and to ask, at any time, for information about the processing of your personal data carried out by Italfarmaco S.p.A. Furthermore, you can object to the processing of personal data in cases provided by laws, addressing to:

To the extent that we are processing your personal information based on your consent, you have the right to withdraw your consent at any time. You can do this by contacting us using the details below.

F. Data Controller and Data Protection Officer

The Data Controller is:

Pursuant to Article 37 of the GDPR, the Data Protection Officer (DPO) of Italfarmaco S.p.A. is available to reply to any request sent to the following e-mail address: infoprivacy.italy@italfarmacogroup.com or at the address: