Privacy notice for job applicants

pursuant to Article 13 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR)

1. Introduction

Pizeta Pharma S.p.A. is committed to protecting your privacy and the security of your personal data. We process your personal data with due care and apply appropriate technical and organisational measures to ensure a level of security appropriate to the risks associated with the processing.

This privacy notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”) and explains how we process your personal data by paper-based and electronic means while ensuring appropriate security and confidentiality.

2. Definitions

Personal data: means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to that natural person’s physical, physiological, genetic, mental, economic, cultural or social identity.

Processing: means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Special categories of personal data: means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation.

Data Controller: means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processor: means the natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller.

3. Data Controller

Your personal data are processed by Pizeta Pharma S.p.A. (also referred to below as “Pizeta Pharma” or the “Company”), with registered office at Via Roma, snc, 62039 Visso (MC), in its capacity as Data Controller for the purposes of the GDPR.

If you have any questions about this privacy notice or the processing of your personal data, you may contact Pizeta Pharma S.p.A. at any time using the following contact details:

Data Controller

Company name: Pizeta Pharma S.p.A.

Administrative office address: Via Bruno Simonucci, 3, Ponte San Giovanni, 06135 Perugia (PG)

Telephone: 0759474542

Email: info@pizetapharma.com

Certified email (PEC): greempharmsrl@legalmail.it

4. Categories of data processed

The Company processes the personal data contained in your curriculum vitae and any supporting documents you submit, which may include:

identification and contact details;
information concerning education, professional qualifications and work experience;
qualifications, skills, certifications and any references provided;
any further information voluntarily provided by the applicant.

Please do not include special categories of personal data referred to in Article 9 GDPR in your curriculum vitae (for example, data concerning health, racial or ethnic origin, religious beliefs, political opinions or trade union membership), unless such information is strictly necessary for the recruitment process or for compliance with obligations arising under employment, social security and social protection law (for example, information concerning membership of protected categories under applicable law).

Where the processing of such data is necessary for the purposes permitted under applicable law, they will be processed solely within the limits of Article 9(2)(b) GDPR and the applicable national legislation in the field of employment, social security and social protection.

5. Purposes and legal bases of the processing

We process your personal data for the following purposes:

	Purpose (Why we process your data)	Legal basis (The legal provision on which the processing is based)	Consequences of failure to provide the data (What happens if you do not provide the requested personal data)
A	Managing applications and recruitment and selection procedures, including applications for specific vacancies and unsolicited applications	Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract	The processing does not require your consent. If you do not provide the required personal data, we will be unable to consider your application or proceed with the recruitment and selection process
B	Retention of the CV for future employment opportunities	Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Data Controller in retaining and assessing applications for future recruitment opportunities	The processing does not require your consent. You have the right to object to the processing at any time pursuant to Article 21 GDPR
C	Assessment of the application in fulfilment of obligations in the field of employment, social security and social protection law, where special categories of data are provided (e.g. membership of protected categories)	Article 9(2)(b) GDPR – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the Data Controller or of the Data Subject in the field of employment and social security and social protection law, insofar as it is authorised by Union or Member State law or by a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and interests of the Data Subject	The processing does not require your consent. If you do not provide the required data, it may not be possible to assess your application or comply with applicable employment-law obligations

Purpose

(Why we process your data)

Legal basis

(The legal provision on which the processing is based)

Consequences of failure to provide the data

(What happens if you do not provide the requested personal data)

Managing applications and recruitment and selection procedures, including applications for specific vacancies and unsolicited applications

Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract

The processing does not require your consent. If you do not provide the required personal data, we will be unable to consider your application or proceed with the recruitment and selection process

Retention of the CV for future employment opportunities

Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Data Controller in retaining and assessing applications for future recruitment opportunities

The processing does not require your consent. You have the right to object to the processing at any time pursuant to Article 21 GDPR

Assessment of the application in fulfilment of obligations in the field of employment, social security and social protection law, where special categories of data are provided (e.g. membership of protected categories)

Article 9(2)(b) GDPR – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the Data Controller or of the Data Subject in the field of employment and social security and social protection law, insofar as it is authorised by Union or Member State law or by a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and interests of the Data Subject

The processing does not require your consent. If you do not provide the required data, it may not be possible to assess your application or comply with applicable employment-law obligations

6. Recipients

The personal data you provide, or that we collect during the recruitment process, will be processed only by personnel duly authorised by the Data Controller and acting on its instructions.

Where necessary for the purposes described in this notice, your personal data may be disclosed to recruitment service providers, professional advisers, IT service providers and competent public authorities, each acting in accordance with applicable data protection law.

7. Transfers of data outside the EEA

Your personal data are not transferred outside the European Economic Area (EEA).

8. Personal data retention period (Data retention)

We retain your personal data only for as long as necessary for the purposes for which they were collected, as set out below.

Document	Retention period
Curriculum vitae	2 years after the recruitment process is closed, if the applicant is not hired (for CVs submitted in relation to advertised vacancies); 2 years after receipt of the application, if the applicant is not hired (for an unsolicited application not related to an open recruitment process); 10 years after termination of the employment relationship, if the applicant is hired

At the end of these periods, your data will be permanently erased or otherwise irreversibly anonymised by Pizeta Pharma.

9. Rights of the Data Subject

You may exercise the following rights in relation to the personal data covered by this notice, as provided for and guaranteed by Regulation (EU) 2016/679 (GDPR):

Right of access and rectification (Articles 15 and 16 GDPR): you have the right to access your personal data and to request that inaccurate data be corrected or incomplete data completed. Upon request, we will provide you with a copy of the personal data we hold about you.
Right to erasure (Article 17 GDPR): you may request the erasure of your personal data where the applicable legal requirements are met.
Right to restriction of processing (Article 18 GDPR): you have the right to obtain restriction of processing in the circumstances set out in Article 18 GDPR.
Right to data portability (Article 20 GDPR): where the processing is carried out by automated means and is based on consent or on a contract, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transmit those data to another Data Controller, subject to the conditions set out in Article 20 GDPR.
Right to object (Article 21 GDPR): you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on the legitimate interests pursued by the Data Controller. The Data Controller will cease the processing unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.
Right to withdraw consent (Article 7 GDPR): where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint (Article 77 GDPR): you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or another competent supervisory authority if you consider that the processing of your personal data infringes the GDPR.

You may exercise your rights at any time in relation to the specific processing of your personal data by Pizeta Pharma by contacting the Data Controller using the contact details set out in section 3 of this notice.

For further information about your rights, please contact the Data Controller using the contact details above. The full text of the Articles referred to above is available at the following link: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng

10. Security measures

Pizeta Pharma implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

11. Changes to this notice

We may update this privacy notice from time to time to reflect changes in applicable data protection law, our services or our organisational arrangements.

We encourage you to review this privacy notice periodically. Where appropriate, we will inform you promptly of any material changes and their implications.

In any event, the updated version of this privacy notice will be published in the dedicated section of the Company’s website, together with the date on which it was last updated.

12. Date of last update

30 July 2026