Enfinity Recruitment Privacy Statement

As part of our recruitment process, we request data from you that will allow us to analyze your professional profile and establish your suitability for certain vacancies. Information collected when you visit our recruitment portal is processed based on the legitimate interests of the Data Controller. Processing of Personal Data for subscribing to our other job offers will only be processed with your consent. Under the GDPR and UK GDPR, our legal bases are Article 6(1)(b) (steps taken at your request prior to entering into a contract), Article 6(1)(c) (compliance with legal obligations such as immigration or tax law), Article 6(1)(f) (our legitimate interests in evaluating candidates and defending legal claims) and Article 6(1)(a) (your consent, where required, for example for talent-pool retention).

The Data Controller is the Enfinity legal entity offering the position or to which you are applying (hereinafter the “Controller”, the “Data Controller” or “Enfinity”). The Annex for the country of the position identifies the Data Controller.

We may collect personal data including:

1. Civil status (name and surname, etc.).
2. Personal contact details (phone number, city of residence, e-mail, etc.).
3. Academic qualifications and proof.
4. CVs and Resumes.
5. Proof of identity and visa status.
6. Information needed to screen your profile for vacancies you are applying for.

Sources of personal data may be:

1. Job application though LinkedIn/Career portal of our company.
2. You send your data directly to our company’s employees.
3. Third parties: our company may work and use the services of third parties such as recruiting firms that are responsible autonomously for managing your personal data.
4. Our recruiters and hiring managers, who may source your profile from public professional networking sources, such as your LinkedIn profile, or through referrals.

Your personal data will be used for human resources and recruitment reasons, such as:

1. Identifying and evaluating potential candidates for open and future vacancies;
2. Maintaining data and records in relation to recruiting and hiring;
3. Verifying the information you or others provide and carrying out reference checks or conducting background checks (where applicable);
4. Facilitating the recruiting and interview process; and
5. Preparing an offer letter, if your application is successful.

The information processed as part of the recruitment process is required for us to contact you and to determine whether you are the right candidate for the vacant position. Information provided to us will only be used to consider your application and in connection with subsequent employment. We do not make hiring decisions about you solely on the basis of automated processing or profiling; all hiring decisions are taken by a human recruiter or hiring manager.

Use of AI-assisted tools. We may use AI-assisted tools to support our recruitment activities, including administrative, organizational and reporting tasks and the administration of candidate assessments against criteria we define in advance. Such tools process your personal data only on our instructions, for the purposes and on the legal bases set out in this Statement, and within limits we set. They are not used to rank, shortlist or reject candidates, to assess your suitability independently, or to make hiring recommendations or decisions. Open-ended responses are reviewed by a human reviewer, all recruitment decisions are taken by a human reviewer, and no decision about your application is made solely by automated means.

During the recruitment process, we will process general personal data about you. We may also process information about your national identification number where this is necessary. Depending on the role and the location, we may also process special category data within the meaning of Article 9 of the GDPR or UK GDPR. To the extent we process any such special category data, we do so on the basis of Article 9(2)(b) (carrying out obligations and exercising rights in the field of employment law) or, where applicable, your explicit consent under Article 9(2)(a). Where, as part of background screening, we process personal data relating to criminal convictions and offences within the meaning of Article 10 of the GDPR or UK GDPR, we do so only where and to the extent authorized by the law applicable to the location of the position.

If you receive an offer from us, we may conduct a background check on you or instruct a third party to do so on our behalf. Background screening will only be done where permitted by the law applicable to the location where the position is located and to the extent necessary and proportionate to the role that you are being offered. Our legal basis for background screening is our legitimate interest in verifying the information you provide and your suitability for the role (Art. 6(1)(f) GDPR). If a background screening is required, you may be contacted by a third-party background screening service provider to request authorization for the release of your information, and at that time you will be provided with further information about the process and what personal data it might involve.

By submitting your application, you declare that your Personal Data is true, accurate, complete, and not misleading. In addition, you authorize the Data Controller to take all reasonable steps to verify the Personal Data provided by you at any time during the application and selection process where this is permitted within the local legal context, also in order to exercise the rights of the Data Controller, such as the right to defense in court, on the basis of the legitimate interest of the Data Controller. This legitimate interest is to be considered prevailing since it corresponds to a constitutionally guaranteed right and, as such, is socially recognized as prevailing over the interests of the individual concerned. The provision of Data for this purpose is necessary to enable the Data Controller to defend itself in legal proceedings.

We may share your data with third-party processors with whom we have concluded a processing agreement. For example, the Workable recruitment portal is run by a trusted third-party provider that has signed a data processing agreement with Enfinity. Additionally, we may sometimes share your personal data with third parties to conduct (e-)assessments or background checks or application maintenance purposes, operating as data processors. We may also share your data with other Enfinity Global group companies for recruitment administration and reporting, and where a position involves another group company. For positions based in jurisdictions where Enfinity does not have a local recruiting entity, we use an external provider to formally employ successful candidates and administer their employment on our behalf; if you reach the offer stage for such a position, we will share your personal data with that provider. Because Enfinity determines the purposes and means of processing your Personal Data, Enfinity remains the Data Controller; the provider processes that Personal Data as a processor acting on Enfinity’s instructions, and as an independent controller only to the extent required to meet its own legal obligations. Your data could be disclosed also to external subjects operating as autonomous data controllers such as, by way of example, Authorities and supervisory and control bodies and, in general, to subjects, including private subjects, entitled to request the data (such as, for example, accounting consultants, legal consultants), Public Authorities who make an express request for administrative or institutional purposes, in accordance with the provisions of current national and European legislation. If your Personal Data is transferred outside of the European Union for any legitimate purposes by the Controller, these transfers will be covered by appropriate safeguards, including the applicable adequacy decisions and the Standard Contractual Clauses adopted by the European Commission. Country-specific information on international transfers is set out in the Annexes. If you have any questions on how Enfinity safeguards your data, please contact recruitmentprivacy@enfinity.global.

The precise length of time that we store your data will depend on the type of data, our legitimate business needs and other legal or regulatory rules that may require us to retain it for certain minimum periods. Typically, should we reject your application or your candidacy otherwise ends, we will retain your personal data for up to 12 (twelve) months, or a shorter period where required by local law after completion of the application process. After that period, we will delete your personal data and only those details that cannot be traced back to you will be retained in our systems for reporting purposes.

In some cases, we will ask your consent to retain your data for a longer period, to see if there is a match with any future positions. The maximum term for retaining your data in this talent pool is 24 (twenty-four) months, or a shorter period where required by local law. In that case, you will be given access to your data in the talent pool through the applicant portal, and you can change and supplement it, or have it anonymized.

If there is no match within the first 12 months of your retention in the talent pool, we will again ask your consent for retaining your data in the talent pool. If you do not give your consent, we will anonymize your data.

Whenever you visit one of our company websites, cookies may be used. Please review our websites Privacy Policy and Cookies Policy. Additionally, the Workable recruitment portal may use cookies. Please refer to the Workable Privacy Policy and the Workable Cookies Policy.

If you are an applicant in the European Economic Area or the United Kingdom, you have the following rights under the GDPR and UK GDPR. In particular, you have the right to request and obtain, at any time, access to your personal data, information on the processing carried out, rectification and/or updating of personal data, erasure and restriction of processing. You also have the right to object to the processing and to request data portability (i.e. to receive your personal data in a structured, commonly used, machine-readable format). Finally, data subjects always have the right to withdraw their consent at any time (in any case, this will not affect the lawfulness of the processing carried out on the basis of the consent given before the revocation) and to lodge a complaint with a supervisory authority. If you want to exercise your rights, please contact us at recruitmentprivacy@enfinity.global. The Data Controller may ask for proof of identity (such as a copy of an identity card) to be joined to your request. If you are an applicant outside the European Economic Area and the United Kingdom, you have the rights provided by the data protection law applicable to you, as set out in the Annex for your country (for California residents, Annex 5).

You may – unconditionally and at any time – withdraw your consent for our processing of your data. You can do so by sending us an email at recruitmentprivacy@enfinity.global. Withdrawal of your consent will not have any negative impact. However, this may mean that we cannot meet specific requests from you in the future. Withdrawal of your consent will not affect the lawfulness of the processing based on consent before it is withdrawn. Furthermore, it will not affect any processing carried out on another lawful basis.

You can also – unconditionally and at any time – object to our processing when such processing is based on our legitimate interests.

If you have any questions regarding this Recruitment Privacy Statement, please contact us at recruitmentprivacy@enfinity.global.

We may update this Recruitment Privacy Statement. We will review this Statement regularly to ensure it is updated, valid and in accordance with current legislation and our principles for processing personal data. We will publish new versions of this Statement on our recruitment portal. This Statement is maintained in English. We may make translated versions of this Statement or any of its Annexes available. The translated versions are provided for convenience; in the event of any discrepancy or inconsistency between a translated version and the English version, the English version prevails, except where the law applicable to you requires otherwise or grants you rights that can only be exercised by reference to the local-language version.

The Annexes below form part of this Statement. They identify the Data Controller for each country in which we recruit and provide additional information required under the laws of certain jurisdictions where we operate. They supplement, and do not replace, the rest of this Statement; where an Annex differs from the main text, the Annex applies to candidates in that country. The Annexes are: Annex 1 – Italy; Annex 2 – The Netherlands; Annex 3 – Spain; Annex 4 – Japan; Annex 5 – United States; Annex 6 – India; and Annex 7 – United Kingdom.