Privacy Policy

European Regulation 2016/679 (General Data Protection Regulation, hereafter ‘GDPR’) and the relevant Italian legislation regulate the processing of ‘personal data’, i.e. any information concerning an identified or identifiable natural person.

In compliance with these provisions, PRAXI S.p.A. hereby describes the manner in which it collects and processes the personal data of its Clients natural persons and persons acting on behalf of Clients legal persons, hereinafter (“the Data Subject”).

1. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is PRAXI S.p.A. with registered office in Turin, Corso Vittorio Emanuele 3, tax code and VAT number 01132750017, privacy@praxi.praxi.

The Data Protection Officer (DPO), appointed by the Data Controller pursuant to Articles 37 et seq. GDPR, is Dr. Annalisa Settimo, who can be contacted at the email address dpo@praxi.praxi.

2. PURPOSE OF PROCESSING, CATEGORIES OF DATA PROCESSED, LEGAL BASIS, RETENTION TIME AND POSSIBLE RECIPIENTS

PRAXI S.p.A., in the context of its professional activity, collects personal data from the Data Subject or the Entity to which the Data Subject is a party or the Entity with which the Data Subject has a contractual relationship. The processing is carried out in accordance with the principles of lawfulness, fairness and transparency and in compliance with the principle of minimization, i.e. acquiring and processing data only as necessary for the following purposes:

I. management of contractual or pre-contractual relationships to which the Data Subject is a party and performance of legal obligations

• personal and contact data and possibly also data related to professional role are processed;
• processing is necessary for the performance of a contract to which the Data Subject is a party or for the execution of pre-contractual measures (Art. 6, co. 1, lett. b) GDPR) and to fulfill legal obligations to which the Data Controller is subject (Art. 6, co. 1, lett. c) GDPR);
• are retained for the duration of the contractual relationship and until the statutory limitation period provided for by law for the protection of rights arising from the relationship (Art. 2946 et seq. of the Civil Code);
• may be disclosed to public administrations, credit institutions and insurance companies, accountants, auditors, auditors and lawyers, who act as Data Controllers; they may also be disclosed to external IT service providers who act as Data Processors;

II. communications related to PRAXI Group services

(a) Biographical and contact data and data related to professional role are processed;

• processing is carried out in pursuit of the legitimate interest of the Data Controller (art.6, co. 1 lett. f) GDPR);
• are processed until the right of objection is exercised, which can be easily manifested through the request to unsubscribe from the mailing list;
• are communicated to marketing service providers;

(b) images and videos collected in the course of professional activity may be processed (not including in this group the audio-visual recordings referred to in the next paragraph);

• the processing is based on the consent of the Data Subject (art.6, co. 1, lett. a) GDPR);
• are retained until consent is revoked;
• may be posted on the Website and corporate social media;

III. participation in training conducted through audio-visual recordings

• images and videos made during training courses organized by the Holder are processed;
• processing is based on the consent of the Data Subject (Art. 6, co. 1(a) GDPR);
• are retained until the end of training or consent is revoked.

3. MODE OF PROCESSING AND SCOPE OF DATA CIRCULATION

The processing of personal data is carried out by means of the operations specified in Art. 4, co. 1, no. 2) of the GDPR, i.e. by collecting, recording, storing, adapting, extracting, consulting, using and deleting them.

• Personal data are collected and processed by duly instructed personnel in accordance with Article 29 GDPR and in compliance with confidentiality obligations.
• Processing operations are carried out using IT systems suitable to ensure data security and confidentiality and, where necessary, by means of paper media.
• The data are not subjected to automated decision-making that would have a significant effect on the Data Subject.

PRAXI S.p.A. takes appropriate technical and organizational measures to protect data in order to ensure a level of security appropriate to the risk of misuse, loss or unauthorized access.

The management and storage of personal data take place on servers located within the European Union owned by PRAXI S.p.A. and/or third-party companies acting as Data Processors.

4. RIGHTS OF THE DATA SUBJECT

PRAXI S.p.A. ensures at all times that the Data Subject may exercise the rights provided for under the GDPR:

• Right of access, i.e., the ability to obtain confirmation from the Data Controller as to whether or not their data is being processed and to obtain the information contained herein (Art. 15 GDPR);
• Right to rectification or integration of inaccurate or incomplete personal data (Art. 16 GDPR);
• Right to cancellation, if the processing is not required by law or contract or necessary for the Controller to exercise its rights in court (Art. 17 GDPR);
• Right to restriction of processing, i.e., the right to request that data be processed only for the purpose of preservation to the exclusion of other processing (Art. 18 GDPR);
• Right to object to processing that occurs in pursuit of the legitimate interest of the Data Controller (Art. 21 GDPR);
• Right to revoke any consent given, without affecting the lawfulness of the previous processing Art. 13, co. 2(c) and Art. 14, co. 2(d) GDPR).

The Data Subject may exercise the above rights by writing to the e-mail address privacy@praxi.praxi; if he or she believes that the processing concerning him or her violates privacy regulations, he or she may write to the e-mail address dpo@praxi.praxi or lodge a complaint with the Garante per la Protezione dei Dati Personali(www.garanteprivacy.it).

Privacy Notice on the Processing of Clients’ Personal Data – Rev. 7

European Regulation 2016/679 (General Data Protection Regulation, hereafter ‘GDPR’) and the relevant Italian legislation regulate the processing of ‘personal data’, i.e. any information concerning an identified or identifiable natural person.

In compliance with these provisions, PRAXI S.p.A. hereby describes the manner in which it collects and processes the personal data of its Suppliers natural persons and persons acting on behalf of Suppliers legal persons, hereinafter (“the Data Subject”).

1. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is PRAXI S.p.A. with registered office in Turin, Corso Vittorio Emanuele 3, tax code and VAT number 01132750017, privacy@praxi.praxi.

The Data Protection Officer (DPO),appointed by the Data Controller pursuant to Articles 37 et seq. GDPR, is Dr. Annalisa Settimo, who can be contacted at the email address dpo@praxi.praxi.

2. PURPOSE OF PROCESSING, CATEGORIES OF DATA PROCESSED, LEGAL BASIS, RETENTION TIME AND POSSIBLE RECIPIENTS

PRAXI S.p.A., in the context of its professional activity, collects personal data from the Data Subject or the entity to which the Data Subject belongs according to the principles of lawfulness, correctness and transparency and in compliance with the principle of minimization, i.e. acquiring and processing the data limited to what is necessary for the management of contractual or pre-contractual relationships, for the performance of related legal obligations, and for the management of PRAXI projects.

Personal and contact data and bank account identification number are processed. The processing is necessary for the management and execution of a contract to which the Data Subject is a party or for the execution of pre-contractual measures (Art. 6, co. 1, lett. b) GDPR) and to fulfill legal obligations to which the Data Controller is subject (Art. 6, co. 1, lett. c) GDPR).

The data are kept for the duration of the contractual relationship and until the statutory limitation period provided for by law for the protection of rights arising from the relationship (Art. 2946 et seq. of the Italian Civil Code).

They may be disclosed to public administrations, credit institutions and insurance companies, accountants, auditors and lawyers, who act as Data Controllers; they may also be disclosed to external IT service providers who act as Data Processors.

3. MODE OF PROCESSING AND SCOPE OF DATA CIRCULATION

The processing of personal data is carried out by means of the operations specified in Art. 4, co. 1, no. 2) of the GDPR, i.e. by collection, recording, storage, adaptation, extraction, consultation, use and deletion of the same.

Personal data are collected and processed by duly instructed personnel in accordance with Article 29 GDPR and in compliance with confidentiality obligations.

Processing operations are carried out using IT systems suitable to ensure data security and confidentiality and, where necessary, by means of paper media.

The data are not subjected to automated decision-making that would have a significant effect on the Data Subject.

PRAXI S.p.A. takes appropriate technical and organizational measures to protect data in order to ensure a level of security appropriate to the risk of misuse, loss or unauthorized access.

The management and storage of personal data take place on servers located within the European Union owned by PRAXI S.p.A. and/or third-party companies acting as Data Processors.

4. RIGHTS OF THE DATA SUBJECT

PRAXI S.p.A. ensures at all times that the Data Subject may exercise the rights provided for under the GDPR:

• Right of access, i.e., the ability to obtain confirmation from the Data Controller as to whether or not their data is being processed and to obtain the information contained herein (Art. 15 GDPR);
• Right to rectification or integration of inaccurate or incomplete personal data (Art. 16 GDPR);
• Right to cancellation, if the processing is not required by law or contract or necessary for the Controller to exercise its rights in court (Art. 17 GDPR);
• Right to restriction of processing, i.e., the right to request that data be processed only for the purpose of preservation to the exclusion of other processing (Art. 18 GDPR);
• Right to object to processing that occurs in pursuit of the legitimate interest of the Data Controller (Art. 21 GDPR).

The Data Subject may exercise the above rights by writing to the e-mail address privacy@praxi.praxi; if the Data Subject believes that the processing concerning him/her violates the Privacy regulations, he/she may write to the e-mail address dpo@praxi.praxi or lodge a complaint with the Guarantor for the Protection of Personal Data (www.garanteprivacy.it).

Privacy Notice on the Processing of Suppliers’ Personal Data – Rev. 5

European Regulation 2016/679 (General Data Protection Regulation, hereafter ‘GDPR’) and the relevant Italian legislation regulate the processing of ‘personal data’, i.e. any information concerning an identified or identifiable natural person. In compliance with these provisions, PRAXI S.p.A. hereby describes the manner in which it collects and processes the personal data of the Candidate (hereinafter also the “the Data Subject”) used to carry out Personnel Search and Selection services on behalf of the Client Companies.

PRAXI S.p.A. is an Employment Agency authorized by the Ministry of Labor and Social Policies to carry out the activity of Personnel Search and Selection, aut. no. 13/I/0003868/03.04, and the activity of Vocational Outplacement, aut. no. 39/0006096/MA004.A003.

1. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is PRAXI S.p.A. with registered office in Turin, Corso Vittorio Emanuele II No. 3, tax code and VAT number 01132750017, privacy@praxi.praxi.

The Data Protection Officer (DPO), appointed by the Data Controller pursuant to Articles 37 et seq. GDPR, is Dr. Annalisa Settimo who can be contacted at the email address dpo@praxi.praxi.

2. PURPOSE OF PROCESSING, LEGAL BASIS, CATEGORIES OF DATA PROCESSED, POSSIBLE RECIPIENTS, AND RETENTION TIMES

PRAXI collects personal data from Candidates in accordance with the principles of lawfulness, fairness and transparency and in compliance with the principle of minimization, i.e., acquiring and processing data limited to what is necessary for the performance of Personnel Search and Selection services provided on behalf of Client Companies:

• processing is necessary for the execution of pre-contractual measures taken at the request of the Data Subject (art.6(b) GDPR);
• the personal data processed are those communicated by the Candidate by sending his or her resume to PRAXI or to the Principal Companies, by registering on PRAXI’s Candidate Portal or on professional networks on the Internet, or during direct contact. Personal data may also be provided by third parties, such as acquaintances of the Candidate, colleagues or employers. Examples include, but are not limited to, first and last name, date and place of birth, residence, domicile, email address, telephone number, education, academic training, professional skills and experience, employer, job position, photograph, if any.
• when strictly pertinent to the purpose of the ongoing recruitment service, information related to the health of Candidates, collected directly from the Data Subject, may be processed;
• where inherent to the purpose of processing and in accordance with applicable laws, processed personal data may be transmitted to the following categories of entities, acting as Data Controllers:
  • Potential employers;
  • A company in the Praxi Alliance network of global executive search firms;
  • Authorities to which communication may be required by law.
• there are also external IT service providers acting as Data Processors;
• the Candidate’s personal data are retained until the Candidate deletes his or her account from the Portal or until five years have elapsed since his or her last access to the professional profile. The Candidate can delete his or her account independently and at any time by accessing the Candidate Area of the PRAXI Portal. At the end of the procedure, the notice of cancellation appears and a confirmation email is also sent. In case of failure to access their account, each Candidate annually receives an automatic email with an invitation to update their professional profile. In the event that the Candidate does not access his or her professional profile for five consecutive years, he or she receives an automatic email informing of the upcoming deletion of the account. In the event that the Candidate does not log in in the next thirty days after receiving this information, the account is automatically deleted from the system, after a final notice is sent twenty-four hours before the deletion. The procedure ends with the sending of an email confirming the deletion.

3. MODE OF PROCESSING AND SCOPE OF DATA CIRCULATION

The processing of personal data is carried out by means of the operations indicated in Art. 4, co. 1 no. 2) of the GDPR, i.e. by collection, recording, storage, adaptation, extraction, consultation, use and deletion of the same.

Personal data are collected and processed by duly instructed personnel in accordance with Article 29 GDPR and in compliance with confidentiality obligations.

Processing operations are carried out using IT systems suitable to ensure data security and confidentiality and, where necessary, by means of paper media.

PRAXI takes appropriate technical and organizational measures to protect data in order to ensure a level of security appropriate to the risk of misuse, loss or unauthorized access.

The data are not subject to automated decision-making that produces legal effects concerning the Data Subject or similarly significantly affects the Data Subject.

The management and storage of personal data take place on servers located within the European Union owned by PRAXI S.p.A. and/or third-party companies acting as Data Processors.

4. RIGHTS OF THE DATA SUBJECT

PRAXI S.p.A. ensures at all times that the Data Subject may exercise the rights provided for under the GDPR:

• Right of access, i.e., the ability to obtain confirmation from the Data Controller as to whether or not their data is being processed and to obtain the information contained herein (Art.15 GDPR);
• Right to rectification or integration of inaccurate or incomplete personal data (Art.16 GDPR);
• Right to cancellation, if the processing is not required by law or contract or necessary for the Controller to exercise its rights in court (art.17 GDPR);
• Right to restriction of processing, i.e., the right to request that data be processed only for the purpose of preservation to the exclusion of other processing (Art.18 GDPR);
• Right to object to processing that occurs in pursuit of the legitimate interest of the Data Controller (Art.21 GDPR).

The data subject may exercise the above rights by writing to the e-mail address privacy@praxi.praxi; if the Data Subject believes that the processing concerning him or her violates the privacy regulations, he or she may write to the e-mail address dpo@praxi.praxi or lodge a complaint with the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it).

Privacy Notice on the Processing of Candidates’ Personal Data – Rev. 6