Informativa Candidati


This privacy notice (the “Privacy Notice”) pursuant to article 13 of European Regulation No 2016/679 (the “GDPR”) is considered issued to the data subjects who have applied for a job with Pirola Pennuto Zei & Associati on the website (“the site”). This Privacy Notice shall not apply to other websites accessed through external links.

Before submitting your personal data, the Controller asks you to read this privacy notice carefully, as it contains important information on Personal Data protection and the security measures put in place to ensure the confidentiality of personal data in accordance with the provisions of the GDPR.

* * *


The Controller shall be Studio Pirola Pennuto Zei & Associati, with registered office in Milan, via Vittor Pisani, 20, VAT number 06946520159 (hereinafter the “Controller” or “Pirola Pennuto Zei & Associati”).

The Controller has appointed a Data Protection Officer (the “DPO”), who may be contacted at


During the recruitment process, the Controller will gather the following data:

  1. Personal data such as first name, last name, gender, Italian fiscal code, resident address and phone number, place and date of birth, e-mail address, data concerning any self-certifications, data concerning education, professional certifications and registrations, language skills, attendance at training courses
  2. Special categories of personal data such as personal data revealing racial or ethnic origin, political opinion, religious or philosophical convictions, union membership, data on a person’s health, sex life or sexual orientation.

In this regard, unless strictly necessary, we would please ask you not to provide such information. Should you decide in any case to provide it, we point out that the Controller shall process such special categories of personal data only if necessary to achieve the purposes set out below, in accordance with the “Rules on the processing of special categories of personal data in employment relationships” (Italian Data Protection Authority’s Authorization no. 1/2016) and with the provisions of the GDPR.

Furthermore, the optional, explicit and voluntary sending of documents, certificates, reference letters and CVs through the site shall result in obtaining personal data which may potentially give rise to the accidental processing of third-party information by the Controller. In these cases, you will be deemed to be the controller, with the associated legal obligations and responsibilities. In this regard, you agree to indemnify and hold the Controller harmless against any claims, demands, claims for damages in connection with processing etc. made by any third parties whose personal data were processed as a result of your spontaneous submission of data, in breach of the applicable data protection regulations.

With regard to the personal data of any third parties you may provide and/or process, you hereby agree – and accept the related responsibility – that such particular processing relies on adequate legal basis in accordance with article 6 of the GDPR, regarding lawful processing of the information.



The Controller may process your personal data for the following purposes:


a)       To evaluate your profile for the positions open with the Controller and, in general, make the necessary evaluations as to whether an employment or other work relationship may be established between you and the Controller;

b)      To contact you on the details you will provide for the purposes of the selection process.

The legal basis for processing your Personal Data for the purposes set out above is contained in article 6(b) and (c) of the GDPR, pursuant to which:

–          processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract;

–          processing is necessary for compliance with a legal obligation to which the controller is subject.


Solely with regard to the Processing of special categories of personal data, the legal basis shall be article 9(2)(b) of the GDPR, within the limits laid down in the “Rules on the processing of special categories of personal data in employment relationships” (Italian Data Protection Authority’s Authorization no. 1/2016).

The submission of your personal data for these purposes is not mandatory, but failure to do so may involve the Controller’s inability to evaluate your application and consider you in the staff selection process.


Your personal data, including the special categories of data, may be shared with:

  1. persons appointed to act as data processors and/or sub-processors;
  2. persons authorized by the Controller to process Personal Data and who have agreed to maintain confidentiality or are subject to adequate confidentiality obligations.

Except for the above cases, your data will not be provided to anyone other than persons, entities or Authorities to whom the data are to be disclosed pursuant to the law or regulations.

Your personal data shall not be transferred outside the European Economic Area.



Your personal data, including the special categories of data, shall be kept for the purposes set out above for a period of twelve (12) months after their submission and may be used for any future contacts and interviews. At the end of such period, your data shall be permanently deleted or anonymized.

If the recruitment process is successful, the Controller shall process your personal data as stated in the privacy notice prepared for the consultants of Pirola Pennuto Zei & Associati.



You are entitled at all times to request access to your personal data, to object to their processing, and ask the Controller to amend or delete them; you shall also be entitled to ask for restriction of processing in the cases set out in article 18 of the GDPR or receive the personal data concerning you in a structured, commonly used and machine-readable format in the cases set out in article 20 of the GDPR.

Please send your requests to the following address:

Finally, if you believe that processing of your data infringes the applicable law, you may file a complaint with the Italian Personal Data Protection Authority (Garante per la Protezione dei Dati Personali) pursuant to article 77 of the GDPR.


Last updated: May 2021.