Privacy Policy for candidates: Satispay Group

1. Who is the data controller and how can you contact the DPO?

The data controller is the company belonging to Satispay Group at which you would be hired (depending on job openings, Satispay Europe S.A., SatisWelfare S.p.A., Momentum S.p.A., Satispay International S.à.r.l., jointly “Satispay”). In all cases, regardless of which company is the data controller, this privacy policy shall apply.

Satispay has appointed a data protection officer (“DPO”) who may help with any questions about the data processing we carry out and/or how to exercise your rights. You can reach our DPO at dpo@satispay.com.

2. How does Satispay collect personal data?

In the context of recruiting processes, Satispay collects personal data from candidates as well as through external consultants who support Satispay in searching for profiles in line with the relevant job position and, if applicable, in verifying the information provided by candidates.

3. What types of personal data does Satispay process? For what purposes and on what legal basis?

Satispay processes biographical data (e.g., first name, last name, residence address), contact data (e.g., phone number, e-mail), education data (e.g., schools and universities attended), as well as any other information included in CVs and/or collected during the recruitment process (which, in the case of a job opening dedicated to individuals having a “legally protected status,” may also include health data). Such personal data shall be processed for the following purposes and on the basis of the following legal bases:

1. to manage recruitment processes and follow up on relevant applications, to the extent that such processing is necessary for the performance of pre-contractual measures taken at the request of the data subjects (art. 6.1, lett. B, GDPR). For the pursuit of this purpose, Satispay may also use machine learning models that help in managing job applications without, however, affecting the final choice of candidates;
2. to comply with legal obligations, as well as requests from the relevant authorities, to which Satispay is subject (art. 6.1., lett. C, GDPR and, in case health data are processed, art. 9.2, lett. B, GDPR);
3. to carry out statistical analysis to improve recruitment processes, based on Satispay’s legitimate interest (art. 6.1, lett. F, GDPR).

4. Who can receive personal data?

Only where strictly necessary, Satispay may share personal data with:

• Satispay group’s staff who provide intercompany services;
• external counsultants who support Satispay in searching for profiles in line with the relevant job position and, if applicable, in verifying the information provided by candidates;
• service providers for IT, communication and compliance;
• where requested, competent authorities, including financial institutions, courts, law enforcement agencies and public administrations.

These recipients may, as the case may be, act as autonomous data controllers or as data processors. Data processors follow Satispay’s instructions.

5. Where is data stored and where may it be transferred?

Personal data is stored on servers located in the European Union. If needed for specific purposes, personal data is also transferred to companies located outside the European Union. In this case, Satispay ensures that the data is processed safely and that it has entered into agreements that guarantee an adequate level of protection and/or include the standard contractual clauses provided by the European Commission.

6. How does Satispay ensure the security of personal data?

Satispay has set up strong internal data security measures as well as technical and organisational measures (like encryption, pseudonymization and anonymization) to keep personal data safe from accidental loss, misuse, alteration, destruction and/or unauthorised access.

7. How long does Satispay retain personal data?

For the purposes outlined above, Satispay retains your personal data for no longer than two years from the moment you submitted your latest application. Shortly before the expiration of the two-year period, Satispay may contact you to request your consent for an additional two-year retention period, so that we may consider you for any future job opportunities that might match your profile. You may withdraw your consent at any time during additional two-year retention periods, in accordance with paragraph 8 below. However, where you have been proactively searched/contacted by Satispay and nevertheless have not formally applied for the proposed job position, your personal data shall be retained in any case for no more than six months from the collection. In all cases, personal data may be stored longer in the event of disputes or requests by the competent authorities.

8. Which rights may you exercise?

You may exercise at any time the following rights:

• the right to know whether your personal data are being processed, and, if this is the case, access it (right of access);
• the right to correct inaccurate or outdated personal data (right to rectification);
• if possible, the right to obtain the erasure of your personal data (right to erasure).
• if possible, the right to limit data processing (right to restriction of processing);
• the right to receive and share your personal data with another controller in a common format (right to data portability);
• if possible, the right to object to data processing based on legitimate interest (right to object).
• the right to withdraw any consent given for the further storage of your personal data (right to withdraw consent).