Candidates' Privacy Notice 

Our commitment to your personal data

We take your personal security and privacy seriously. Our Candidates' Privacy Notice outlines how we responsibly collect, use, share and protect your data throughout the recruitment process.

Prima Global Recruitment - Candidates’ Privacy Notice

pursuant to artt. 13 and 14 EU Regulation 2016/679

This Privacy Notice applies to anyone wishing to pursue a job career at Prima, either by applying directly through our official channels or through a personal referral and describes how companies part of Prima Group (“we”, “us” or “Prima Group”) jointly collect and process your personal data (“Data”) in connection with applications for employment with us, how we use and protect this information and what are your rights,pursuant to artt. 13 and 14 EU Regulation 2016/679 (“GDPR”).


For any request or information, please send an e-mail to our designated contact point: privacy@prima.it. If you prefer, you can directly use the contact for your specific Country.


The Joint Controllers (each one the “Controller”) and Data Protection Officer (“DPO”) are:

  • Prima Assicurazioni S.p.A., with registered office at Piazzale Loreto 17, 20131 Milano, Italy - VAT No. 08879250960;
    DPO: dpo@prima.it
    DSR: privacy@prima.it
  • Prima Assicurazioni S.p.A., Sucursal en España, with registered office at Nanclares de Oca 1B, 28022 Madrid, Spain - VAT No. W0233473H;
    DPO and DSR: es-dpo@helloprima.com
  • Prima Assicurazioni S.p.A., German Branch, with registered office at Kurfürstendamm 21/Regus-Berlin KuDamm 21, 10719 Berlin, Germany - VAT No. HRB242956B
    DPO: dpo@prima.it
    DSR: privacy@prima.it
  • Prima, Hello Prima, with registered office at Paul van Vlissingenstraat 24, 1096BK Amsterdam, Netherlands - VAT No. NL863920287B01
    DPO: dpo@prima.it
    DSR: privacy@prima.it
  • Prima Subsidiary Ltd, with registered office at 71-73 Carter Lane, EC4V 5EQ London, United Kingdom - VAT. No. 432254130
    DPO: admin@digitallaw.com
    DSR: help@helloprima.co.uk


Data processed by Prima Group

The Data that we may collect directly from you are:

  1. identifying data (e.g. full name, date of birth,address, marital status and tax code);
  2. contact details (e.g. phone number, e-mail address, postal address or mobile number);
  3. information contained in your resume or CV and other documents related to the application or recruitment process (e.g. questionnaire, cover letter, transcripts, certifications);
  4. educational details (e.g. educational history, qualifications, certifications, skills);
  5. citizenship or immigration information;
  6. information related to professional social media profile you may want to share with us;
  7. other information you may choose to submit to us in connection with your application;
  8. Data belonging to “special categories” (pursuant to art. 9 GDPR), where specific job positions require their processing. Through your CV, or subsequently, we may collect health related Data. Where present in your CV, if unnecessary, we refrain from processing them.


We can also collect some of the above-mentioned Data from other sources, such as:

  1. head-hunters or recruitment and temp agencies;
  2. Prima employees, in case of referral;
  3. information about your relationship with Prima, including prior work experience or association you may have with any current or former Prima employees.


Purposes and legal basis of the processing

We use your Data to:

  1. assess your skills, qualifications and interests against the job position applied for and other positions within Prima Group;
  2. communicate with you in relation to your application, the recruitment process and to arrange interviews;
  3. deal with your enquiries and requests.

The legal basis for the above-mentioned purposes is the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (art. 6, lett. b), GDPR).

  1. comply with legal obligations to which we are subject and cooperate with regulators and law enforcement bodies.

The legal basis for the above-mentioned purpose is compliance with a legal obligation to which the Joint Controllers or each Controller are subject (art. 6, lett. c), GDPR).

  1. detect, prevent and respond to fraud or potentially illegal activities, misuse of the recruitment system, intellectual property infringement or other violations of law or Prima Group policies;
  2. if necessary, to ascertain, exercise and/or defend the Joint Controllers’ or each Controller’s rights in court.

The legal basis for the above-mentioned purposes is the legitimate interests pursued by the Joint Controllers or each Controller (art. 6, lett. f), GDPR).

  1. carry out the obligations and exercising specific rights of the Joint Controllers or each Controller or of the data subject in the field of employment and social security and social protection law or a collective agreement pursuant to EU Member State law.

The legal basis for the above-mentioned purpose is fulfil legal obligations to which Joint Controllers or each Controller are subject in respect of special categories of personal data (art. 9, par. 2, lett. b), GDPR).

Any failure to provide the Data may prevent or delay the fulfilment of these purposes.

Data retention

We store your Data for a period of 24 months following your last application. We will only store your Data after this time if we are required to do so to comply with the law, or if there are claims or complaints that will reasonably require your personal information to be stored. If your application is successful, your information will be part of your employment profile pursuant to any applicable law.

However, you may contact us at any time asking to be removed from our recruitment database.

We will not store any data belonging to special categories if not necessary for the job position.


Recipients of Data

Your Data may be shared with:

  1. any subject appointed by Prima Group as Data Processor, pursuant to art. 28 GDPR;
  2. staff authorized for processing, pursuant to art. 29 GDPR.
  3. third parties acting as independent Data Controllers, pursuant to art. 4, n. 7), GDPR (e.g. natural or legal persons, public authorities, agency or others to which Prima Group is required to share your Data by law).


Transfers of personal data to third countries or international organizations

We can transfer your Data outside of the European Economic Area.

The transfer shall always be based, alternatively:

  1. on an adequacy decision, pursuant to art. 45 GDPR; or
  2. on Standard Contractual Clauses, pursuant to art. 46, lett. d), GDPR, considering the case law of the Court of Justice of the European Union and the decisions n. 1/20 and 2/20 issued by the European Data Protection Board.


Data subject rights – Complaint to the Supervisory Authority

Where applicable, in accordance with the provisions of artt. 15 et seq. GDPR, the data subject may contact our designated contact point by sending an e-mail to privacy@prima.it.

Alternatively, the data subject can contact each Controller at the e-mail address indicated in the respective section above (“Joint Controllers - DSR”) and/or the DPO at the respective e-mail address (“Joint Controllers - DPO”) at any time, in order to:

  • request access to the Data concerning him/her, their erasure, the rectification of inaccurate Data, the integration of incomplete Data, as well as the restriction of processing;
  • receive, where applicable, in a structured, commonly used and machine-readable format the Data, as well as, if technically workable, to transmit them to another Data Controller without hindrance (“right to data portability”);
  • oppose the processing in cases of legitimate interest of the Data Controller for reasons related to the particular situation;
  • withdraw at any time the optional and freely given consent.


The data subject also has the right to lodge a complaint with the competent Supervisory Authority.


Last update: v.2 published on 02/10/2023