Match S.r.l., with registered office in Viale Carlo Espinasse 143 – 20156 Milano, C.F. e P. IVA 02844730123, as Data Controller, hereby informs you, pursuant to Articles 13 and 14 of EU Regulation No. 2016/679 (hereinafter “GDPR”), that the data you provide in the manner and purpose set out below. This notice refers to the data collected through the “Recruiting” and “Work with us” pages of the matchsrl.it website, in relation to both open positions and unsolicited applications.
1. Subject Matter of the Processing
For the purpose of establishing and managing the relationship in progress with you, the Data Controller processes:
- Your personal identification and contact data (e.g. first name, surname, e-mail address, telephone number, region, province, and municipality of residence, etc.);
- Where disclosed, your health-related data (e.g. legally protected status);
- Your Curriculum, and solely object to your optional consent, a photograph of you.
2. Purposes of the Processing and Legal Basis
- Pursuant to Article 111-bis of Legislative Decree No. 196/2003, and within the limits of the purposes referred to in Article 6(1)(b) of the Regulation, consent to the processing of personal data contained in curricula is not required.
- Your sensitive personal data, where provided at the interview stage, are processed without prior express consent, in accordance with Measure No. 146 of 5 June 2019 issued by the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).
- With regards to the photograph accompanying the Curriculum, such processing takes place exclusively on the basis of your free and specific consent (Article 6(1)(1) GDPR), which may be withdrawn at any time.
3. Nature of the Data Provided and Consequences of Failure to Provide Data
The provision of data for the purposes referred to in points 2.a) and 2.b) is necessary for the performance of pre-contractual measures adopted at the request of the data subject. In the absence of such data, it will not be possible to evaluate the application. The provision of the photograph referred to in point 1.c), on the other hand, is optional: the related processing is based on your consent, and failure to provide it does not in any way affect the evaluation of your application.
4. Access to Data, Communication, and Dissemination
Your data may be made accessible to:
- Employees and collaborators of the Data Controller, in their capacity as persons authorised to process data pursuant to Article 29 GDPR and/or as system administrators;
- Third-party companies or other parties (by way of example: consultants and self-employed professionals, including associated form; etc.) that carry out outsourced activities, including, by way of example, the providers of the application management platform and the provider of hosting and maintenance services for the website on behalf of the Data Controller, acting in their capacity as external data processors.
Your data will not be disseminated.
We further inform you that, in order to protect the application form from the automated submission of messages, we use the reCAPTCHA services provided by Google Ireland Limited, which processes your IP address and certain information regarding your interaction with the page as an autonomous data controller, in accordance with its own privacy notice (policies.google.com/privacy).
5. Data Transfer
We inform you that, as a general rule, we seek to avoid transfer of data outside the European Union. It remains understood, in any case, that the Data Controller shall be entitled, where necessary, to transfer data to non-EU countries. In such cases, the Data Controller hereby assured that any transfer of data outside the EU will take place in compliance with applicable legal provisions, by entering into, where necessary, agreements ensuring an adequate level of protection and/or by adopting the Standard Contractual Clause provided for by the European Commission and/or Binding Corporate Rules. In particular, the use of the reCAPTCHA service on the application submission page may involve the transfer of your IP address to Google Ireland Limited, including to the United States, on the basis of the EU-U.S. Data Privacy Framework of 10 July 2023 (for certified organisations) or of the Standard Contractual Clauses approved by the European Commission (Article 46 GDPR).
6. Data Retention
All personal data provided will be processed in compliance with the principles of lawfulness, fairness, relevance, and proportionality, using only the methods, including IT and telematic methods, strictly necessary to pursue the purposes described above.
Personal data will be retained for 12 months from the date of collection. In the event of a request for erasure by the data subject, data related to the Data Controller’s legitimate interest, or necessary for compliance with legal obligations, may nevertheless continue to be retained. It should be noted that the information systems used to manage the data collected are, from the outset, configured so as to minimize the use of personal data. If, at the time of submitting your application, you authorize us to retain your profile for evaluation in relation to future opportunities, the data will be retained for a further period of 12 months. If you subscribe to the “Job Alert” service in order to receive communications regarding new open positions, such processing is governed by the website’s general privacy notice, to which reference is made.
7. Rights of the Data Subject
Pursuant to Articles 15 to 22 of EU Regulation No. 679/2016, the Data Subject is granted the possibility of exercising specific rights. In particular, the Data Subject has the right to:
- obtain confirmation as to whether or not personal data concerning them exist, and, if so, to access such data;
- obtain the rectification of inaccurate personal data and the completion of incomplete personal data;
- obtain the erasure of personal data concerning him or her, in the cases permitted by the Regulation;
- obtain the restriction of processing, in the cases provided for by the Regulation;
- obtain communication, to the recipients to whom the personal data have been transmitted, of any rectification or erasure of personal data or restriction of processing carried out at the request of the Data Subject, unless this proves impossible or involves disproportionate effort;
- receive, in a structured, commonly used, and machine-readable format, the personal data provided to the Data Controller, as well as have such data transmitted to another data controller, at any time, including upon termination of any relationship maintained with the Data Controller;
- object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her pursuant to Article 6(1)(e) or (f), including profiling based on such provisions. Where personal data are processed for direct marketing purposes, the Data Subject has the right to object at any time to the processing of personal data concerning him or her carried out for such purposes, including profiling to the extent that it is related to such direct marketing;
- not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her;
- lodge a complaint with a supervisory authority pursuant to Article 77.
Where the processing is based on your consent (e.g., for the photograph), you may withdraw it at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal (Article 7(3) GDPR).
8. Exercise of Rights
You may exercise your rights at any time by contacting the Data Controller at the following e-mail address: privacy@matchsrl.it
9. External Data Processors and Authorized Persons
The updated list of external data processors and of persons authorized to process data is kept at the registered office of the Data Controller; You may request a copy thereof by writing to privacy@matchsrl.it
10. Right to Lodge a Complaint with the Supervisory Authority
Should you believe that the processing violates your rights in any way, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) pursuant to Article 77 GDPR, with registered office at Piazza Venezia n. 11, 00187 Rome, e-mail protocollo@gpdp.it – checking the applicable procedures on the website www.garanteprivacy.it. In any case, your right to apply to the competent judicial authority remains unaffected (Article 79 GDPR).
11. Data Protection Officer
Pursuant to Articles 37 et seq. of EU Regulation No. 679/2016, please be informed that the Data Controller has appointed, as its DATA PROTECTION OFFICER (DPO), the company CONSULENTI PRIVACY SRL, with registered office at Via Valentini n. 11, 47923 Rimini (RN), C.F. e P. IVA 04391970409, Tel. 0541 1798723, e-mail dpo@matchsrl.it, certified e-mail (PEC) consulentiprivacy@postaleg.it. You may contact the DPO for any matter relating to the processing of your personal data and the exercise of your rights.
12. Updates to this Notice
This notice may be updated in order to bring it into line with new regulatory provisions, measures issued by the Supervisory Authority, or changes to the selection process. The version in force is always published on the matchsrl.it website: We invite you to consult it periodically.
Last update: 29th July 2026