Information on the processing of the applicants’ personal data

The Company has appointed a Data Protection Officer, who can be contacted at the following e-mail address: dpo@eni.com.

The personal data collected belong to the following categories and may be collected directly, indirectly and/or automatically, as follows.

a.    Data collected directly

The Company may process data directly communicated by you through your CV and the recruitment procedure, such as so-called common personal data (e.g. personal and contact details, professional and/or life experience data, etc.).

Finally, your data may be processed in order to take part in career guidance courses, workshops, cultural and informational events which may be recorded and which may require the processing of information, images, video or audio that concern you (in specific cases following your prior consent). They may also be processed to record or demonstrate knowledge of a foreign language or other skills.

At any rate, we kindly ask you not to include in your CV and/or disclose to the Company during the interview any data of a sensitive nature or information from which such data can be deduced (e.g. relating to your health, political opinions, sex life, etc.), except for those that are required by law to assess your CV (e.g. if you belong to a protected category, or data required for compliance with immigration regulations, etc.).

b. Data collected through other sources

The Company may process data collected through other public and/or private sources, such as social media platforms (if shared by you), recruitment companies, application assessment companies, referrers, whenever the applicable legislation allows it.

c. Data collected automatically

The Company may process data collected automatically when you send communications through electronic means (e.g. e-mail, SMS, WhatsApp, etc.) or access an application portal provided by the Company via the Internet (e.g. URL, date and time of visit, pages selected, IP address, etc.).

a.    Legal purposes - processing is necessary to comply with a legal requirement to which the data controller is bound

Personal data may be processed without requesting your consent in cases where this is necessary to fulfil obligations arising from legal provisions relating to civil law and taxation, from EU regulations, as well as from regulations, codes or procedures approved by Authorities and other competent Institutions.

Your personal data may also be processed in order to comply with requests by the competent administrative or judicial authorities and, more generally, by public bodies in compliance with legal procedures.

The provision of data is necessary to enable compliance with regulatory obligations and failure to provide them will make it impossible for the Controller to carry out the recruitment process in all its stages.

b.    Purpose of staff recruitment - Measures adopted to comply with a request from the data subject 

Your personal data will be processed for the purpose of recruiting staff in the interest of Eni and of its directly or indirectly owned subsidiaries or affiliates.

The provision of data is necessary for operational or contractual purposes and failure to provide them will make it impossible for the Controller to carry out the recruitment process in all its stages. The data will be processed also by electronic means, recorded in appropriate Company databases and used strictly and exclusively for the purposes for which they were collected.

c. Legitimate interest of the Data Controller

The Controller may process your personal data without your consent in the following cases:

- in the case of extraordinary merger, sale or transfer of a business unit, in order to allow due diligence and pre-transfer operations to be carried out. It is understood that only the data that are exclusively necessary for the above-mentioned purposes will be processed, and in the most aggregate/anonymous form possible;

- whenever it is necessary in order to verify, exercise or defend a right of the Controller or of other companies within Eni's scope of consolidation in judicial proceedings;

- when analysing in an anonymous and aggregate form the recruitment procedures in which the data subject has taken part, in order to identify his/her habits and preferences and to improve the recruitment process.

For the purposes set out in section 4, the Controller may disclose your personal data to third parties, such as the following entities or categories of entities:

- police forces, armed forces and other public administrations to comply with obligations laid down by law, regulations or EU legislation. In such cases, in accordance with the applicable data protection regulations, there is no obligation to obtain prior consent from the data subject for such disclosures;

- companies, bodies or associations, i.e. parent, subsidiary or associated companies, and companies under joint control, as well as consortia, networks of companies and temporary groupings and associations of companies and their participants;

- companies specialising in recruitment on behalf of Eni and its direct or indirect subsidiaries or affiliates;

- other companies with contractual bonds with the Controller that provide, by way of example, IT services, consultancy, support for the provision of services, etc.

The Controller guarantees it will act with the utmost care to ensure that the communication of your personal data to the aforementioned recipients only concerns the data necessary to achieve the specific purposes they are intended for.

Your personal data are stored in the Data Controller's databases and will only be processed by authorised staff. The latter will be given appropriate instructions on the manner and purpose of processing. Your data will not be disclosed to third parties, except as specified above and, in any case, within the limits indicated therein.

Finally, we remind you that your personal data will not be disclosed, except in the cases described above and/or provided for by law.

For some of the purposes indicated in section 4, your personal data may be transferred outside the EEA, also by uploading them to databases shared and managed by third party companies that may or may not be within Eni's scope of consolidation. The management of the database and the processing of such data are bound to the purposes for which they were collected and are carried out in full compliance with the standards of confidentiality and security as laid down in the applicable data protection laws.

Whenever your personal data are transferred outside the EEA, the Controller will adopt all appropriate and necessary contractual measures to ensure an adequate level of protection of your personal data in accordance with this privacy statement, including, among others, the Standard Contractual Clauses approved by the European Commission.

The data will be kept for no longer than is necessary for the purposes for which they were collected or subsequently processed, in accordance with legal provisions. They will be deleted after a maximum period of two years from the date on which they were sent or last updated if there is no contact from the Company following your application.  If the Company does contact you, the data will be deleted after a maximum of five years from the end date of an unsuccessful recruitment process to allow the Company to consider your application for other positions, unless you specifically request not to be considered any further.

As the data subject, you have the following rights with regard to personal data collected and processed by the data controller for the purposes set out in section 4: (i) the right of access, and specifically of requesting at any time whether your personal data are found in the Company's files and the communication to you of such information in a clear and intelligible form, as well as the right to know the origin, the logic and the purpose of processing by specifically indicating the persons in charge of it and the third parties to whom your data may be communicated. (ii) the right to update and rectify data (except for evaluative data), to delete data that are superfluous or to transform them into anonymous form, as well as to block processing and to obtain the permanent erasure of data processed unlawfully; and (iii) where applicable, restriction of processing and portability of data. The law also recognises your right to lodge a complaint with the competent supervisory Authority for the protection of personal data if you believe that your rights under the applicable data protection legislation have been violated.