Information on the processing of the applicants’ personal data

The companies marked with an asterisk in Annex 1 have appointed a Data Protection Officer, who can be contacted at the following email address: dpo@eni.com.

The Company may process Data provided directly by you, contained in the CV and communicated within the recruitment process through the ORC Eni Careers platform and, in the case of applications related to training activities, also communications from training institutions or universities operating in collaboration with the Company. In particular, the following categories of Personal Data may be processed:

• common Personal Data (such as, for example, personal details, contact details, professional and/or personal experience, citizenship, date and place of birth, etc.);
• Special categories of Personal Data (e.g. belonging to protected categories).

During the selection process, additional data may be collected during interviews and/or tests (e.g., technical, language) and you may be asked for audio and/or video recordings to check the level of a certain foreign language or to pre-record an interview.

In any case, we invite you not to include in your CV and/or communicate to the Company during the interview or test or recording of audio / video content Data of a sensitive nature or information from which such Data can be inferred (e.g. relating to the state of health, political opinions, sex life, etc.), except in cases where such information is strictly necessary according to the law for the purposes of selecting and evaluating the CV (e.g. belonging to protected categories, Data necessary for immigration, etc.).

a. Legal purpose - processing necessary to fulfill a legal obligation to which the Data Controller is subject (article 6(1)(c) GDPR)

Personal Data may be processed where this is necessary to fulfill obligations deriving from legal provisions in both civil and fiscal matters, community legislation, as well as rules, codes or procedures approved by Authorities and other relevant Institutions.

Furthermore, your Personal Data may be processed to respond to requests from the relevant administrative or judicial authority and, more generally, from public entities in compliance with legal formalities.

Data entry is necessary to allow compliance with regulatory obligations and any missing Data will make it impossible for the Data Controller to proceed with the selection of the application at all stages of the selection process.

b. Purpose of recruiting and selecting - Measures taken to respond to a request from the interested party in order to take steps at the request of the data subject prior to entering into a contract (article 6(1)(b) GDPR)

Your Personal Data will be processed: i) for the creation of the user account within the ORC Eni Careers platform; ii) for the submission of the application; iii) to carry out recruitment and selection activities (in case of training activities, as well as for admission, also for the possible granting of scholarships). In this context, such Data may be used to send you organizational communications relating to the recruitment process or to activities connected to it (such as for example e-mails relating to the outcome, information about the recordings of interviews and/or language tests).

Data entry is necessary for operational or pre-contractual reasons and any missing Data will make it impossible for the Data Controller to proceed with the selection of the application at all stages of the selection process.

c. Legitimate interest of the Data Controller (article 6(1)(f) GDPR)

The Data Controller may process your Personal Data in the following cases:

1. in the event of extraordinary merger operations, assignment or transfer of a business unit, in order to allow the carrying out of the operations necessary to due diligence activity and of strict relevance to the sale. It is understood that exclusively necessary Data will be processed for the aforementioned purposes, in as much of an aggregated/anonymous form as is possible;     
2. whenever it is necessary to ascertain, exercise or defend a right of the Data Controller or of other companies falling within Eni's legally controlled perimeter;
3. anonymous and aggregated analysis of the use of the selection procedures in which you have taken part, to identify habits and propensities, to improve the selection processes.

Providing the Data, for the purposes set out in points i. and ii., is necessary for operational or defensive reasons. Failure to provide such data will prevent the Data Controller from carrying on the recruitment process.

 d. Consent of the data subject (article 6(1)(a) GDPR)   

The Data Controller, subject to your explicit consent, may process your Personal Data in the following cases:

1. for purposes strictly related to the management of the selection process, special categories of Personal Data may be processed (e.g. belonging to protected categories);
2. to send you, by e-mail, updates on any new open positions published by Eni’ Group.

Providing Data for the above mentioned purposes is optional. In relation to the purpose mentioned in point ii., the Data Controller is Eni International Resources Ltd.

Personal Data may be processed with the aid of electronic or automated systems, managed through tools that ensure security and confidentiality, and will include every operation or set of operations necessary for the processing.

Personal Data are processed by personnel appointed by the Data Controller to pursue the purposes described in section 4, as persons authorised to process. For the pursuit of the purposes indicated in point 4, the Data Controller may communicate your Personal Data to third parties, such as, for example, those belonging to the following subjects or categories of subject:

• Police forces, armed forces and other public administrations, for the fulfillment of obligations established by law, by regulations or community legislation;
• other companies controlled by Eni S.p.A.;
• Companies specialised in the selection of personnel on behalf of Eni S.p.A. and of the companies directly or indirectly controlled or in which it has a stake;
• Training institutions or universities that, within the scope of training activities, collaborate with the Data Controller;
• Other companies contractually linked to the Data Controller who carry out, by way of example, the provision of IT services and maintenance of the ORC Eni Careers platform, consultancy activities, support for the provision of services etc.

We remind you that your Personal Data will not be disseminated, unless required by law.

With respect to the Personal Data disclosed to them, recipients in the above categories may operate, as the case may be, as data processors (in which case they will receive appropriate instructions from the Data Controller) or as independent Data Controllers. The Data Controller guarantees the utmost care so that the communication of your personal data to the aforementioned recipients only concerns the Data necessary to achieve the specific purposes for which they are intended.

Where this serves the purposes described in section 4, Personal Data might also be transferred abroad to companies based outside the European Economic Area (“EEA”). Some of the jurisdictions outside the EEA might not guarantee the same level of Personal Data protection guaranteed within the EEA. In this case, the Data Controller undertakes to regulate the transfer and subsequent processing of the Personal Data through the Standard Contractual Clauses provided by the European Commission and to adopt every other safeguard required by article 46 GDPR if it is not possible to use one of the derogations listed in article 49 GDPR.

The Personal Data will be stored in the Data Controller's filing systems, including automated ones, and protected by appropriate security measures, until the purposes described in section 4 above have been achieved, after which they will be erased. In particular, Data will be deleted after a period of two years from the date of sending or the last update made if no further contact to initiate the selection process is made by the Company following your application. Conversely, in the event of contact and initiation of the selection process, Data will be deleted after a maximum of five years from the endof an unsuccessful selection process. With reference to the contact and Personal Data for sending updates about any new positions opened by Eni, this information will be retained for two years from the moment the data subject gives consent to receive such communications.

Where applicable, and within the limits set by the GDPR, Data Subjects are entitled to:

• obtain confirmation from the Data Controller as to whether or not their Personal Data are being processed, and, where that is the case, access to the information listed in article 15 GDPR;
• obtain from the Data Controller the rectification of inaccurate Personal Data, or, taking into account the purposes of the processing, have incomplete Personal Data completed in accordance with article 16 GDPR;
• obtain from the Data Controller the erasure of Personal Data, where one of the grounds listed in article 17 GDPR applies;
• obtain from the Data Controller the restriction of processing of Personal Data in the cases listed in article 18 GDPR;
• receive - in a structured, commonly used and machine-readable format - the Personal Data provided to the Data Controller, so that the Data Subject may transmit those data to another data controller without hindrance, in accordance with article 20 GDPR;
• object to the processing of their Personal Data on the basis of their particular situation, unless there are compelling legitimate grounds for the processing that override their interests, rights and freedoms or compelling legitimate grounds for the establishment, exercise or defence of legal claims, in accordance with article 21 GDPR;
• revoke their consent.

You can exercise the rights listed above by writing to the Data Controller to whom you have submitted your application, or by writing to the Data Protection Officer, if designated by the companies marked with an asterisk in Annex 1, at the email address DPO@eni.com. Without prejudice to their right to initiate other administrative or judicial proceedings, Data Subjects also have the right to lodge a complaint with the competent supervisory authority (for Italy: Garante per la Protezione dei Dati Personali) if they believe that there has been a breach of their rights with regard to the protection of their Personal Data.