Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree 196/2003 · Last updated 21 October 2026
This is an English translation provided for convenience; in case of discrepancy, the Italian version (in Italian) prevails.
1. Who processes your data
The data controller is Servizi Ausiliari Integrati S.r.l., a member company of the Consorzio Demetra Global Solutions, with registered office at Via Camillo Riccio 7, Turin, Italy, tax code 13024420013. For any privacy-related request you can write to privacy@demetragroup.it.
The Data Protection Officer (DPO) is Vincenzo D’Ambrosio, who can be contacted at the same address: privacy@demetragroup.it.
2. What data we process, why, and on what legal basis
| When | Data | Why | Legal basis | How long |
|---|---|---|---|---|
| Contact or quotation request | Name, email, telephone (optional), sector, content of the message | To reply and, if requested, to prepare an offer | Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) | 24 months from the last contact, unless a contract results |
| Download of the «Dopo il furto» (“After the theft”) kit | Name, email, company, job title | To send you the requested document | Performance of your request (Art. 6(1)(b) GDPR) | 24 months from the request |
| Updates on regulations and retail security | Name, email, company, job title | To send you updates and communications about our services | Your optional consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time | Until consent is withdrawn |
| Job application via the «Lavora con noi» (“Work with us”) page | Name, email, phone number, province; answers to the questionnaire (experience, certificates, availability, education, languages, computer skills, driving licence, current employment status, contracts accepted); curriculum vitae and its contents, message; optionally, membership of the protected categories (Law 68/1999) | To assess the application for current and future vacancies and to prepare the interview | Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR); for unsolicited CVs consent is not required (Art. 111-bis of Legislative Decree 196/2003); for membership of the protected categories, obligations and rights in the field of employment (Art. 9(2)(b) GDPR and Law 68/1999) | 12 months from receipt, then deletion |
| Browsing the website | Technical data and aggregated visit statistics | Website security and measurement of page usage | Legitimate interest (Art. 6(1)(f) GDPR); for non-essential cookies, consent via the banner | See the Cookie policy |
Job applications. Please do not include in your CV any data that is not necessary for the assessment: health information, religious or political beliefs, trade union membership, photographs of identity documents. Documents required by law or by the collective agreement, including the criminal record certificate, are requested only at the time of hiring, not with the application.
Application scoring. The «Lavora con noi» form contains ten questions on interest in the job, experience, qualifications, availability of hours, mobility and skills. Each answer carries a fixed score, the same for everyone; the total, from 0 to 100, is used only to determine the order in which our Recruitment Office reviews applications. The score does not exclude anyone: every application is read by a person, who compares the answers with the CV and may correct the score. It is therefore not a decision based solely on automated processing within the meaning of Art. 22 GDPR. You may always ask to be told the score given to your application and to have it reviewed. The information in the «Per il colloquio» (“For the interview”) section, such as education, languages, driving licence and employment status, does not count towards the score.
Protected categories. The question on membership of the protected categories (Law 68/1999) is optional: answering “No” or “I prefer not to say” has no effect on the assessment. It is used only to know whether the hiring may fall within the quotas and incentives provided for by law. We do not ask for diagnoses or medical documents with the application: any documentation is requested only at the hiring stage. The information is seen only by the staff in charge of recruitment and is kept for the same period as the application.
3. How we process the data
Data is processed electronically by authorised and trained staff, with appropriate security measures: encrypted connection (HTTPS), protected access to the website’s admin panel, and storage of uploaded files outside the website’s public media library. We do not take decisions based solely on automated processing and we do not carry out profiling.
4. To whom the data may be disclosed
- To Group staff responsible for responding to requests and managing recruitment.
- To the other companies of the Consorzio Demetra Global Solutions, where the request or job position concerns their services: in that case they process the data as independent controllers, solely for the purposes set out in this notice.
- To the providers who help us run the website and email, appointed as data processors: Aruba S.p.A. for website hosting, in Italy; Google Ireland Limited for business email (Google Workspace).
- To public authorities, only where required by law.
The data is neither disseminated nor sold. The website and its data remain in Italy. For email, Google may also process data in the United States: the transfer takes place on the basis of the European Commission’s adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework), to which Google LLC adheres, and of the standard contractual clauses provided for by Art. 46 GDPR.
5. Statistics and cookies
For visit statistics we use Burst Statistics, installed on our own server: the data stays with our hosting provider and is not shared with third parties. Fonts are hosted on the website and are not loaded from external servers. Details of cookies and your preferences can be found in the Cookie policy and in the banner, which you can reopen at any time.
6. Whether providing data is mandatory
Fields marked with an asterisk in the forms are necessary to respond to your request: without them we cannot follow it up. Consent to receive updates is always optional, and refusing it does not prevent you from receiving the kit.
7. Your rights
At any time you may request access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest (Arts. 15-22 GDPR). You may withdraw consent already given without affecting the lawfulness of prior processing. Simply write to privacy@demetragroup.it: we reply within one month.
If you believe that the processing infringes data protection law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).
8. Changes
We may update this notice when the website’s services or the law change. The date at the top indicates the latest version.