Candidate privacy notice

Draft for legal review before publication.

Data controller

GRM Holding S.r.l., Via Pietro Scavini 2/A, 28100 Novara (NO), Italy. Contact: info@grmholding.eu.

Purpose and data

We process identification and contact data, CV content and information voluntarily supplied to manage spontaneous applications and identify the group companies most relevant to the candidate’s professional interests.

AI-assisted routing and human review

An AI system may analyse CV content solely to suggest internal routing. It does not make hiring, rejection or employment decisions. An HR professional reviews the CV and chooses whether and where it should be forwarded.

Recipients

Following human review, the CV may be shared with one or more GRM group companies relevant to the profile. Service providers supporting hosting, security and AI processing may process data under appropriate contractual safeguards.

Retention

Applications should be retained only for the period established by GRM Holding’s approved retention policy and then securely deleted.

Rights

Candidates may request access, correction, deletion, restriction or objection by contacting info@grmholding.eu and may contact the competent supervisory authority.

International transfers

Any transfer outside the European Economic Area must rely on a valid GDPR transfer mechanism and be described in the final approved notice.