Data privacy policy

Your personal data (e.g. name, house address, e-mail address, phone number) are processed by us only in accordance with the provisions of German data privacy laws. The following provisions describe the type, scope and purpose of collecting, processing and utilizing personal data. This data privacy policy applies only to our web pages. If links on our pages route you to other pages, please inquire there about how your data are handled in such cases.

Inventory data

(1) Your personal data, insofar as these are necessary for a contractual relationship (inventory data) in terms of its establishment, organization of content and modifications, are used exclusively for fulfilling the asked purpose.

(2) Without your explicit consent or a legal basis, your personal data are not passed on to third parties outside the scope of fulfilling this contract. After completion of the contract, your data are blocked against further use. After expiry of deadlines as per tax-related and commercial regulations, these data are deleted unless you have expressly consented to their further use.

Privacy notice for recruitment candidates

According to Section 13 of EU Regulation no. 679/2016, concerning the protection of individuals with regard to the processing of personal data, Reply S.p.A., Reply AG, Reply LTD (hereinafter, “Reply”), hereby provides you with the Privacy notice regarding the processing of your personal data.

Reply together with one or more Reply group companies are the Joint Controllers of this processing activity, as specified by Art. 26 of the GDPR Process. You may require details on Reply group companies contacting Reply as specified hereinafter.

We may obtain your personal data either directly from you or from third parties for recruitment purposes. Such third parties may include recruitment agencies, job boards and publicly available websites such as Linked-In, as well as specialist companies that facilitate the entrance of recent graduates into the working life. The data we collect may include your contact details, employment and education history, skills and professional qualifications, as well as records of any interactions with us including interviews and tests.

1. Purpose and processing activity. Legal basis

Your data are stored and processed solely for the following purposes:

a) carry out the necessary evaluations in order to possibly establish a job or contract relationship with one of the companies in the Reply group. Legal basis for the processing: execution of precontractual activities.

b) following a successful evaluation, arrange any documentation needed to establish the job or contract relationship, such as passport, work permit, driving license, etc. Legal basis for the processing: execution of pre-contractual activities.

c) comply with specific obligations required by law or other binding regulations (e.g. fiscal legislation, social security and social protection law, health and safety at work, protection of health, public order and public security law). Legal basis for the processing: legal obligations.

To achieve the abovementioned purposes, it may be necessary to collect and process data defined as “particular” by GDPR art. 9 comma 2.b. In particular, this may include information about health status and disability, subject to any relevant employment legislation.

2. Provision of data

If you are unwilling to provide sufficient data to support the recruitment and evaluation process, we shall be unable to consider you for setting up the job or contract relationship.

3. Method of processing activity. Data retention period

Your data are stored electronically and will be subject to strict information security measures to protect your privacy. Your data will only be accessed by those directly involved in the evaluation and recruitment process.

If you subsequently join Reply, as an employee or as a freelance, you will be given a separate Privacy Notice to cover our storage and use of your personal data during your employment.

Otherwise, your data will be held for up to three years from the most recent update unless you specifically request deletion.

4. Data Recipients

The personal data collected to achieve the purposes indicated in section 1, could be used by any of the Reply companies as Joint Controller of the processing activity according to art. 26 GDPR.

Within the organization of each Joint Controller, personal data will be processed by subjects specifically appointed and interested to the applicant’s profile and that intend to conduct an evaluation of the applicant, or by all subjects to whom the communication is due in base of specific law obligations.

In some cases, we may share an anonymized profile with a potential Reply client as part of your evaluation.

The Joint Controllers may use external companies to provide services for the achievement of the purposes on point 1. Any such company will be designated as a Data Processor according to art. 28 of GDPR.

If you are being considered for a position with a Reply group company outside the European Union, please be aware that these companies may be subject to different data protection legislation, and this may require additional protections and consents. We will inform you of these if necessary.

Whenever personal data are transferred from an EU member state to a third country, this transfer will be protected by standard contractual clauses according to Art. 46 par. 2.c of GDPR.

5. Dissemination of data

Apart from the third parties identified above your data will not be subject to any wider dissemination.

6. Data subjects’ rights

You have the right to require to each Joint Controller the access to your personal data and, where the conditions are met, to require the amendment or erasure of the same or restriction of the processing that refer to You, or to oppose to the processing.

Where the conditions are met, You have the right to data portability.

For the abovementioned communications, you may use the contact details reported in section 8 below.

You have the right to lodge a complaint to the competent Supervisory Authority.

7. Data Controller. Data Protection Officer

The Reply Group Companies are Joint Controllers of the processing ex art. 26 GDPR.

Reply together with one or more Reply group companies are the Joint Controllers of this processing activity, as specified by Art. 26 of the GDPR Process.

The contact details of the Data Protection Officers are:
DPO UK: DPO Italy: DPO Germany:

8. Other Contact Details for data subjects’ rights

ITALY Data Subjects can send an email to, or a mail by postal service, to Reply S.p.A., Corso Francia 110, Turin.

UK Data Subjects can send an email to or a mail by postal service to the HR Department, Reply Ltd, 38 Grosvenor Gardens, London SW1W 0EB.

GERMANY Data Subjects can send an email to, or a mail by postal service to Reply AG with registered office at Bartholomäusweg 26 D-33334 Gütersloh

POLAND Data Subjects can send an email to or a mail by postal service to Hermes Reply Polska Sp. z o.o. with registered office at Ul. Gliwicka 6/2 44-079 Katowice


According to the Federal Data Protection Act, you have a right to free-of-charge information about your stored data, and possibly entitlement to correction, blocking or deletion of such data. Inquiries can be directed to the following e-mail addresses: