Last updated: 03 November 2025
The personal data provided through this section of our website (Careers) will be processed by Arena Santa Giulia, as Data Controller, solely for the purpose of evaluating your application and managing the recruitment process.
Information on the processing of personal data pursuant to Article 13 of Regulation (EU) 2016/679, General Data Protection Regulation (“GDPR”).
Pursuant to and for the purposes of the provisions of Article 13 of Regulation (EU) 2016/679 on the protection of personal data (hereinafter, “GDPR”) and of the current national privacy legislation (hereinafter “Privacy Code”), we inform you that your personal data will be processed through electronic and paper-based tools, in Italy and in other countries of the European Union. This policy, drafted on the basis of the principle of transparency and containing all the elements required by the GDPR, is divided into individual sections, each of which deals with a specific topic in order to make it quicker, easier and more understandable to read (hereinafter, “Privacy Policy”).
Who is the Data Controller?
The Data Controller is Arena Milano Management S.r.l. with registered office in Milan, Via Fabio Filzi, 29 (hereinafter, “Arena Milano”, the “Data Controller” or the “Company”).
What types of personal data are collected?
Your personal data will be processed by the Company as part of its personnel search and selection activities and during your job interview(s) with the Data Controller. By way of example, the following personal data will be processed:
personal and contact data (e.g. first name, surname, fiscal code, date/place of birth, addresses of residence/domicile, telephone numbers/email addresses)
data relating to education and work activities (e.g. data contained in CV, contractual classification, salary data, data on training and professional career, educational qualifications, training certificates, certifications, skills, professional experience, etc.);
special categories of personal data, with specific reference to information on health status (e.g. suitability for certain jobs, membership of protected categories), if necessary for the activity for which you are applying. In relation to such data, please do not provide any information that does not strictly comply with the aforementioned legal requirements, in which case the Data Controller will not collect such data as they are not relevant and necessary for your selection and application.
For what purposes will your data be processed?
Your personal data, including special data, will be processed for the purposes and in the manner described in this notice for the following purposes:
to ensure the proper conduct of the selection process and the management of your application;
to fulfil the legal obligations connected with such activity (e.g. regarding the recruitment of the so-called protected categories)
to defend the rights of the data subject and/or the Company.
The provision of your data for purposes connected with the management of your candidature and the fulfilment of legal obligations is necessary to initiate and implement personnel search and selection activities and, if necessary, to evaluate your candidature with a view to the establishment of a possible employment relationship. Failure to provide your personal data will make it impossible for the Company to evaluate your application.
What is the legal basis of the processing?
The legal bases of the processing of your personal data by the Data Controller for the purposes indicated above are represented:
by the execution of pre-contractual measures adopted at your request pursuant to Article 6 (b) of the GDPR, Article 111-bis of the Privacy Code and Decision of the Data Protection Authority No. 146 of June 5, 2019;
the fulfilment by the Data Controller of legal obligations, company regulations, collective agreements, national and community regulations inherent to the personnel search and selection process;
the pursuit of a legitimate interest of the Company, which does not override the fundamental rights and interests of the data subjects.
To which parties may your personal data be communicated?
Your personal data will be processed exclusively by persons authorised to process the data identified by the Data Controller pursuant to art. 29 of the GDPR, in their capacity as data processors and/or internal data controllers and/or system administrators, and by third parties who carry out activities in outsourcing on behalf of the Data Controller and who will process the data as data processors in compliance with art. 28 of the GDPR in order to properly carry out all the processing activities necessary to pursue the purposes set out in this policy (e.g. suppliers of the technological infrastructure, companies that carry out activities functional to the management of services, IT service providers, professionals and consultants in tax or accounting matters, etc.).
Your personal data may also be communicated, within the scope of the purposes specified above, to public bodies or judicial authorities, where required by law or at their express request, or for the investigation and prosecution of criminal offences, the prevention of and protection against threats to public safety, or to enable the Company to ascertain, exercise or defend a right in court. These parties will act as autonomous data controllers.
Where will your data be processed?
Your personal data will be processed by the Controller within the territory of the European Union.
How long will your personal data be stored?
Your personal data will not be processed for longer than is necessary to achieve the purposes set out in this policy.
What are your rights?
We remind you that you can exercise your rights under the GDPR and in particular obtain:
confirmation as to whether or not personal data relating to you are being processed and to obtain access to the data and to the following information (purpose of processing, categories of personal data, recipients and/or categories of recipients to whom the data have been and/or will be disclosed, storage period);
the rectification of inaccurate personal data concerning him/her and/or the integration of incomplete personal data, also by providing a supplementary declaration;
the cancellation of personal data in the cases provided for by the GDPR;
the restriction of processing in the cases provided for by the current Privacy Code;
the portability of the data concerning you and, in particular, to request the personal data provided to the Data Controller and/or request the direct transmission of your data to another data controller;
objection to the processing of personal data concerning you at any time, on grounds relating to your particular situation;
lodging a complaint with the Data Protection Authority.
In the above cases, where necessary, the Data Controller shall inform the third parties to whom your data is communicated of the possible exercise of your rights, except in specific cases (e.g. when such fulfilment proves to be impossible or involves a manifestly disproportionate effort compared to the right protected).
The rights listed above may be exercised by sending a request to the following e-mail address: privacy@arenamilano.it