PRIVACY NOTICE – CANDIDATES

Introduction

Throughout this Privacy Notice (“Notice”) “Aon” refers to Aon plc, including its affiliated companies and subsidiaries (also referred to as “we”, “us”, “our” or “the Company”) and explains how Aon makes use of the personal information collected about you in connection with your application for employment. A full list of our group entities is available here.

Collection of personal data
1. The personal data we collect about you may include the following:
  a. identifying and contact data: first name, last name, telephone number, e-mail address, residential address, date of birth, social security number;
  
  b. economic and financial data: IBAN, RAL;
  
  c. curricular data: previous work experience, educational and professional qualifications, personal licenses and certifications, exam results, languages spoken;
  
  d. multimedia data: photo included in the curriculum vitae, video presentation.
2. The processing will concern only your common personal data, such as those listed above. This is without prejudice to cases where special categories of data, as defined in Article 9 of the GDPR, need to be known due to the establishment of the employment relationship, with reference to whether you belong to protected categories. Special data includes health data relating to disabilities, illnesses, motor difficulties or other health information that the Company acquires in order to ensure that the selection process does not discriminate against you. Aon processes your personal health data only for purposes related and/or instrumental to ensuring that you undergo a selection and application evaluation process without discrimination and for purposes related to the fulfillment of obligations imposed by law, regulations and EU legislation.
3. If you provide Aon with personal data about third parties, you must provide those Data Subjects with a copy of this Notice in advance or ensure that they are informed of how their information will be used by Aon.
4. In addition to obtaining personal data directly from you, the Company may collect it from your previous employers, educational and professional institutions, recruiting firms, universities, headhunters, designated referrers, agencies.
Processing of personal data

We will process personal data collected on your application for the following purposes:

a. recruitment and selection of staff and management of the selection and evaluation processes of your application, in connection with the possibility of an employment relationship with the Company;

b. fulfillment of obligations imposed by law, regulations, and EU legislation;

c. use of potential future recruitment processes for additional job positions.

The provision of data for these purposes is optional, however, it is a necessary requirement for the evaluation of the candidacy and the possible subsequent conclusion of the employment/collaboration contract; therefore, your refusal to provide your personal data, in whole or in part, could result in the impossibility for the Company to properly execute the application selection process.
Legal basis for processing

The Company relies on the following legal bases for collecting and using your personal data:

a. Purposes referred to in point a) in paragraph 4
Execution of pre-contractual measures related and/or functional to the establishment of the employment and/or collaboration relationship (art. 6, par. 1, letter b, GDPR)
Legitimate interest of the Controller in carrying out the selection process of candidates, in compliance with internal policies and procedures (art. 6, par. 1, letter f, GDPR)

b. Purposes referred to in point b) in paragraph 4
Fulfillment of legal and regulatory obligations (art. 6, par. 1, letter c, GDPR)

c. Purposes referred to in point c) in paragraph 4
Data Subjects’ Consent (art. 6, par. 1, letter a, GDPR) Consent is explicit, free, specific, and informed, provided optionally by you, where you intend to consent to the use of recruitment processes for additional employment positions. You may revoke, at any time, the consent previously given.

Recipients of personal data

We share personal data about our potential employees with the following recipients:

a. other group companies for recruitment purposes;

b. recruitment agencies, where necessary to administer and manage the recruitment process;

c. employees, where necessary to manage our business;

d. third-party vendors, where we outsource our processing operations to vendors who process personal data on our behalf. Such processing operations will remain under our control and will be carried out in accordance with our security standards and strict instructions;

e. public authorities, regulators, and government agencies as necessary to fulfill our legal and regulatory obligations.
Transfer of personal data
1. Considering the multinational organizational structure of the Company, a transfer of personal data to other countries of the European Union (EU), the European Economic Area (EEA) or to countries outside the EU or the ESS is carried out for the purpose of processing in accordance with the provisions set out in this Notice and required by law.
2. Your personal data may be transferred abroad for the purposes of managing the employment relationship, business, improving the efficiency of Aon's business operations and fulfilling legal and regulatory obligations.
3. Disclosure of your data outside the EU or EEA is done in accordance with what is required by data processing regulations. Aon takes the necessary measures to protect your personal data during the transfer, in compliance with legal safeguards. In particular, the same is done in accordance with Articles 45 and 46 of the GDPR, which provide for the adherence to adequacy decisions or the adoption in agreements and contracts of standard contractual clauses defined by the European Commission, and considering any additional measures required by applicable law.
Retention of personal data
1. Your personal data will be retained as long as it is necessary for the purposes with respect to which it was collected, i.e., for purposes strictly related and instrumental to the review of applications received and the eventual recruitment process and to fulfill legal and regulatory obligations and, in any case, no longer than 18 months after receipt of your Curriculum Vitae.
2. Aon has implemented appropriate measures to ensure that your personal data are deleted/anonymized in accordance with the GDPR after the retention periods have expired.
3. Under certain circumstances, Aon may retain your personal data for longer periods of time in order to handle any complaints or disputes or if there is potential litigation between the parties.
Accuracy of personal data

In order to evaluate your application for employment and to match you with future job opportunities that may arise, we rely on the availability of accurate personal data. You must therefore ensure that the information you provide in support of your application is accurate and, where appropriate, up to date. Please notify us promptly of any changes to your personal information.

Security of Personal Data

We have implemented appropriate security measures to protect the confidentiality, integrity, and availability of the personal data we collect and to ensure that such data are processed in accordance with the GDPR.

Data Subjects Rights
1. Data Subjects have the following rights under the GDPR in relation to any personal data we collect and use about them:
  
  a. right of access: the right to access your personal data or to receive a copy of the data about you;
  
  b. right to rectification: the right to request correction of personal data or, in cases where the accuracy of the data is disputed, to supplement it;
  
  c. right to erasure: the right to request the deletion of personal data, particularly when it is no longer necessary to continue using them;
  
  d. right to object: the right to object to the processing of personal data, when it considers that there aren’t longer sufficient legitimate grounds for continuing to process them;
  
  e. right to restriction: the right to request the restriction of the processing of personal data, for example where the accuracy of the data is disputed and request that the personal data not be processed until its accuracy is confirmed;
  
  f. right to data portability: the right to request the portability of data in electronic form to enable its reuse;
  
  g. right not to be subjected to decisions based solely on automated processing: the right not to be subjected to decisions based solely on automated processing, including profiling, or decision-making without human intervention, which produces legal effects concerning him or affects him personally.
  
  h. If he or she believes that the processing concerning him or her violates the GDPR, the Data Subject also has the right to lodge a complaint with the competent data protection authority.
2. Aon will endeavor to promptly acknowledge the Data Subject's request or to inform the Data Subject if further information is needed to satisfy such request. Please note, however, that some of the rights may only be exercised in specific circumstances. Where it is not possible to comply with the request, it will be the Company's responsibility to communicate in writing the reasons for the refusal.
Complaints

If you wish to make a complaint about the way we process your personal data, you should contact the Data Protection Officer (DPO) at the following e-mail address: [email protected].

You can contact the competent data protection authority at the following link: https://www.garanteprivacy. We would like to inform you that our competent authority for the protection of personal data is the “Garante per la Protezione dei dati personali”, based in Piazza di Monte Citorio, No. 121, Rome (00186).

Changes to this Notice

This Notice is not contractual, and we reserve the right to reasonably modify it from time to time to ensure that it continues to accurately reflect how we collect and use your personal information. Any updates or changes to this Notice will be posted on the website. This privacy Notice was updated in September 2022. You are responsible for reviewing this Notice periodically to ensure that you understand how we collect and use your personal information.

Contact Informations

If the Data Subject has any questions about the content of this Notice or the rights conferred under the GDPR, he or she should contact the Data Protection Officer at the following e-mail address: [email protected].
Employee Privacy Notice

If you are offered employment with the Company, you will be issued an additional Employee Privacy Notice explaining how we process your personal data in connection with your employment.