Privacy Notice for personnel

Date of last update: 9 July 2026

Pursuant to Article 13 of EU Regulation 2016/679, we inform you of the following:

  1. Data Controller.

    The Data Controller is M4SS S.r.l., with registered office in Reggio Emilia, via dello Statuto n. 1/A, tax code and VAT number: 02772290355, e-mail: privacy@m4ss.net, which has appointed its own Data Protection Officer (DPO), who can be contacted at the registered office of M4SS S.r.l. and at the following e-mail address: dpo@m4ss.net.

  2. Purposes and legal basis of data processing.

    Processing is aimed at:

    1. hiring, assignment of a work role or establishment of an employment relationship (including temporary employment) or collaborative working relationship, where not already in place; the legal basis is the necessity to perform a contract to which you are a party or to carry out pre-contractual measures adopted at your request;

    2. management of the employment or collaborative working relationship, for the execution of measures connected to contractual or pre-contractual obligations (by way of example and not exhaustively: management of services and/or business trips, activity planning, internal control for security and the use of IT tools, legal and economic management); the legal basis is the necessity to perform a contract to which you are a party or to carry out pre-contractual measures adopted at your request;

    3. fulfilling all legal and contractual obligations, including collective ones, connected to the employment or collaborative working relationship, in every area (by way of example and not exhaustively: tax, anti-money-laundering, privacy, insurance, occupational health and safety); the legal basis is the fulfilment of a legal obligation to which the Data Controller is subject;

    4. fulfilling the obligations and exercising the specific rights of the Data Controller or of the data subject in the field of labour law and social security and social protection, including the payment of union membership fees or the exercise of union rights; the legal basis is the fulfilment of a legal obligation to which the Data Controller is subject and, as regards the processing of data belonging to special categories referred to in Article 9 of EU Regulation 2016/679 (such as health data or trade union membership), the fulfilment of obligations and the exercise of specific rights of M4SS S.r.l. or of the data subject in the field of labour law and social security and social protection;

    5. defending a right in legal proceedings; the legal basis is the pursuit of the Data Controller's legitimate interest and, as regards the processing of data belonging to special categories referred to in Article 9 of EU Regulation 2016/679 (such as health data or trade union membership), the same need to defend a right in legal proceedings.

  3. Methods of data processing.

    Processing is carried out, using methods strictly necessary to meet the purposes indicated above, by means of some of the operations or the set of operations referred to in Article 4, no. 2) of EU Regulation 2016/679: collection, recording, organisation, structuring, storage, consultation, processing, adaptation, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure and destruction of data. The operations may be carried out with or without the aid of electronic, telematic or otherwise automated tools. The personal data are not subject to any fully automated decision-making process, including profiling.

  4. Provision of data.

    The provision of personal data is mandatory for everything required to comply with legal and contractual obligations relating to the employment or collaborative working relationship. Therefore, any refusal to provide it in whole or in part may make it impossible for M4SS S.r.l. to execute the contract or to correctly carry out all obligations, such as those of a remunerative, contributory, tax and insurance nature, connected to the employment relationship. In any case, by communicating your personal data for any of the purposes referred to in point 2, M4SS S.r.l. may process such data to pursue its legitimate interest in protecting a right in legal proceedings.

  5. Data retention.

    Personal data will be processed and retained for the entire period necessary for the complete performance of the contract to which you are a party, and therefore for its entire duration.
    In any case, the personal data processed may be retained for the period necessary for the possible defence of its rights in legal proceedings and for the possible fulfilment of legal obligations or orders of the authority.

  6. Communication of data.

    Personal data may be communicated to, or become known to, for the purposes referred to in point 2:

    1. internal personnel of M4SS S.r.l., specifically authorised to process data and assigned to personnel management and related payroll, to administration, and to the management and control of the corporate IT infrastructure;

    2. clients, suppliers and consultants of M4SS S.r.l.;

    3. data processors and their further processors and authorised parties, such as, by way of example and not exhaustively: accountants, labour consultant, IT service providers or their support providers, and the relevant appointed technical staff, any collaborators, persons in charge of occasional maintenance operations, all adequately trained in confidentiality protection;

    4. competent occupational physician, pursuant to Law 81/2008;

    5. public bodies, judicial or administrative authorities, for the fulfilment of legal obligations;

    6. pension and welfare funds or schemes, including private ones;

    7. banking and insurance institutions;

    8. trade union organisations and welfare assistance institutes (patronati);

    9. any temporary employment agency designated for the temporary worker concerned;

    10. other parties processing the data in fulfilment of specific legal obligations.

  7. Transfer of data abroad.

    Personal data will not be transferred outside the European Union and the European Economic Area.

  8. Rights of the data subject.

    Pursuant to Articles 15-18 and 20-21 of EU Regulation 2016/679, you have the right to obtain:

    1. confirmation as to whether or not personal data concerning you exist, even if not yet registered, and their communication in intelligible form;

    2. the indication of:
      - the origin of the personal data;
      - the purposes and methods of processing;
      - the logic applied in case of processing carried out with the aid of electronic tools;
      - the identifying details of the Controller and of any processors;
      - the parties or categories of parties to whom the personal data may be communicated or who may become aware of them in their capacity as processors or appointees;

    3. updating, rectification or, where you have an interest therein, the completion of the data;

    4. the erasure, anonymisation or blocking of data processed in breach of the law, including data whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed;

    5. confirmation that the operations referred to in letters c) and d) have been brought to the attention, also as regards their content, of those to whom the data were communicated or disseminated, except where such fulfilment proves impossible or involves a manifestly disproportionate effort compared to the right protected.

    The data subject has the right to object, in whole or in part:

    1. for legitimate reasons, to the processing of personal data concerning you, even if pertinent to the purpose of collection;

    2. to the processing of personal data concerning you for the purpose of sending advertising material or direct selling, or for carrying out market research or commercial communication.

    The data subject has the right to withdraw, at any time, the consent given, in relation to processing activities for which it constitutes the legal basis, without prejudice to the lawfulness of the processing based on the consent given prior to its withdrawal.
    The data subject has the right to data portability, i.e. to receive, in a structured, commonly used and machine-readable format, the personal data concerning them and has the right to transmit such data to another Data Controller without impediment.
    The data subject also has the right to lodge a complaint with a supervisory authority (in Italy, the Garante per la Protezione dei dati personali, the Italian Data Protection Authority: www.garanteprivacy.it).
    They may exercise their rights by means of a written request, sent to M4SS S.r.l., at the contact details indicated in point 1.