Privacy policy regarding the processing of candidates' personal data

01Data controller

The Data Controller is S ENERQOS ENERGY SOLUTIONS.R.L., with registered office at Viale Monza 270, 20128 Milan, C.F. and P. IVA 09142060962.

Contact: [email protected]

02Data Protection Officer

The Data Protection Officer (“RPD” or “DPO”) can be reached at the following contact point: [email protected].

03Categories of personal data processed

Enerqos may process the data provided directly by the candidate through the online form, the CV, any attachments, communications and interviews, including:

• identification and contact details, such as name, surname, contact information, and any other identifying information possibly contained in the CV;
• data relating to education, qualifications, skills, certifications, professional experiences, references, and previous employment;
• information regarding the position of interest, the availability of work and, in general, data relevant to the evaluation of the candidacy;
• any additional information that the candidate chooses to communicate, provided that it is relevant to the selection process.

The candidate is invited not to include in the CV or in the attachments any data that is not necessary for the selection process, in particular data belonging to particular categories under Article 9 of the GDPR, unless they are strictly necessary and relevant for the purposes of establishing the employment relationship (for example, where relevant, information regarding membership in protected categories).

04Purposes and legal bases of the processing

Personal data is processed to: receive and record applications; assess the profile, skills and suitability for available positions; organize interviews and selection activities; communicate with the candidate; perform activities necessary or preliminary to the eventual establishment of a working or collaboration relationship.

The main legal basis is the execution of pre-contractual measures adopted at the request of the interested party, pursuant to Article 6, paragraph 1, letter b), GDPR. In the cases provided for, processing may also be necessary to comply with legal obligations pursuant to Article 6, paragraph 1, letter c), GDPR.

Any special categories of data strictly necessary for the establishment of the employment relationship are processed, subject to the prerequisites, in accordance with Article 9, paragraph 2, letter b), GDPR, as well as in compliance with national regulations and applicable requirements in the field of labor.

Consent does not constitute the ordinary legal basis for the processing of CVs for selection purposes. In particular, for curricula submitted voluntarily, Article 111-bis of Legislative Decree 196/2003 provides that, within the limits of the purposes set out in Article 6, paragraph 1, letter b), GDPR, consent to the processing of the data contained in the curriculum is not required.

05Nature of the Contribution

The provision of the data necessary for evaluating the candidacy is optional, but indispensable to allow Enerqos to examine the candidacy and manage the selection process. The failure to provide the necessary data may therefore prevent the evaluation of the candidacy.

06Mode of treatment and automated decision-making process

The data are processed using paper and, mainly, electronic tools, in accordance with the principles of legality, correctness, transparency, minimization, integrity and confidentiality, through appropriate technical and organizational measures.

Access to the data is limited to authorized individuals who need it to carry out the selection process.

Enerqos does not adopt decisions that have legal effects on the candidate or similarly significantly affect them based solely on automated processing, including profiling, pursuant to Article 22 of the GDPR.

07Recipients of the data

The data may be processed by authorized Enerqos personnel involved in the recruitment process, specifically by the Human Resources department and by the managers of the business units involved in the position.

The data may also be made accessible, to the extent necessary, to providers of IT services, hosting, candidate management, professional consultants and other entities acting on behalf of Enerqos, appointed, where required, as Data Processors pursuant to Article 28 of the GDPR.

Given Enerqos’s membership in the Ameresco group, the data may also be processed by companies within the group when necessary for organizational, administrative, or IT services related to the management of applications, in compliance with applicable regulations.

Personal data will not be disclosed.

08Data Transfers Outside the European Economic Area

For organizational reasons or for the use of services provided by group companies or suppliers, some personal data may be transferred or made accessible to recipients located outside the European Economic Area, including the United States.

Such transfers will be made in compliance with Articles 44 et seq. of the GDPR, based on a decision on adequacy by the European Commission, where applicable, or through appropriate safeguards pursuant to Article 46 of the GDPR, including, where necessary, the Standard Contractual Clauses and any additional measures required.

For transfers to the United States, the adequacy decision under the EU-U.S. Data Privacy Framework may be used exclusively in respect of U.S. organizations that are validly certified under the Framework.

The candidate can request information about the applicable guarantees by contacting Enerqos at the contact details indicated in this information.

09Shelf Life

If the selection does not lead to the establishment of an employment relationship or collaboration, the data related to the application will be kept for a period not exceeding 12 months from collection, unless further retention is necessary to comply with legal obligations or, limited to the data actually necessary, for the ascertainment, exercise or defense of a right.

After this period has elapsed, the data will be deleted or made anonymous. If the selection concludes with the hiring or the establishment of a collaboration relationship, the necessary data will subsequently be processed and retained in accordance with the information policy applicable to the relevant relationship.

10Rights of the interested party

In the cases and within the limits provided by applicable regulations, the candidate may exercise the rights of access, rectification, cancellation, restriction of processing, data portability and opposition, as well as request information about transfers to third countries and the related guarantees.

Requests may be submitted to: ENERQOS ENERGY SOLUTIONS S.R.L., Viale Monza 270, 20128 Milan; email: [email protected].

11Complaint to the Control Authority

If the data subject considers that the processing of their personal data is taking place in violation of applicable regulations, they have the right to lodge a complaint with the Data Protection Authority pursuant to Article 77 of the GDPR, without prejudice to any other administrative or judicial remedy provided for by law.

12Updates

This information may be updated when necessary, also as a result of regulatory, organizational or processing changes.

Last update: September 15, 2026