The Data Controller identified below, pursuant to art. 13 of EU Regulation no. 679/16 on the protection of natural persons with regard to the processing of personal data (hereinafter the "Regulation"), informs you that it will process personal data for the purposes and in the manner indicated below.

1.CATEGORIES OF PERSONAL DATA PROCESSED

The data processed by the Data Controller are only those marked with a tick:

1.1.identification data: 1 ☒ first name; 2 ☒ surname; 3 ☒ date of birth; 4 ☒ place of birth; 5 ☒ tax code; 6 ☒ address/city; 8 ☒ handwritten signature; 9 ☒ telephone number; 10 ☒ e-mail address; 13 ☒ images; 14 ☒ audio;

1.2.special categories of personal data: 3 ☒ health (for protected categories, if indicated in the CV)

1.3.personal data relating to criminal convictions and offences: no data processed

1.4.types of possible profiling: 1 ☒ work performance; 6 ☒ reliability (professional) (e.g. work completed); 7 ☒ behaviour (professional) (e.g. operational organisation).

The processing of data will be carried out in compliance with the provisions of the Regulation, as specified below.

2.SOURCE OF THE PERSONAL DATA PROCESSED.

The personal data processed are those collected from the data subject pursuant to art. 13 of the Regulation.

3.PURPOSES OF THE DATA COLLECTION, RELATED RETENTION PERIOD AND LEGAL BASIS (art. 13 par.1 letter c of the Regulation) The data will be processed exclusively for the following purposes:

3.1MANAGEMENT OF APTITUDE QUESTIONNAIRE RESULTS FOR PROFILING. The data subject's personal data are processed for the profiling of professional aptitudes, by analysing the results (in aggregate form) of the aptitude questionnaire. The processing consists of the elaboration of the answers provided by the data subject in order to classify and assess their specific professional aptitudes, according to the following analysis dimensions [indicative example: 1) aptitude for organisation, 2) aptitude for sales, 3) aptitude for communication]. In accordance with art. 13, par. 2, letter f) of the GDPR and with Recital 71, the following information on the logic involved is provided: the questionnaire uses an assessment model based on multiple choice, the results of which are aggregated automatically, generating a chart showing a score for each aptitude dimension. These scores are then interpreted by a qualified human operator who, taking into account the data subject's professional context, formulates a final assessment. The decision-making process is not based solely on automated processing: human intervention in the final assessment is always provided for, in accordance with Recital 71 of the GDPR and art. 22 of the GDPR. The aptitude profile produced may be used by the Data Controller only to identify the most suitable job position among those available. The data subject is informed that assessments concerning them will never be used as the sole determining criterion for decisions producing legal effects or significantly affecting them, in compliance with art. 22 of the GDPR. The Data Controller adopts technical and organisational measures to ensure that profiling does not produce discriminatory effects towards the data subject, in compliance with Recital 71 of the GDPR. The identification data processed for this purpose are those ticked in point 1.1 under no. 1,2,3,9,10 while in point 1.4 no. 1, 6, 7 are ticked. Information and communications with the data subject may take place via e-mail, telephone, SMS or messaging tools. Legal basis: free, specific, informed and explicit consent of the data subject pursuant to art. 6, par. 1, letter a) of the GDPR. The provision of data is optional. Failure to give consent for this purpose does not in any way affect the possibility of taking part in the selection process referred to in Purpose 3.2. The data subject may withdraw consent at any time or exercise the rights listed in point 9 of this notice (e.g. the right to object) by contacting the Data Controller at the contact details indicated in this notice (e.g. e-mail or PEC). Withdrawal does not affect the lawfulness of processing carried out before it. In the event of withdrawal, the aptitude profile produced remains valid until the withdrawal request. The data processed for this purpose, including the aptitude profile produced, are retained for a maximum period of 24 months from the date on which the questionnaire was completed, after which they will be deleted or anonymised, subject to any legal obligations or the time technically required for deletion.

3.2MANAGEMENT OF THE SELECTION PROCESS WITH APTITUDE QUESTIONNAIRES.

The data subject's personal data are processed for selection purposes, using the identification and profiling data listed above and detailed below, in order to identify the job role best suited to their professional aptitudes among those available within the application submitted. The profiling processing, as indicated in point 3.1, is aimed at finding the most suitable role, with human intervention by qualified operators. The activity does not involve any automated decision concerning the data subject, nor the creation of permanent aptitude profiles: the data produced by the questionnaire are used exclusively as a tool for guidance towards the most suitable role. The identification data processed for this purpose are those ticked in point 1.1 under no. 1,2,3,9,10 while in point 1.4 no. 1, 6, 7 are ticked, together with the aptitude questionnaire results in aggregate form by professional aptitude as further explained in point 3.1 above, limited to what is necessary for the definition of the selection process. Organisational communications with the data subject may take place via e-mail, telephone, SMS or messaging tools. Legal basis: free, specific, informed and explicit consent of the data subject pursuant to art. 6, par. 1, letter a) of the GDPR. The provision of data is optional. Failure to give consent will change nothing between the parties and the selection process will continue without the aid of the questionnaire. The data subject may withdraw consent at any time or exercise the rights listed in point 9 of this notice (e.g. the right to object) by contacting the Data Controller at the contact details indicated in this notice (e.g. e-mail or PEC). Withdrawal does not affect the lawfulness of processing carried out before it. The data processed for this purpose are retained for a maximum period of 24 months from the date of selection or completion of the questionnaire, after which they will be deleted or anonymised, subject to any legal obligations or the time technically required for deletion.

3.3MANAGEMENT OF THE DATA CONTAINED IN THE CV FOR RECRUITMENT PURPOSES. The personal data contained in the curriculum vitae and those subsequently provided are processed for the management of the pre-contractual relationship between the parties, within the scope of the Data Controller's activities, in order to assess the data subject's application and manage personnel selection activities, including the handling of requests, the organisation of interviews and communications (e.g. via e-mail, telephone, sms or messaging tools). The personal data actually processed are exclusively those ticked in section 1.1 under no. 1,2,3,4,5,6,8 (if present in the CV),9,10,13 (if present in the CV), 14 (in the case of an audio CV) and section 1.2 no.3 (health/protected categories). The data are retained for the time strictly necessary to manage the selection process and in any case for a period not exceeding 24 months from receipt of the curriculum vitae, subject to any legal obligations or the time technically required for deletion. Legal basis: performance of the personnel selection procedure requested by the data subject and any pre-contractual measures (art. 6 par. 1 letter b GDPR) aimed at establishing the relationship and, for any special categories of data, compliance with obligations and the exercise of rights in the field of employment (art. 9 par. 2 letter b GDPR). The data subject may exercise the rights set out in point 9 of this notice.

3.4MANAGEMENT OF (AGGREGATED) DATA FOR STATISTICAL ANALYSIS IN ORDER TO IMPROVE THE SERVICES/PRODUCTS OFFERED (F) Personal data are processed for statistical and internal analysis purposes, in order to improve the services and products offered within the scope of the Data Controller's activity. The data are processed in aggregate form and, in order to avoid homonyms and duplications, the data indicated in point 1.1 no. 1,2,3 are used. The data are retained for the time strictly necessary, for a maximum period of 2 years from the last relationship and/or from the statistical analysis, subject to any legal obligations or the time technically required for deletion. Legal basis: legitimate interest of the Data Controller (art. 6 par. 1 letter f GDPR), consisting in the improvement of the services offered. The data subject may exercise the rights set out in point 9 of this notice (e.g. the right to object).

N.B. Please note that for all purposes requiring consent, the data subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4.LEGAL BASIS FOR THE PROCESSING (art. 13 par.1 letter c of the Regulation) The legal basis is set out in each of the individual purposes under point 3.

5.NATURE OF THE PROVISION OF DATA (art.13 par.2 letter e of the Regulation)

In compliance with art.13 par.2 letter e of the Regulation, the data requested are necessary in order to carry out the processing (e.g. legal and pre-contractual obligations).

6.RECIPIENTS WHO MAY BECOME AWARE OF YOUR PERSONAL DATA (art. 13 par.1 letter e of the Regulation)

The categories of parties who may become aware of your personal data are: authorised persons (e.g. employees), Data Processors (e.g. suppliers) of the Data Controller, the DPO (where appointed) indicated in the "DPO" box, Joint Controllers (where present) indicated in the "Joint Controllers" box, companies of the Business Group (where present) indicated in the "Business Group" box, public authorities responsible for controls or legal obligations.

7.TRANSFER OF PERSONAL DATA (art. 13 par.1 letter f of the Regulation)

7.1.The data will be/may be transferred to EU Member States ☒YES ☐NO. For further information, please contact the Data Controller.

7.2.The data will be/may be transferred to third countries outside the EU ☐YES ☒NO. For further information, please contact the Data Controller. Should data be transferred outside the EU, the Data Controller hereby guarantees that the transfer will take place in accordance with art. 44 et seq. of the GDPR and with the applicable legal provisions, entering into, where necessary, agreements for the transfer of personal data to third countries that do not ensure an adequate level of personal data protection.

8.METHODS OF PROCESSING

The processing will be carried out in paper form and/or in electronic form or in any case with the aid of computerised tools.

9.RIGHTS OF THE DATA SUBJECT (art. 13 par.1 letter b of the Regulation)

Articles 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23 of the Regulation grant the data subject the exercise of specific rights, including:

9.1.art.12 Transparent information, communication and modalities for the exercise of the data subject's rights;

9.2.art.13 Information to be provided where personal data are collected from the data subject;

9.3.art.14 Information to be provided where personal data have not been obtained from the data subject;

9.4.art.15 Right of access: the right to obtain from the Data Controller confirmation as to whether or not personal data concerning them are being processed;

9.5.art.16 Right to rectification: the right to obtain from the Data Controller the rectification of inaccurate personal data concerning them;

9.6.art.17 Right to erasure ("right to be forgotten"): the right to obtain from the Data Controller the erasure of personal data concerning them;

9.7.art.18 Right to restriction of processing: the right to obtain from the Data Controller the restriction of processing of their data where the accuracy of the personal data is contested, where the processing is unlawful and where the data subject has objected to the processing;

9.8.art.19 Right to receive from the Data Controller notification in the event of rectification or erasure of personal data or restriction of processing;

9.9.art.20 Right to data portability: to obtain data portability, i.e. to receive the data from a controller in a structured, commonly used and machine-readable format, and to transmit them to another controller without hindrance;

9.10.art.21 Right to object: to object to the processing at any time, including in the case of processing for direct marketing purposes;

9.11.art.22 Automated individual decision-making, including profiling;

9.12.art.23 Restrictions.

The documents are available at the operational headquarters of the Data Controller (indicated in the box below), which, as stated above, undertakes to guarantee the exercise of these rights.

The data subject may lodge a complaint with the Italian Data Protection Authority (art. 13, par.2 letter d of the Regulation), following the procedures and instructions published on the Authority's official website at www.garanteprivacy.it.

In exercising the rights under articles 12-23 of the Regulation, the data subject may grant, in writing, a delegation or power of attorney to natural persons or to associations. Requests may be submitted to the Data Controller or to the DPO, if appointed, using the e-mail addresses indicated in the boxes below.

10.DURATION OF THE PROCESSING (art. 13 par.2 letter a of the Regulation) The processing of data will last for the period indicated in each individual purpose, subject to any technical time required for deletion. Retention for a longer period is reserved in the event of the Data Controller's defence in legal proceedings, for the entire duration of the dispute.

11.DATA CONTROLLER (art. 13 par.1 letter a of the Regulation) The identification details of the Data Controller are those indicated in the box below, together with the relevant contact points.

12.DATA PROTECTION OFFICER (DPO) (art. 13 par.1 letter b of the Regulation) The identification details of the DPO (Data Protection Officer), if appointed, are indicated in the box below.