Information provided pursuant to and for the purposes of article 13 EU Regulation 2016/679 (GDPR)

In compliance with Regulation (EU) 2016/679 (GDPR), we are providing the privacy policy information required. This information is provided pursuant to art. 13 GDPR and in compliance with Opinion 2/2017 “processing workers’ personal data” prepared by the Article 29 Work Group for data protection.

1.PROCESS CONTROLLER, pursuant to arts. 4 and 24 of EU Reg. 2016/679, is Molteni & C- S.p.A Via Rossini, 50, Giussano (MB) in the person of its legal representative pro-tempore, T +39 0362 3591 - F +39 0362 354448 - email address: privacy@molteni.it

2.TYPE OF DATA PROCESSED/PROCESSABLE

Personal data any information (including images, photos and video) concerning a data subject, with specific reference to an identifier such as a name, an identification number, location data, an online identifier or one or more characteristic elements of the person’s physical , physiological, genetic, mental, economic, cultural or social identity – ref. art. 4, par. 1, no. 1 GDPR;
Any special data categories such as racial and ethnic origin, or related to health – ref. art. 9 GDPR.

3. PROCESSING PURPOSE LEGAL BASIS, DATA RETENTION PERIOD , NATURE OF THE PROVISION

PROCESSING PURPOSE	LEGAL BASIS	RETENTION PERIOD	NATURE OF THE PROVISION
A)Selection of personnel, performing personnel search and selection activities to possibly establish a working relationship, also for positions other than those for which the data subject provided its candidacy spontaneously; retention of personal data also for future selections; management of candidacies also in response to job offers published on our website; interviews and any video-interviews (data processing of video/audio too).	processing is needed to execute pre-contractual measures that the data subject is part of or at the latter’s request; (C44) art. 6 par. 1 letter b) of the GDPR	For the duration of the selection and for future selections, and maximum 24 months	Personal data must be provided to process data for selections Not providing the personal data makes it impossible to apply
B) for the above selection, the Controller can view the candidate’s publicly accessible “social profile” on social media. The Controller may collect and process the candidate’s personal data to the extent in which that collection is needed and pertinent to perform the job.	Processing is needed to pursue the legitimate interest of the process controller or third parties, as long as the interests or rights and the fundamental liberties of the data subject requiring protection of personal data do not prevail (C47-C50) art. 6 par. 1 letter f) of the GDPR	In principle, data collected during the hiring process will be erased as soon as it is evident that no job offer will be made or that the offer will not be accepted by the candidate, and maximum 24 months	Providing personal data is optional Not providing the personal data does not make the selection impossible
C) Communication of personal data and the curriculum vitae to group companies for their selection needs	Processing is needed to pursue the legitimate interest of the process controller or third parties, as long as the interests or rights and the fundamental liberties of the data subject requiring protection of personal data do not prevail (C47-C50) art. 6 par. 1 letter f) of the GDPR	In principle, data collected during the hiring process will be erased as soon as it is evident that no job offer will be made or that the offer will not be accepted by the candidate, and maximum 24 months	Providing personal data is optional Not providing the personal data does not make the selection impossible

4.DATA RECIPIENTS OR RECIPIENT CATEGORIES

The personal data will be communicated to subjects who will process the data as individuals acting under the authority of the Controller and the Processor (art. 29 of EU Reg. 2016/679) and data processors (art. 28 of EU Reg. 2016/679), for the above listed purposes, and to autonomous third party controllers. More specifically, the data will be communicated to: - group companies; -subjects providing services to manage the information system and the communication networks (including e-mail and software platforms); - firms or Companies as part of assistance and consultancy relationships; -and third parties and labour consultants and personnel selection companies, as part of assistance and consultancy relationships; - competent authorities to fulfil legal obligations and/or the orders of public bodies, on request; the subjects belonging to the above categories act as data Processors, or operate autonomously as separate Controllers. The list of Processors is updated continuously and available by writing to privacy@molteni.it

5.TRANSFERRING DATA TO A THIRD COUNTRY

The personal data will not be transferred to a Non-EU Country. If that should be necessary, the transfer outside the European Union will take place after the data subjects have been suitably notified and within the limits and under the conditions pursuant to arts. 44 et seq. of EU Regulation 2016/679, in order to fulfil purposes connected to the transfer itself. In that case, the data subjects may obtain a copy of guarantees underlying the transfer by contacting the Controller, at the above indicated contact details.

6.AUTOMATED PROCESS

We do not use decision-making processes based on automatic processing, including profiling, without obtaining your explicit consent.

7.RIGHTS OF THE DATA SUBJECTS

You may enforce your rights as stated in arts. 15 et seq. of EU Regulation 2016/679, by writing to privacy@molteni.it. Nei casi previsti, l’interessato ha Specifically, you have the right, at any time, to be given access to your personal data by the Controller and to request the information related to processing, and to rectify, erase your personal data or limit it being processed. You have the right to object to processing based on legitimate interest. When foreseen, you have the right to the portability of your personal data. In that case, the Controller will provide the personal data concerning you in a structured, common use format, readable from an automatic device. If you should believe that the personal data processing performed by the controller breaches what is set forth in Regulation (EU) 2016/679, you may submit a complaint to the Privacy Control - Guarantor Authority https://www.garanteprivacy.it/

8.AMENDMENTS TO INFORMATION

The controller reserves the right, at its discretion, to change, amend, add or remove any part of this privacy information, at any time. In order to facilitate control of any changes, the policy will contain the date it was updated.

Date updated: 16 July 2020