Dear Applicant,

We hereby inform you that EU Regulation 2016/679 (the General Data Protection Regulation, or GDPR) grants every natural person the right to the protection of their personal data processed by third parties. In accordance with the provisions of the Regulation, personal data will be processed in full compliance with the principles set out in Article 5(1)(a), (b), (c), (d), (e) and (f).

The processing of personal data means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making data available, alignment or combination, restriction, erasure or destruction.

Pursuant to Article 13 of the GDPR, the undersigned hereby provides the following information:

Data Controller

The Data Controller is RECUPERO ETICO SOSTENIBILE S.P.A., with its registered office and operational headquarters in the Industrial Zone, Pettoranello del Molise (IS), Italy, without a street number (snc).

Pursuant to Article 37 of the GDPR, the Data Controller has appointed Macroazienda S.r.l., represented by Dr Francesca Ricciardi, as its Data Protection Officer (DPO). The DPO can be contacted at: francesca.ricciardi@macroazienda.it

Purposes of Processing and Legal Basis

Your personal data will be processed for the purposes of the activities carried out by the Data Controller, including:

• storing your CV in the Data Controller's records in order to consider you for future vacancies that match your professional profile;
• assessing the information contained in your CV in order to determine whether your profile matches the job vacancies offered by the Data Controller;
• carrying out recruitment and selection procedures to assess your suitability for the position offered by the Data Controller;
• collecting the information necessary to establish an employment relationship with the Data Controller.

The legal basis for processing your ordinary personal data for the purpose of managing your application is the necessity to take steps at your request prior to entering into a potential employment contract, in accordance with Article 6(1)(b) of the GDPR. The legal basis for processing special categories of personal data collected as part of your application for the purpose of managing the Data Controller's recruitment and selection process is your explicit consent, pursuant to Article 9(2)(a) of the GDPR.

Categories of Personal Data Processed

For the purposes specified above, the Data Controller may process ordinary personal data that you provide directly, such as identification details, contact information, professional history and photographs, as well as special categories of personal data that may be necessary for your application, such as information relating to membership in protected categories under Italian Law No. 68/1999, or optional information that may be included in your CV, such as trade union membership, sexual orientation, political opinions, religious beliefs or philosophical convictions. In all cases, such information is provided voluntarily by you.

Methods of Processing

Your personal data will be processed using paper-based, electronic and digital systems designed to store, manage and transmit such data in compliance with applicable data protection legislation and, in particular, Article 32 of the GDPR. Appropriate technical and organisational measures will be adopted to ensure a level of security appropriate to the risks associated with the processing, including measures to protect the security and confidentiality of the data.

Data Retention Period

Personal data collected for the purposes specified under "Purposes of Processing and Legal Basis" will be retained for six months from the date of receipt for applicants who are not hired, and for five years following the termination of the relevant employment relationship for applicants who are hired. Upon expiry of these periods, the data will be deleted.

Recipients of Personal Data

For the purposes specified under "Purposes of Processing", your personal data will be processed by duly authorised employees of our company. All such personnel are appropriately informed and instructed regarding their privacy obligations and the measures to be adopted to ensure compliance with applicable data protection requirements.

Disclosure of Personal Data

Your personal data will not be made publicly available.

Transfer of Personal Data

Your personal data will not be transferred to countries outside the European Union.

Provision of Personal Data and Consequences of Refusal

Providing your ordinary personal data is necessary to process your application. Failure to provide such data will make it impossible for the Data Controller to assess your application. Failure to give consent to the processing of special categories of personal data may also prevent the Data Controller from assessing your application, for example, where information concerning membership in protected categories, a video interview provided by you or other special categories of personal data contained in your CV are relevant to the selection process.

Data Subject Rights

The GDPR grants data subjects a number of rights, including the right to access their personal data; the right to obtain the rectification or erasure of such data, or the restriction of processing concerning them; the right to object to processing; the right to data portability; the right to withdraw consent, where applicable, without affecting the lawfulness of processing based on consent before its withdrawal; and the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

How to Exercise Your Rights

You may exercise your rights at any time by sending:

• a registered letter with acknowledgment of receipt to: RECUPERO ETICO SOSTENIBILE S.P.A., Industrial Zone, 86090 Pettoranello del Molise (IS), Italy;
• or an email to: info@recuperoeticosostenibile.it