PRIVACY INFORMATION NOTICE FOR THE PROCESSING OF CANDIDATES’ PERSONALDATA (updated September 9th, 2019)

1. Introduction
This document contains the privacy notice drafted by Loro Piana S.p.A., with registered office in Quarona (VC),
Corso Rolandi no. 10, in its capacity as data controller (hereinafter, ‘Company’ or ‘Controller’), which may becontacted via the following email address privacy@loropiana.com, concerning the processing of the Personal Data(as defined below) of candidates who send their curricula vitae to the Company or otherwise participate in selection
procedures prior to entering into an employment or collaboration agreement with the Company (hereinafter, the‘Candidate’ or the ‘Data Subject’).

2. Who is the Controller?
The Company is the Controller as regards the processing of Personal Data. A complete list of the data processors
appointed by the Company may be requested by submitting a request to the address mentioned in paragraph 9 ofthis privacy information notice.
The Company has appointed a data protection officer (DPO), who may be contacted via the following email
address privacy@loropiana.com.

3. What types of Personal Data are processed?
The Company collects the following categories of personal data (the ‘Personal Data’):
1. name, surname of the Candidate;
2. the Candidate’s curriculum vitae;
3. the Candidate’s contact details;
4. residence permit and its expiry date;
5. any classification in protected categories;
6. details of current salary;
7. information relating to family members in order to check whether there are any potential situations
involving conflicts of interest.

4. For what purposes is Personal Data processed?
The Company processes the Personal Data of Candidates for the following purposes:a) assessment of the Candidate’s professional profile prior to entering into an employment or collaborationagreement;b) for administrative-accounting purposes, in preparation for the conclusion of any employment orcollaboration agreements;c) in order to comply with the applicable national or European legislation and/or to comply with requests
made by public authorities;(the purposes described in letters a) to c) are jointly defined as ‘Assessment Purposes’)d) in order to exercise and defend its interests;e) in order to complete any merger, transfer of assets, transfer of the business or of a business unit involving
the disclosure and transfer of the Candidate’s Personal Data to the third party/parties involved;(the purposes described in letters d) and e) are jointly defined as ‘Legitimate Interests Purposes’).

5. What is the legal basis for the processing of Personal Data?
The processing of Candidates' Personal Data is required for the Assessment Purposes, in order to:(i)determine whether the Candidate may be hired, in relation to the cases described in paragraph 4,letters a) to c);(ii)comply with the applicable legislative provisions as described in paragraph 4, letters b) and c).

If the Candidate does not provide the Personal Data required for the Assessment Purposes, it will not be possible
for the Company to assess his or her profile and hence to hire the candidate.
The processing of Candidates' Personal Data for the Legitimate Interests Purposes described in paragraph 4, lettersd) and e) is performed as set out in article 6, letter f) of the EU General Data Protection Regulation 2016/679 (the‘GDPR’) in order to safeguard the Company’s legitimate interests, which are fairly balanced against the Candidate’sinterests, insofar as the processing of Personal Data is limited to what is strictly necessary to complete the economic
operations requested. Processing for the Legitimate Interests Purposes is not mandatory and the Candidate canobject to such processing by following the procedure described in Section 9 below, but if a Candidate objects tosuch processing his or her Personal Data may not be used for the Legitimate Interests Purposes.

6. How is Personal Data processed?
Candidates’ Personal Data may be processed manually or using IT tools, suitable for ensuring its security,confidentiality and for preventing any unauthorised access, dissemination or changes to or removal of data throughthe adoption of appropriate technical, physical and organisational measures.
7. To whom is Personal Data passed on?
The Company may communicate Candidates' Personal Data to collaborators, employees and suppliers of the Controller, within the scope of their duties and/or any
contractual obligations with them;legal, administrative and tax consultants providing the Company with support when carrying out its
activities;

public bodies and/or legal and/or supervisory authorities, if requested by them, in the capacity ofautonomous data controllers; and

providers of cloud or IT services.

Furthermore, prior to your consent, the Personal Data can be communicated to the other LVMH Groupcompanies to evaluate your job profile for the purposes related to the establishment of an employment relationshipor a collaboration, in the event of a job offer corresponding to your profile.

8. Is Personal Data transferred abroad?
Personal Data may be freely transferred outside national territory, also to Countries outside of the EuropeanUnion, where the subsidiaries or affiliates of the Company have their offices and/or, in case you have given yourprevious consent to the transfer of Personal Data to the other LVMH Group companies, where the other LVMH
Group companies have their offices.
The transfer of the Candidates’ Personal Data to Countries outside of the European Union will be carried incompliance with the suitable and appropriate guarantees for the purposes of transfer as provided by sections 45and 46 or the GDPR.
The candidate will be entitled to obtain a copy of the guarantees on the basis of which such Personal Data istransferred and to find out where such Personal Data has been made available by submitting an explicit request in
this respect to the Controller to the address mentioned in paragraph 9 of this privacy information notice.

9. What are the Data Subject’s rights?
Without prejudice to the Candidate’s right to refrain from providing his or her Personal Data, notwithstanding
the consequences described in paragraph 5, the Candidate, at any moment and without incurring any charges,
may: (i) obtain confirmation of the existence or otherwise of the Personal Data regarding him or her; (ii) find out
about the origin of the data, the processing purposes and methods, and the logic applied to processing using
electronic means; (iii) request that the Personal Data regarding him or her be updated, rectified - or if this is in theCandidate’s interest - request that any incomplete Personal Data regarding the Candidate be completed; (iv)request that any Personal Data processed in violation of the law is rendered anonymous or blocked and object,for legitimate reasons, to processing; (v) request that the Company restrict the processing of the Personal Data
regarding him or her if (1) the Data Subject contests the accuracy of the Personal Data; (2) the processing is
unlawful and the Data Subject objects to the erasure of the Personal Data and instead asks that its use be limited;(3) although the Company no longer has any need for the data for the purposes of processing, the Data Subject
nevertheless requires the Personal Data to ascertain the existence of a right or to exercise or defend said rightbefore a court; (4) the Data Subject has objected to processing within the meaning of article 21, paragraph 1 ofthe GDPR pending an examination of the existence of overriding legitimate interests pursued by the Data
Controller with respect to those of the Data Subject; (vi) object at any moment to the processing of his or her
Personal Data for Legitimate Interests Purposes; (vii) request the erasure of the Personal Data regarding him or
her without any unjustified delay; (viii) obtain the portability of the Personal Data regarding him or her; (ix) lodge
a complaint before the Data Protection Authority if the requirements for submitting such a complaint have beensatisfied.
Any requests in this respect may be submitted in writing to the Controller via the following email addressprivacy@loropiana.com.

10. What is the retention period applicable to Personal Data?
The Personal Data of Candidates will be stored for the period required for the purposes for which the Personal Data
was collected, as set out in this privacy information notice. In any case, the Personal Data of Candidates will be storedfor Assessment Purposes and for Legitimate Interests Purposes for a period of 10 years after the end of the contract
for Candidates who have been selected, and 24 months for Candidates who have not been selected, except for thosecases in which the storage of Personal Data during an additional period is requested in the event of any disputes,
requests made by competent authorities or as required under applicable legislation.
At the end of the retention period Personal Data will be erased, anonymised or aggregated.

11. Amendments and updates
This privacy information notice will take effect from the date of its issue. However, the Company is entitled to amend
and/or supplement this privacy notice, which may also be undertaken following the entry into force of the GDPR
and of any subsequent legislative changes and/or additional legislation. Candidates will be notified in advance aboutsuch amendments and will be able to consult the text of the notice as it is continually updated on the website
www.loropiana.com.