INFORMATION NOTICE REGARDING THE PROCESSING OF CANDIDATES’ PERSONAL DATAIN ACCORDANCE WITH EU REGULATION 2016/679 (“GDPR”)

DATA CONTROLLERDATA PROTECTION OFFICER (DPO)

DATA PROCESSINGPURPOSES

IdB Holding S.p.A
Address: Viale Ortles, 12, 20139, Milan
E-mail privacy@idbholding.com(“Company”)
The Data Protection Officer of each company of the group (IDB
Holding S.p.A.) is Partners4Innovation S.r.l., Via Copernico 35,20125 Milan (tel. 02/92852779), and can be reached at the e-mailaddress: dpo@idbholding.com

LEGAL BASIS FOR DATAPROCESSINGDATA RETENTIONPERIOD

Purposes connected to or instrumental Implementation
ofpre-contractual 2 years
to the carrying out of the research and measures adopted on candidate request.
selection of candidates.
Once the aforementioned retention period has expired the data will be destroyed or made anonymous compatibly with technicalerasure and backup procedures and with the accountability requirements of the Data Controller.

PERSONAL DATA PROCESSEDBy "Data" it is intended, by way of example but not limited to: forename, surname, date and place ofbirth, residence, e-mail address and telephone numbers, qualifications, work experience and any otherinformation in CVs and/or forms completed during an interview (the so-called “common data”) as
well as those suitable to reveal, by way of example, the state of health (such as belonging to protectedcategories) possibly contained in the CV or in any further documentation sent to the Company (DataController), special categories of personal data processed ( the so-called "sensitive" data).
DATA PROVISION
Mandatory for personnel research and selection activities. Refusal to provide the data does not allow
this activity to be carried out and will not allow your application to be taken into consideration.

DATA RECIPIENTSThe provision of Data is necessary for the conclusion and/or execution of the contract. The refusal toprovide the Data therefore means that it will not be possible to establish the contractual relationshipand/or to fulfil the resulting contractual obligations.
The data may be processed on behalf of the Company by parties appointed as data processors(according to art. 28 of the GDPR), who are provided with suitable operating instructions. Theseparties are essentially companies used by the data controller to select, recruit and assess candidates,
including companies in the same Group.
PARTIES AUTHORISED TO PROCESS DATA
Data may be processed by employees and/or collaborators of the Data Controller/Data Processor
who have received adequate operating instructions and who have been expressly authorized to process
it by the Data Controller/Data Processor.
PERSONAL DATA TRANSFERS OUTSIDE THE EU
The data may be transferred to non-European countries in accordance with the provisions of Articles
45 and 46 of the GDPR.

DATA SUBJECTS’ RIGHTS – COMPLAINT TO THE SUPERVISORY AUTHORITY
By contacting the Data Protection Committee via e-mail sent to privacy@idbholding.com, datasubjects can ask the controller for access to their personal data, their rectification, their cancellation,
the restriction1 of the processing in the cases provided for by art. 18 GDPR, as well as the opposition
to the processing, for reasons related to their particular situation, in the hypothesis of legitimate
interest of the Data Controller.
Furthermore, in the event that the processing is based on consent or contract and is carried out with
automated means, data subjects have the right to receive the personal data in a structured, commonlyused and machine-readable format and, if technically feasible, to transmit the data to another data
controller without hindrance.
Data subjects have the right to withdraw consent at any time.
Data subjects have the right to lodge a complaint to the competent Supervisory Authority.