Information on the processing of personal data of candidates pursuant to art. 13 and 14 of the EU Regulation n. 2016/679 ("GDPR")

Version of January 12, 2022

This information is provided by the company Arper s.p.a., as the data controller of the personal data of candidates who send their Curriculum Vitae or who, in any other way, participate in selection procedures aimed at establishing employment relationships. or of collaboration with Arper (hereinafter, the "Candidates" or "Interested").

1. Data controllers - (Data Protection Officer)

The Data Controller is:

·  Arper s.p.a., with registered office in , (), , VAT number IT 03658750264.

The interested party may contact the Data Protection Officer in a secure and confidential manner, at any time, if he has general questions on the processing of his personal data, or to exercise his rights as specified below, by e-mail to the address [email protected].

2. What data are processed and on what occasion?

The Data Controller will process the Candidates' personal data ("Data") as described below:

·  Data provided voluntarily for the creation of a user profile and registration in the reserved area: the candidate can create his own profile on the site https://www.arper.com ("Site"), specifying name, surname, age, date of birth, residence (state, street, state / province), contact details (telephone number, email address);

·  Data provided voluntarily through the " Careers " section of the Site as an application for a specific position or as a spontaneous application. On this point, the candidate must complete the online application, specifying:

·     For open positions in Italy: name, surname, age, date of birth, residence (state, state / province), contact details (telephone number, email address), information relating to the educational path (qualification and related subjects ); and upload, through the specific function, the CV.

·     For open positions in the rest of the world: name, surname, age, date of birth, residence (state, state / province), contact details ( telephone number, email address), information relating to the educational path (qualification and related matters); and upload, through the specific function, the CV.

The data processed will be all those provided by the candidate in this section. Alternatively, the candidate can apply through the " Apply with LinkedIn " function, in which case the Joint Controllers will have access to the Data contained in the LinkedIn profile of the interested party .

In the event that the interested party inserts text contents containing personal data of other people (e.g. contact details), the interested party declares to assume all the obligations and responsibilities of the law, relieving the owner from any dispute, claim, claim for damages in this sense.

·  Data provided voluntarily by sending an email or paper mail: the Data processed will be those contained in the communication sent by the Candidate and contained in his CV and / or cover letter .

·  Data communicated to the Joint Controller by third parties, such as employment agencies, head hunters: the Data processed will be those contained in the CV and / or cover letter of the Candidate provided by the third party.

·  Data provided voluntarily by the Candidate during the interview, whether in person or remotely: the Data processed will be all those additional personal data that may be provided by the Candidate during the selection phase, including data that will be collected during the selection process by remote.

Any Particular Categories of Data, cd. "Sensitive Data" (eg. Data that reveal information on the psycho-physical suitability for certain jobs, relating to disabilities or disabling diseases, allergies or belonging to certain protected categories, as well as membership and any roles covered in trade unions and associations, including philanthropic, any institutional positions held, both elective and non), will be processed exclusively for the examination of the candidacy and only if this is strictly necessary, in accordance with the applicable legislation.

Interested parties are recommended not to provide data that are not necessary for the pursuit of the purposes referred to in this information on the processing of personal data. In particular, the Joint Controllers, during the selection process, do not deal in any way with the so-called "Judicial Data" of the Candidates during the selection process, therefore please do not enclose them with the application (eg, do not attach the extract of your criminal record to the Curriculum Vitae).

3. For what purposes are the data processed and on what legal basis?

The data of the interested parties will be processed for the following purposes:

·  Creation of a User Profile and registration in the personal area of the Site: creation of the profile relating to the Candidate within the Site, for the purpose of sending the application. The legal basis for the processing of data is art. 6 paragraph 1) letter b) of the GDPR, to execute a contract of which the interested party is a party;

·  Selection and evaluation of the Candidate's professional profile: to execute pre-contractual obligations of which the Candidate is a party, for the purpose of establishing the employment relationship, including, but not limited to, the evaluation of the Candidate's professional profile and the performance administrative / accounting duties in the preparatory phase for the possible signing of the employment / collaboration contract. The legal basis for the processing of data is art. 6 paragraph 1) letter b) of the GDPR, to execute a contact of which the interested party is a party or to pre-contractual measures adopted at the request of the same; in the case of Special Categories of Data, the legal basis is art. 9 paragraph 2) letter b) i.e. the need to fulfill the obligations and exercise the specific rights of the data controller or of the data subject in relation to labor law;

(the purposes indicated above are jointly defined below as the "Contractual Purposes")

·  fulfill any legal or regulatory obligations. The legal basis for the processing of data is art. 6 paragraph 1) letter c) of the GDPR, to fulfill a legal obligation to which the Joint Controller (s) is subject (hereinafter the "Legal Purposes");

·  keep the Curriculum Vitae of the Candidate: in the event that the application has had a negative result, to possibly evaluate the suitability to fill positions other than that for which the Candidate had submitted his application, in the face of the opening of new job positions , both at the relevant Joint Controller and at other Joint Controllers. The legal basis for the processing of data is art. 6 paragraph 1) letter f) of the GDPR, the pursuit of the legitimate interest of the Joint Data Controller (hereinafter the "Purposes of Legitimate Interest").

4. What is the nature of the processing of Personal Data (optional or mandatory)?

The processing of Candidate Data is mandatory with reference to the Contractual Purposes and the Legal Purposes. If the Candidate does not want his Data to be processed for these purposes, the Owner will not be able to proceed with the creation of the user profile on the Site and / or the evaluation of his profile or the outcome of the application could be affected.

The processing for the purposes of legitimate interest is not mandatory and the Candidate may oppose this processing in the manner referred to in paragraph 9 below, but if the Candidate objects to this processing, his / her Data cannot be used for the conservation of the application. with a view to possible similar open positions with other Joint Controllers.

5. How is the data processed?

In relation to the aforementioned purposes, the Data will be processed manually or automatically, both in digital and paper form, by persons authorized to process the processing within the company organization of each of the Joint Controllers, in compliance with all applicable regulations. and applicable and in order to guarantee the security and confidentiality of the data.

The Data, including any "Sensitive Data" will not be profiled.

6. Who is the data disclosed to?

The Data collected for the purposes referred to in paragraph 3 may be used by the Data Controller described here.

The Data will not be disseminated and, again in relation to the purposes referred to in paragraph 3, could be communicated to the following categories of subjects:

·  suppliers of instrumental or support services to those carried out by the Data Controller and therefore, by way of example but not limited to, experts, consultants, lawyers, auditing companies, suppliers of technological services, as independent data controllers or processors;

·  outsourcing service providers and / or trusted external consultants of the Data Controller who provide personnel search and selection services related to the purposes referred to above in this information which, specifically and depending on the case, could act as independent owners or data controllers;

·  subjects transferees of a company or business branch, companies resulting from possible mergers, divisions or other transformations of the Data Controller, as independent data controllers; And

·  subjects who can access the Data by virtue of the law provided for by the law of the European Union or by that of the Member State to which the Data Controller is subject.

The list of these subjects is available upon request via email to the Data Controller through the contacts referred to in paragraph 9 below.

7.  What is the data retention term?

The Data will be kept for the period of time necessary for the pursuit of the purposes for which such Data were collected. In any case:

·  The Candidate Data collected for the Contractual Purposes are kept for the entire period in which the position for which the application was sent is still open (for any further conservation in the event of the establishment of an employment / collaboration relationship following successful application, please refer to the relative information provided by the Joint Controller who makes the recruitment at the time of the same). The Candidate's online profile will be deleted after 24 mesi months from the last modification made. The Data Controller reserves the right to contact candidates before the expiry of this period to request them to extend the retention period of their Data or to request an update. In case of no reply, the Data Controller will delete the collected Data;

·  The Candidate Data collected for the purposes of the law are kept for the period required by specific legal obligations or by applicable legislation;

·  The Candidate Data collected for the Legitimate Interest Purposes are kept for the two years following the end of the selection phase, taking into account the frequency of the availability of new positions within the Owner's Group, or for a period of five years. for the purposes of legal defense of the rights of the owner.

In any case, at the end of each retention period, the Data will be deleted or anonymised.

8.  Are the data transferred abroad?

The Data could, in compliance with the applicable regulations, be transferred abroad even to countries not belonging to the European Economic Area (the updated list can be requested via email from the Joint Controller via the contacts referred to in paragraph 9 below). Any transfer of Data to countries located outside the European Economic Area will take place, in any case, in compliance with the appropriate and appropriate guarantees for the purposes of the transfer, pursuant to articles 44 et seq. GDPR.

9. What are the rights of the interested party?

In relation to the aforementioned treatments, the interested party may exercise, at any time and under the conditions and within the limits set out in Articles. 12 and 13 GDPR, the following rights:

(i)        Right of access (Article 15 of the GDPR); (ii) Right of rectification of inaccurate Data and integration of incomplete Data (Article 16 of the GDPR); (iii) Right of cancellation (Article 17 of the GDPR); (iv) Right to limitation of processing (Article 18 of the GDPR); (v) In the event that the processing is based on consent or on the contract and is carried out with automated tools, the right to receive personal data in a structured, commonly used and machine-readable format, as well as, if technically feasible, to transmit them to another holder without impediments pursuant to art. 20 GDPR; (vi) Right to object to the processing carried out pursuant to art. 6, paragraph 1, letters e) or f) GDPR (art.21 GDPR);

(ii)       The interested party will also have the right to lodge a complaint with the competent Supervisory Authority (Guarantor for the Protection of Personal Data in Italy) at the contacts indicated on the website www.garanteprivacy.it, where the conditions exist (Article 77 of the GDPR).

The candidate can exercise his rights by writing to the email address of the Data Processor email [email protected]

10. Changes and Updates

This information is valid from the effective date. However, the Data Controller may make changes and / or additions to this information, also as a consequence of any subsequent amendments and / or regulatory additions. The changes will be published on the Site, therefore the Candidate is requested to monitor the same to become aware of the most recent and updated version of the Information.

Each Co-Data Controller possibly not belonging to the European Union will process the Data possibly under its control in compliance with and in the application of local legislation and, if necessary, will integrate this information and put in place all further compliance obligations that may arise. be necessary.