Data Controller The data controller of your personal data is Vitale Barberis Canonico S.p.A. with registered office in Via Diagonale 296 - 13835 Valdilana (BI), VAT no. 01225120029 (hereinafter the "Data Controller"). The Data Controller can be contacted for all matters concerning to the processing of your personal data at the following e-mail address: [email protected].

Data Protection Officer The Data Controller has appointed a Data Protection Officer ("DPO") who can be contacted to request any information regarding the processing of your personal data at the following e-mail address: [email protected].

Data source Your personal data is generally collected directly from you. In some circumstances your data may be collected from employment agencies and headhunters.

Personal data processed For the purposes indicated in this privacy notice, the Data Controller will process the following personal data: personal details and contact data (e.g. name, surname, date and place of birth, nationality, residence, domicile, telephone number, e-mail); data contained in the curriculum vitae or provided by you filling in the data collection form available in the Careers section of the website (e.g. education, professional experiences, qualifications, areas of interest, languages spoken, positions held, hobbies, previous salaries etc.); professional photo; any additional personal data voluntarily provided by you. Special categories of personal data The Data Controller may also process special categories of data, such as data concerning health (if the applicant is part of protected categories), possibly contained in the CV or in any additional documentation provided by you. This data is processed, where necessary, to comply with specific legal obligations relevant to establishing the employment relationship (i.e. targeted employment).

Purposes and legal bases The Data Controller will process your personal data for the following purposes and related legal bases: Recruitment of personnel - even through the involvement of employment agencies and headhunters and by means of the form available in the “Careers” section of the website - in relation to the possible establishment of an employment, collaboration or internship relationship with the Data Controller. The legal basis of the processing is the execution of pre-contractual measures adopted at your request. In case of special categories of data (i.e. data concerning health) the processing would be legitimate as it is necessary to carry out legal obligations and exercising specific rights of the Data Controller or of the data subject in the field of employment and social security and social protection law (art. 9, par. 2, lett. b) of the GDPR). The provision of data for this purpose is necessary to evaluate your application; failure to provide data it will make it impossible for the Data Controller to assess your application for a job position at the company and to establish the employment, collaboration or internship relationship. Fulfilment of legal and regulatory obligations to which the Data Controller is subject (e.g. in the field of labour law, such as targeted employment). The legal basis of the processing is the fulfilment of legal and regulatory obligations to which the Data Controller is subject. In case of special categories of data (i.e. data concerning health) the processing would be legitimate as it is necessary to carry out legal obligations and exercising specific rights of the Data Controller or of the data subject in the field of employment and social security and social protection law (art. 9, par. 2, lett. b) of the GDPR). The provision of data for this purpose is necessary to allow the Data Controller to fulfil the legal obligations to which it is subject; failure to provide data will make it impossible for the Data Controller to fulfil legal and regulatory obligations to which it is subject and, therefore, to be able to establish and manage the contractual relationship. Protection or exercise of rights in judicial and extrajudicial proceedings. The condition of lawfulness of the processing is the legitimate interest of the Data Controller ascertain, exercise, or defend a right in judicial and extrajudicial proceedings, where necessary to protect its interests.

Data retention period The Data Controller stores personal data for the time necessary to achieve the purposes for which it was collected or for any other related legitimate purpose. Therefore, if personal data is processed for two different purposes, the Data Controller will store this data until the purpose with the longest-term ceases. In any case, the Data Controller will no longer process personal data for that purpose whose retention period has expired. Personal data that is no longer required, or for which there is no longer a legal basis for its retention, will be irreversibly anonymized (and thus it can be retained) or deleted. Personal data processed for purposes related to the recruitment of personnel and compliance with legal and regulatory obligations are stored for 24 months from the collection. If it is necessary to process the data for the purpose of protecting rights in judicial and extrajudicial proceedings, the data is stored for the time necessary to pursue the protection of the rights (i.e. for the entire duration of the pre-litigation and litigation, until the expiration of the terms for appeal actions).

Categories of data recipients In order to carry out certain processing activities, your data may be disclosed to external entities acting as autonomous data controllers or as data processors. Processing of personal carried out by data processors are governed by data processing agreements pursuant art. 28 of the GDPR. Personal data may be disclosed to the following categories of recipients: employment agencies; headhunters; employment offices; companies that provide IT and assistance services for our IT systems and website; companies that provide hosting services; company providing us with the software for the management of curricula; company that provides domain management and SSL certificate renewal services; law firms; Authorities and institutions to which the right to access the data is granted by laws or regulations (e.g. public security authorities and police forces. The list of recipients to whom your personal data is disclosed can be requested to the Data Controller by writing to the following e-mail address: [email protected].

International data transfers The Data Controller stores the data on servers located within the European Union. If the Data Controller - due to needs related to the headquarters or processing locations of its providers - needs to transfer data outside the European Union to countries for which the European Commission has not issued an Adequacy Decision, the Data Controller undertakes to guarantee adequate levels of protection and safeguards, including contractual ones, compliant with the applicable laws, including the adoption of standard contractual clauses pursuant to art. 46, par. 2, letter c) of the GDPR, supplemented if necessary by additional technical, legal and organizational measures necessary to ensure that the level of protection of personal data is equivalent to the one of the European Union.

Rights of the data subject In relation to the processing of your personal data, you will always have the possibility, in the cases provided by the GDPR, to exercise the following privacy rights: the right to receive confirmation that personal data is being processed and to access their content (right of access); the right to update, amend and/or correct your personal data (right to rectification); the right to request the deletion of data (right to be forgotten); the right to request the restriction of the processing (right to restriction of the processing); the right to withdraw, at any time, the consent given, where consent is the legal basis applicable to the processing, without prejudice to the lawfulness of the processing before its withdrawal (right to withdraw the consent); the right to receive a copy of the data in electronic format and to request that such data be transmitted to another controller (right to data portability); the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. In addition, you may object at any time, for reasons related to your particular situation, to the processing based on the Data Controller’s legitimate interest (right to object). If you exercise any of the aforementioned privacy rights, the Data Controller will verify that you are entitled to exercise it and you will be provided with a response, as a rule, within one month. To exercise your privacy rights, you can contact: the Data Controller at the following e-mail address: [email protected]. The DPO at the following e-mail address: [email protected].

Additional rights If you believe that the processing of your data is carried out in violation of the applicable personal data protection legislation, you have the right to lodge a complaint with the competent Supervisory Authority (in Italy, the competent Supervisory Authority is the “Garante per la protezione dei dati personali” - www.garanteprivacy.it).

Last update: April 2025 The icons reproduced in this notice have been created by the Maastricht European Centre on Privacy and Cybersecurity and disseminated by the Italian Data Protection Authority (www.garanteprivacy.it) in the form in which it received them from the authors. The icons are used here on the basis of the CC BY 4.0 license (the conditions of which are recalled), in the form in which they are published on the Italian Data Protection Authority’s website.