Optional – Failure to provide consent will prevent the Data Controller from evaluating your
professional characteristics for the purpose of establishing an employment relationship.

• Immediate deletion of CVs not aligned with corporate needs.
• 24 months from the last update for candidates whose profiles may be relevant for future positions.

• Common data

Processing will be carried out using both electronic and paper-based tools.

No processing of minors’ data is performed.

Personal data are processed exclusively within the European Union.

• Data Processor: ICT system maintenance services;
• Authorized Personnel: Employees of the Data Controller.

With regard to the processing described in this Information Notice, as a data subject you may
exercise the rights provided by Articles 15 to 22 of the GDPR, including the following rights:

• Right of access (Article 15 GDPR): the right to obtain confirmation as to whether or not
  personal data concerning you are being processed, and, if so, access to such data;
• Right to rectification (Article 16 GDPR): the right to obtain without undue delay the
  rectification of inaccurate personal data concerning you and/or the completion of incomplete
  data;
• Right to erasure (“right to be forgotten”) (Article 17 GDPR): the right to obtain without
  undue delay the erasure of personal data concerning you. This right does not apply where
  processing is necessary to comply with a legal obligation or for the performance of a task
  carried out in the public interest or for the establishment, exercise, or defense of legal
  claims;
• Right to restriction of processing (Article 18 GDPR): the right to obtain restriction of
  processing where: (a) the accuracy of the personal data is contested; (b) the processing is
  unlawful and you oppose the erasure and request restriction instead; (c) the data are required
  by you for legal claims; (d) you have objected to processing pending verification of whether
  the legitimate grounds of the controller override yours;
• Right to data portability (Article 20 GDPR): the right to receive your personal data in a
  structured, commonly used, and machine-readable format, and to transmit those data to
  another controller without hindrance, where processing is based on consent or contract and
  carried out by automated means. You also have the right to request the direct transmission of
  your personal data from one controller to another, where technically feasible;
• Right to object (Article 21 GDPR): the right to object, at any time, to the processing of
  personal data concerning you based on legitimate interest, including profiling, unless the
  Data Controller demonstrates compelling legitimate grounds overriding your interests,
  rights, and freedoms, or for legal claims;
• Right not to be subject to automated decision-making (Article 22 GDPR): the right not to
  be subject to a decision based solely on automated processing, including profiling, which
  produces legal effects concerning you or similarly significantly affects you, unless necessary
  for the performance of a contract or you have given explicit consent. In any case, such
  decisions will not concern your personal data without human intervention, and you will
  always have the right to express your opinion and contest the decision.

In addition to the above rights, you may also:

• Lodge a complaint with the Italian Data Protection Authority http://www.garanteprivacy.it;
• Withdraw your consent at any time, with the same ease with which it was granted, without
  affecting the lawfulness of processing based on consent before withdrawal.

You may exercise these rights by contacting the Data Controller at the contact details provided
above.
The exercise of your rights as a data subject is free of charge pursuant to Article 12 GDPR.
However, in the case of clearly unfounded or excessive requests, including due to their repetitive
nature, the Data Controller may charge you a reasonable fee based on administrative costs incurred,
or refuse to act on your request.
Finally, please note that the Data Controller may request additional information necessary to
confirm your identity.

Right to lodge a complaint:
You also have the right to lodge a complaint with the Italian Data Protection Authority:
www.garanteprivacy.it.