Policy on the processing of personal data for recruitment

In this document, we inform you about the specifics of the processing of Your personal data carried out by Fabrick S.p.A.. In particular, information is provided here on:

1. Who is the Data Controller?
2. How to contact the Data Protection Officer?
3. What data are or may be processed and what are the sources of data?
4. For what purposes are the data processed and on what legal basis?
5. To whom may the data be disclosed?
6. Can the data be transferred outside of the European Economic Area?
7. How long will the data be stored?
8. What are Your rights?

1) Who is the Data Controller?

The Data Controller of Your personal data is Fabrick S.p.A. (hereafter, the "Data Controller" or the "Company") with head office in Biella (BI) - 13900, Piazza Gaudenzio Sella, 1.

2) How can the Data Protection Officer be contacted?

The Data Protection Officer (hereinafter also "DPO - Data Protection Officer") may be contacted at the following addresses:

• postal address of Fabrick S.p.A.: Piazza Gaudenzio Sella 1, 13900, Biella - DPO;
• e-mail address: privacy@fabrick.com

3) What data are or may be processed and what are the sources of data?

The processing concerns your personal data as a candidate (hereinafter referred to as the "Data Subject"), present in your curriculum vitae and acquired during the recruitment and personnel selection process, with particular reference to the following categories:

• identification, personal and contractual data (such as: name, surname, tax code, details of identification document and copy thereof, telephone number and e-mail address)
• data revealing the economic and professional situation (such as: annual salary, professional classification, information on training and professional career)
• data belonging to special categories, in accordance with art. 9 of the Regulation, which may be included in your curriculum vitae, with particular reference to your eventual eligibility to protected categories and corresponding disability percentage.

The aforementioned data are provided by you personally to the Company by filling in specific online application forms to apply for job positions, social networks or communicated by third parties, such as personnel search and selection companies, which process the data as independent data controllers.

4) For what purposes are data processed and on what legal basis?

The processing of personal data is carried out exclusively in the presence of one of the following legal grounds and is limited to the pursuit of the related purposes

• the fulfilment of a contract or pre-contractual measures adopted at the request of the Data Subject, in accordance with Art. 6 par. 1 lett. b) of the Regulation, in order to follow up on applications, manage the staff search and selection process as well as any preliminary stages in the establishment of the employment relationship
• the fulfilment of a legal obligation to which the Data Controller is subject, in accordance with Article 6 par. 1 lett. c) of the Regulation, in order to comply with social security, welfare and tax obligations, during the possible establishment of the employment relationship;
• with reference to data belonging to special categories, the fulfilment of regulatory obligations and exercising specific rights of the data controller or of the data subject in the field of labour law and social protection, in accordance with Art. 9, par. 2, letter b) of the Regulation, in order to comply with any obligations relating to personnel belonging to protected categories.

With reference to the above-mentioned purposes, the provision of data is compulsory and your consent to their processing is not required; failure to provide one or more data will not allow the personnel search and selection process to continue.

5) To whom may the data be disclosed?

Personal data are processed by employees and collaborators of the Company and may be communicated to the following categories of subjects, for the same purposes expressed in paragraph 4

• public entities within the scope of any communications required by law (e.g. INPS);
• parties that provide work consultancy services or in the legal or tax field;
• companies, including those belonging to the Sella Group, which provide the Company's technological infrastructure, as well as assistance to the Data Controller in the phase of establishing the employment relationship.

These subjects, if the conditions are met, are appointed Data Processors, in accordance with Article 28 of the Regulation.

6) Can data be transferred to countries outside of the European Economic Area?

For the pursuit of the purposes set out in paragraph 4, your personal data are processed within the European Economic Area and are not circulated.

7) How long will the data be stored?

The processing will have a duration required to pursue the purposes for which your data have been collected and/or provided, as listed above. In particular, should the selection process result in a negative outcome, your data may also be stored and processed for subsequent selection activities for a period of time not exceeding 24 months.

8) What are Your Rights?

We inform you that you can learn which personal data are processed by the Company and, where the conditions are met, exercise the rights regarding their use recognised to you by the Regulation (right of access, rectification, cancellation, restriction of processing, portability, withdrawal of consent to processing and to obtain a copy of the appropriate safeguards adopted where the data are processed in countries outside the European Economic Area, as well as to obtain indication of the place where such data are stored or transferred, and to object on legitimate grounds to a particular processing operation), by contacting:

• Fabrick S.p.A. postal address: Piazza Gaudenzio Sella 1, Biella - 13900;
• e-mail address: privacy@fabrick.com.

We also inform you that if you believe that the processing of your data violates the Regulation, you have the right to lodge a complaint with the supervisory authority for personal data protection (hereinafter, the "Data Protection Authority"), in the manner indicated on the Data Protection Authority's website.

The Company shall provide you with information on the action taken regarding your request without undue delay and at the latest within one month of receipt thereof.