.Information pursuant to art. 13 of the European Regulation n. 679/2016 and of the national legislation regarding the protection of personal data

Pursuant to Article 13 of the European Regulation on the protection of personal data (hereinafter also GDPR), Italdesign-Giugiaro S.p.A., as Data Controller pursuant to Article 24 GDPR, provides the following information:

A)  Data Controller and Data Protection Officer

The Data Controller is Italdesign Giugiaro S.p.A., with registered office in Turin, Via San Quintino 28 and operational headquarters in Moncalieri (TO), via Achille Grandi 25, which can be contacted by sending an e-mail to [email protected] or by sending a registered letter to the attention of the Head of Legal & Governance, c / o Italdesign - Giugiaro S.p.A., via Achille Grandi, 25, Moncalieri (TO).

The Data Protection Officer (DPO) can be contacted by sending an e-mail to [email protected].

B)  Typology of personal data and Purpose of processing

1.   The Data Controller mainly processes the following types of personal data:

a.  Common data (name, surname, date of birth, residence, mobile number, e-mail);

b.  Data relating to previous work experience (such as, for example, positions held, date of recruitment, company role and other data relating to work experience);

c.  Tax and income data (such as, for example, tax code, previous salary);

d.  Data provided by sending the curriculum vitae, and other data collected in the performance of personnel selection and recruitment activities, including data provided during the first contact with the candidate;

e.  Photographs (such as images on CVs);

f.   Any other data provided by the candidate;

g.  Third party data (e.g. data relating to previous employers);

h.  Data concerning your state of health (documentation of a disability situation or membership of a protected category); data relating to incapacity to perform specific tasks (e.g. data collected during a general medical examination).

2.   The personal data referred to in points 1.a. - 1.g. are collected and processed for the purposes of:

              i.       research and selection of personnel;

             ii.       to fulfil legal obligations, regulations and European legislation, in particular the obligations provided for by the CCNL and applicable collective agreements;

            iii.       to exercise a right in court.

3.   As regards the data relating to health referred to in point 1.h., they will be processed exclusively for the following purposes:

              i.       to fulfil or require the fulfilment of specific obligations or to perform specific tasks provided for by Community legislation, laws, regulations or collective agreements, (e.g. the percentage of employees with disabilities that each company must employ) in particular for the purposes of establishing the employment relationship and with regard to hygiene and safety at work;

             ii.       to ensure equal opportunities in employment.

C)  Methods of processing

In reference with the purposes mentioned at paragraph B), the data processing is also performed with the support of computerized electronic and automated means, through terminals and computers connected to an internal network and with the other companies of VW/Audi Group with mainframes and, in any case, by means of appropriate instruments to ensure security and confidentiality.

The methods applied also warrant the non-interference between the processing related to the different purposes and the access limited only to the persons in charge for each of the purposes pertaining to your work relationship through the adoption of the necessary and/or useful measures to avoid leakage or destruction (such as, for example, the adoption of passwords and usernames for the processing of personal data with electronic tools, the use of archives duly kept for the security of data in paper format).

The data stored both in paper form and through computerized databases, is kept at the Company for the necessary retention time as stated in paragraph F).

In any case, the personal data referring to you shall be processed in compliance with the methods indicated in Article 5 of the GDPR, which provide, among other things, that said data are:

- processed in a lawful and proper manner;

- collected and recorded for specific, explicit and legitimate purposes;

- accurate and, if necessary, updated;

- relevant, complete and not exceeding the processing formalities.

D) Data Communication

The data will not be communicated, disclosed or transferred, but may be shared with external consultants who support the Data Controller in the selection of personnel and in the management of the platform linked to the "Careers" section of the website, as well as with other companies of the Volkswagen/Audi group who carry out personnel selection activities on behalf of the Owner.

A complete and up-to-date list of Data Processors is available at the registered office of the Data Controller.

E)  Data Transfer

Your data are stored on servers located within the European Union, respectively at the operational headquarters of the Data Controller and at the facilities of the Data Processors who support the Data Controller in the performance of the activities referred to in points B.2 and B.3. The complete list of the Data Processors is available at the operational headquarters of the Data Controller in Moncalieri. Therefore, in relation to the purposes referred to in points B.2 and B.3, the Data Controller does not need to transfer your data to countries outside the European Union. Where the transfer of data outside the EU is necessary in relation to the purposes set out in points B.2 and B.3, the Data Controller hereby ensures that such transfer will take place in full compliance with one of the conditions set out in Chapter V of the GDPR.

F)   Retention Period

Your Personal Data will be kept for the time strictly necessary to evaluate your application, and in any case for a period not exceeding 12 months from the creation of your personal profile and the sending of your application or from the last update of your personal profile. Before the expiry of this period, you will be sent an e-mail asking you to confirm that the data relating to your account will be kept. In the event of a negative response or no response at all, your Data will be deleted from the computer system and from the paper files of the Data Controller and the Data Processors who support the Data Controller in personnel selection activities.

G)  Legal basis for processing

The processing of personal data referred to in points B.1.a. - B.1.g. is necessary for the performance of a contract to which the Data Subject is a party or for the performance of pre-contractual measures adopted at the request of the Data Subject, therefore the legal basis is found in Article 6(1)(b) GDPR.

The legal basis can also be found in Art. 6, par. 1, letter f), given that the collection of the information referred to above is necessary for the pursuit of the legitimate interest of the Controller with reference to its own needs of an organisational and productive nature. With regard to the processing referred to in point B.1.g., it is up to the Data Subject to communicate the contents of this notice to any third parties.

Where the Data Subject provides special categories of personal data that are strictly functional to the assessment of the application referred to in point B.1.h., the legal basis can be found in Article 9(2)(b) GDPR, given that the processing is necessary to fulfil the obligations and exercise the specific rights of the Data Controller or the Data Subject in the field of labour law and social security and social protection.

H)  Data subject's rights

In accordance with the articles 15 (Right of access), 16 (Right to rectification), 17 (Right to erasure), 18 (Right to restriction of processing), 20 (Right to data portability), 21 (Right to object), 22 (Right to not be subject to the automated process), 77 (Right to flodge a complaint to the Supervisory Authority) of the GDPR, the subject can exercise his rights by writing to the e-mail address [email protected].

With regard to the exercise of your rights, we inform you that you may modify, temporarily anonymise or delete your personal profile directly through the recruitment platform made available by the Controller.

With best regards,

Italdesign - Giugiaro S.p.A.