APPLICANT PRIVACY POLICY

The following Privacy Policy – according to article 13 of General European Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as “GDPR”) aims to describe how the personal data of applicants are processed and to inform the data subject.

NHOA Energy S.r.l. (hereinafter NHOA) subject to the direction and coordination of NHOA S.A., registered office at Milan, Piazzale Lodi, 3 – 20137 is Data Controller of the applicant personal data. If you would obtain more information about the data processing, you could contact the Ethics & Compliance Officer, writing to the following email address [email protected].

PERSONAL DATA PROCESSED

NHOA process the personal data provided during the recruiting process, such as: name, surname, e-mail, address, telephone number, data relating to your studies and professional experience indicated on the CV transmitted or subsequently communicated. If you do not want to provide these personal data, will make it impossible to carry out the recruiting procedures concerning your application.

If you have voluntarily included in your CV, or subsequently communicated personal data revealing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, unions, associations or organizations of a religious, philosophical, political or trade union, as well as personal data disclosing health or sex life (c.d. particular categories of personal data), these will be deleted, unless their use is strictly necessary for the searching and recruiting selection and for establishing the employment relationship (eg. in case of sheltered group) within the limits and in accordance with the provisions of the Data protection Law.

POURPOSES OF THE DATA PROCESSING

NHOA process your personal data in order to:

• be compliant with legal obligation

• follow up the human management procedures and employment activities relating to your profile. For this purpose, the data are processed by the Human Resources Department.

LEGAL BASIS OF DATA PROCESS

The processing of personal data is necessary to evaluate your CV, send it to the “InRecruiting” platform in order to put in place all employment activities and procedures to hire the candidate, compliant with the job vacancy requirements.

HOW TO PROCESS THE PERSONAL DATA

The data processing carries out with information system and organizational and logical methods strictly related to indicated purposes and are implemented all technical and procedure security measures to ensure the confidentiality, integrity, availability and resilience of data processing, in compliance with article 32 of GDPR.

The personal data could be transferred to abroad, outside the EU also, in comply with the applicable law.

COMMUNICATION OF PERSONAL DATA

Data Controller could authorize internal to perform the data processing. The internal parties are “people in charge of data processing” involved in the business organization like human resource department and Line manager requesting the applicant.

Data Controller could asks to an external person and/or external company (“Sub-processor”) to carry out activities entailing the processing of applicant personal data, under the responsibility of the Sub-Processor and subject to prior express authorization of the Data Controller.

DATA RETENTION

NHOA maintains your personal data as long as necessary to perform the purpose for which the data are gathered. The CVs will be kept for the time strictly necessary to conduct the processing activities.

DATA SUBJECTS RIGHTS

Data Controller shall provide the data subjects the exercise of the following privacy rights:

• confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data, ae required by article 15 of the GDPR (Right to access);

• rectification of inaccurate personal data concerning him or her or integration of him or her incomplete personal data (Right to rectification);

• erasure of personal data concerning him or her, in accordance with the reasons described in article 17 of the GDPR (Right to be forgotten);

• restriction of processing, when one or more of the cases provided by article 18 of the GDPR (Right to restriction);

• receive the personal data concerning him or her, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller (Right to data portability)

Moreover, the user has the right to make opt-out of consent of data processing, anytime, without prejudice to the lawfulness of the processing based on the consent given before the opt-out.

To exercise your rights, you and send an email with the following subject “PRIVACY", to “[email protected]”.

The data subject can claim Privacy Authority, when he believes the data processing is carried out in violation of the Regulation. Further information is available on the website http://www.garanteprivacy.it.