PRIVACY POLICY CONCERNING THE PROCESSING OF PERSONAL DATA

EX ART. 13 OF REGULATION (EU) 2016/679

Data Subjects: Candidates to be considered for the establishment of an employment relationship.

Opocrin SPA ("Opocrin SPA" or "Data Controller"), pursuant to and in accordance with EU Regulation 2016/679 on the protection of individuals with regard to the processing of personal data ("GDPR"), in its capacity as Data Controller, hereby informs you that the processing of your personal data (first name, last name, email address, social security number, residence, work, education, racial origin, etc.) ("Personal Data") will be based on the principles of fairness, lawfulness, transparency and any other principle provided for in art. 5 of the GDPR, as well as compliance with EU and national legislation on the protection of personal data.

Purpose and legal basis for processing: your Personal Data will be used for the following purposes in order to take steps at the request of the data subject prior to entering into a contract (art. 6, c. 1, lett. b of the GDPR):

- personnel recruitment for the potential establishment of an employment relationship.

For the purposes of the indicated processing, the Data Controller may become aware of special categories of Personal Data and specifically: Sensitive Data inferable from the curriculum vitae sent, racial or ethnic origins. The processing of the aforementioned Personal Data belonging to the special categories will be carried out in compliance with the provisions of art. 9 of the GDPR.

Method of processing: your Personal Data may be processed in the following ways:

- processing by means of electronic computers;

- manual processing by means of paper archives.

The processing of your Personal Data will be carried out by means of any operation or set of operations among those indicated in art. 4, paragraph 1, n. 2) of the GDPR and with the adoption of adequate security measures in accordance with the provisions of articles 6 and 32 of the GDPR.

Persons authorized to process, communication of data and categories of Recipients: where strictly necessary in relation to the aforementioned purposes of conferment, your Personal Data will be communicated by the Data Controller to certain Recipients in order to ensure the security, integrity and confidentiality of your Personal Data as well as the protection of your rights.

Your Personal Data will be processed by internal personnel specifically authorized by the Data Controller and, in particular, by the following Data Processors:

- within the scope of personnel management;

- head of the business function within which the candidate will work.

Dissemination and Transfer of Personal Data: your Personal Data will not be disseminated in any way or transferred to third countries.

Retention Period: in accordance with the principles of lawfulness, purpose limitation and data minimization, pursuant to art. 5 of the GDPR, the retention period of your Personal Data is:

- 3 years

Identity and contact details of the Data Controller: the Data Controller is Opocrin SPA Via Pacinotti, 3, 41126, Corlo di Formigine - Italy; e-mail: in the person of its legal representative pro tempore.

Rights of the data subject (articles 15 - 22 of the GDPR)

1.    As a data subject, you have the right to obtain confirmation of the existence or non-existence of Personal Data concerning you, even if not yet registered, their limitation and communication in an intelligible form and the possibility to file a complaint with the Supervisory Authority.

2.    The data subject, in particular, has the right to obtain information on:

a)      the origin of the personal data;

b)     of the purposes and methods of processing;

c)      the logic applied in case of processing carried out with the aid of electronic instruments;

d)     of the identification details of the data controller, data processors and the representative designated pursuant to art. 5, par. 2;

e)      of the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them in their capacity as designated representative in the territory of the State, managers or appointees.

3.    The data subject also has the right to obtain:

a)      the updating, rectification or, when interested, the integration of data;

b)     the cancellation, transformation into anonymous form or blocking of data processed in violation of the law, including those that do not need to be kept in relation to the purposes for which the data were collected or subsequently processed;

c)      certification that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data were communicated or disseminated, except where this proves impossible or involves a manifestly disproportionate to the protected right;

(d) the portability of the data.

4.    The data subject has the right to object, in whole or in part:

(a)    on legitimate grounds to the processing of personal data concerning him/her, even if pertinent to the purpose of collection;

a)      to the processing of personal data concerning him/her for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication.