Candidate disclosure

Pursuant to Articles 13 and 14 of the EU Regulation 2016/679 (GDPR)

Wonderful Italy S.r.l. with registered office in Via Vigevano, 35 - 20144 - Milan, VAT number 09902710962 (hereinafter, "Data Controller"), as Data Controller, informs you pursuant to Legislative Decree no. 196/2003, as amended by Legislative Decree no. 101/2018 (hereinafter, "Privacy Code") and art. 13 EU Regulation No. 2016/679 (hereinafter, "GDPR") that your data will be processed in accordance with the principles of correctness, lawfulness, transparency, in compliance with the purposes and methods set out below, collecting them to the extent necessary and accurate for processing.

1. Purpose of Processing

The Data Controller records, consults and generally processes your data contained in the CV (personal data, previous work experience, educational qualification, family situation, passport photos) for purposes inherent to the selection process. In particular, the Controller may use your data for: a) pre-contractual activities related to your stated interest in joining our employments and thus pertaining to the recruitment process, b) pursuing a legitimate interest of ours for the purpose of establishing, exercising or defending a right of ours in court.

2. Types of personal data processed

The personal data that the Company usually uses include, but are not limited to: - name, address, contact information, social security number, age, place and date of birth, educational qualification, previous work experience and qualifications (education, training courses and internships), - documents proving your identity and right to work, and any other information on your CV; - if applying through our website/Portal using her LinkedIn account or any other social media: her profile data; - feedback about you submitted by our staff and others; - we may also collect data concerning your visits to our website included therein (e.g. your IP address, browser, timestamp, location, national traffic data, location data).

In some cases we may also collect, if strictly necessary for selection purposes: - your special data referred to in Article 9 of the GDPR suitable for revealing your health status (e.g. belonging to protected categories under Law 68/99, possible disability and accommodations you need in the workplace).

Please do not include in the C.V. other special data (religious beliefs, philosophical beliefs, political opinions, membership in parties, trade unions, sexual orientation) that would be deleted anyway.

3. Legal basis

The processing of data for the purpose referred to in point 1 a) is necessary for the performance of the selection process and in general, for the execution of pre-contractual measures relating to the management of your professional relationship with us, pursuant to Article 6(1)(b) of the GDPR. The processing of data for the purpose referred to in 1(b) is necessary to pursue a legitimate interest of ours within the meaning of Article 6(1)(f) of the GDPR.

With regard to special data disclosing health and strictly necessary for the purposes of the selection, as mentioned above, it may be processed without your prior consent as the processing is necessary to fulfill obligations or perform specific tasks required by European Union legislation, laws, regulations or collective agreements, including company agreements, as well as to exercise the specific rights of the Data Controller or the data subject, in the field of labor and social security law and social protection, pursuant to Art. 9, para. 2 (b) GDPR. Reference is also made to the provisions of General Authorization 1/2016 of the Data Protection Authority, insofar as it is compatible with the GDPR.

4. Methods of collection

Your data are collected through the following modes: - through e-mail - through paper mail - at our office - through our website/portal - through third-party websites or social networks

Additional personal data may later be collected from the person concerned during the interview in an evaluation form that will be kept together with the resumes with the same retention times

• Your data may, therefore, be collected: - when the CV is received in response to personnel search and selection advertisement published by the Data Controller. In this case, only applications that meet the requirements for an assessment interview will be evaluated. - when the C.V. is sent in response to an unsolicited application: if the application is not of interest to the Holder, the submitted C.V. will be destroyed immediately. On the contrary, if it was of interest to the Holder, the office in charge of evaluating applications will provide appropriate information at the first useful contact with the interested party.

Once your application has been received, whether spontaneously or in response to an advertisement, your personal data may be entered, by personnel authorized for that purpose, in the Holder's archives, either in paper or electronic format.

5. Retention Period

The Data Controller has the right to retain your personal data for a period of up to 24 months after your application if of interest to us, or since the last activity by which you showed interest in us (e.g., registration, logging in, updating your CV on the webform). If the selection process is successful, the Company will be required to retain your personal data longer in order to comply with applicable contractual and legal obligations.

6. Mandatory provision of data and consent

The provision of data is optional and is subject to the candidate's willingness to submit his/her curriculum vitae. With regard to the data subsequently and eventually requested by the Data Controller, failure to provide it means that it will be impossible to proceed with the verification of the prerequisites for hiring and/or the start of the collaboration and therefore the possible establishment of the working relationship with the Data Controller.

7. Modalities of processing

The processing of personal data collected in the manner described above will be carried out using both manual and electronic methods and will be marked by the guarantee of maximum security in order to protect the rights and freedoms of the data subject. In particular, no processing will be carried out that consists of automated decision-making processes on the data processed.

8. Communication and dissemination of personal data

The Data Controller - without the need to request your consent - may communicate your personal data to different categories of recipients, such as: - authorized subjects of the processing involved in the operations of evaluation and selection of applications. - subjects (by way of example, companies/individuals who carry out personnel search and selection activities on behalf of the Data Controller, companies/individuals whom the Data Controller uses to perform services instrumental to the achievement of the aforementioned purposes, companies/individuals whom the Data Controller uses to perform data storage activities). These subjects may carry out said activities as autonomous data controllers, external data controllers or joint data controllers.

The Data Controller may also communicate your data for the above purposes: - To Supervisory Bodies, Judicial Authorities, Police Bodies, Public Bodies and all those subjects to whom the communication is obligatory by law for the fulfillment of the said purposes. Said subjects will process the data in their capacity as autonomous data controllers.

The data collected are not subject to dissemination.

9. Data transfer abroad

Personal data are not stored on servers located outside the European Union. It is in any case understood that the Data Controller, should it become necessary, will be entitled to move the servers outside the EU as well. In this case, the Data Controller assures as of now that the transfer of data outside the EU will take place in accordance with the guarantees provided by the GDPR including adequacy decisions of the European Commission or contractual agreements for the protection of personal data (so-called "EU Standard Contractual Clauses").

10. Your rights and how to exercise them

We inform you that, at any time and if the prerequisites are met, you may exercise your rights under Articles 15 et seq. GDPR: - obtain confirmation of the existence or non-existence of personal data concerning you and their copy in intelligible form; - obtain the updating, rectification or integration of your data; - request the deletion of your data, in the terms allowed by the regulations; - object, in whole or in part, to the processing of personal data concerning you; - limit the processing, in case of violation, request for rectification or opposition; - request portability of electronically processed data provided on the basis of consent or contract; - withdraw consent to the processing of your data, if provided. - in relation to fully automated profiling obtain human intervention from the Data Controller to express your opinion and contest the decision.

Should you deem it appropriate, you may file a complaint with the Data Protection Authority.

To exercise your rights, you may contact the Data Controller at the following e-mail address: info@wonderfulitaly.eu.