Personal data processing policy pursuant to articles 13-14 of EU reg. 2016/679

Data Subjects: candidates considered for employment.

ALIVA S.R.L. in its capacity as Data Controller, pursuant to and for the purposes of EU Regulation 2016/679 (hereinafter referred to as 'GDPR'), hereby informs you that the aforementioned legislation envisages the protection of data subjects with regard to the processing of personal data and that such processing shall be based on principles of correctness, lawfulness, transparency and protection of your privacy and rights.

Your personal data will be processed in accordance with the legislative provisions of the above-mentioned legislation and the confidentiality obligations provided for therein.

Furthermore, the Data Controller may become aware of special categories of personal data, specifically: membership in political parties, union membership, philosophical or other beliefs, religious beliefs, political opinions, racial or ethnic origin, health status, sexual life. The processing of personal data in these special categories is carried out in compliance with Article 9 of the GDPR.

Purposes and legal basis of processing: Specifically, your data will be used for the following purposes related to the execution of measures connected to contractual or pre-contractual obligations:

• processing of common and special data for personnel selection purposes for employment.

Methods of processing: Your personal data may be processed in the following ways:

• outsourcing of processing operations to third parties.

Each processing operation is carried out in compliance with the provisions of Articles 6 and 32 of the GDPR and through the adoption of the appropriate security measures provided therein.

Disclosure: Your data may be disclosed to external parties for the proper management of the relationship, specifically to the following categories of recipients, including all duly appointed Data Processors:

• I.V.A.S. Industria Vernici S.p.A. (C.F./P.IVA 00124120403).

Distribution: Your personal data will not be distributed in any way.

Your personal data may also be transferred, limited to the purposes mentioned above, to the following countries:

• EU countries;
• secure non-EU countries;
• the United States, based on a declaration of compliance with the security standards prescribed by Chapter V of EU Regulation 679/2016 GDPR.

Retention Period: We inform you that, in compliance with the principles of lawfulness, purpose limitation, and data minimization, pursuant to Article 5 of the GDPR, the retention period of your personal data is:

• established for a period no longer than necessary to achieve the purposes for which they are collected and processed for the execution and fulfillment of contractual purposes.

Data Controller: The Data Controller of the data, pursuant to the Law, is ALIVA S.R.L. (Via Bellaria, 40 , 47030 San Mauro Pascoli (FC); VAT no.: 04578750400, contactable at the following details: email privacy@aliva.it).

You have the right to obtain from the Data Controller the deletion (right to be forgotten), limitation, updating, rectification, portability, and opposition to the processing of personal data concerning you, as well as the right to exercise all the rights provided by Articles 15, 16, 17, 18, 19, 20, 21, 22 of the GDPR.

EU Reg. 2016/679: Articles 15, 16, 17, 18, 19, 20, 21, 22 - Rights of the Data Subject

1. The data subject has the right to obtain confirmation of the existence or otherwise of personal data concerning them, even if not yet recorded, its communication in an intelligible form, and the ability to file a complaint with the supervisory authority.
2. The data subject has the right to obtain the following information:
   • the origin of the personal data;
   • the purposes and methods of processing;
   • the logic applied in case of processing carried out with the aid of electronic instruments;
   • the identifying details of the Data Controller, the processors, and the designated representative pursuant to Article 5, paragraph 2;
   • the subjects or categories of subjects to whom personal data may be communicated or who may learn about them as designated representatives in the territory of the State, processors, or persons in charge.
3. The data subject has the right to obtain the following:
   • the updating, rectification, or, when there is an interest, the integration of data;
   • the deletion, transformation into anonymous form, or blocking of data processed in violation of the law, including data for which retention is unnecessary for the purposes for which the data were collected or subsequently processed;
   • the certification that the operations referred to in letters a) and b) have been notified, also as regards their content, to those to whom the data have been communicated or distributed, except in cases where this proves impossible or involves the use of means manifestly disproportionate to the protected right;
   • the portability of data.
4. The data subject has the right to object, in whole or in part:
   • for legitimate reasons to the processing of personal data concerning them, even if relevant to the purpose of collection;
   • to the processing of personal data concerning them for the purpose of sending advertising material or direct sales or for carrying out market research or commercial communication.