INFORMATION PURSUANT TO ART. 13 EU REGULATION NO. 679/2016 ON THE PROTECTION OF PERSONAL DATA

In this policy, the company Walvoil S.P.A. (hereinafter also the "Company" or "Personal Data Controller") inform you about its policies for personal data processing upon your access to the Company's premises.The information is provided pursuant to Article 13 of EU Regulation no. 679/2016 on personal data protection (hereinafter also "GDPR").

1. Identity and contact details of the Personal Data Controller
The Personal Data Controller of your personal data is Walvoil S.P.A. with registered office in Via Adige 13/D - 42124 - Reggio Emilia (RE) who can be contacted at the e-mail address: privacy@walvoil.com. The Personal Data Controller has appointed its own Data Protection Officer ("DPO") who can be contacted at the e-mail address: dpo@walvoil.com.

2. Data processed
The data processed are those collected prior to the establishment of the employment relationship, which you voluntarily provide as a candidate ("Candidate"), upon of your job application or later. These data are those typically contained in a Curriculum Vitae, consisting of personal data, educational and professional careers, specific skills and knowledge, as well as the additional data that will be provided by the Candidate during the selection procedure. The data will be processed by manual processing or electronic or in any case automated, computer or telematic tools. It should be noted herein that, for particular types of selection, it will be necessary for Candidates to provide data belonging to "special categories" pursuant to Article 9 of the GDPR (for example, belonging to protected categories or data relating to physical fitness). Any processing of such data will take place in compliance with the provisions relating to the processing of special categories of data, pursuant to Article 21, paragraph 1 of Legislative Decree no. 101/2018 (GU Serie Generale n. 176/2019) ("Authorization Measure"). In this regard, unless strictly necessary, Candidates are invited to omit any information or data not strictly relevant to the selection in their CV or in further communications made to the Personal Data Controller.

3. Purpose and lawfulness of the processing
The collection and processing of personal data provided by the Candidate takes place exclusively for the purposes of research, evaluation and selection of personnel in the interest of the Company for the purpose of a possible establishment of an employment relationship. The legal basis for the processing of your personal data for the aforementioned purposes is Article 6, paragraph 1, letter b) of the GDPR, i.e. "the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract". Any processing of Personal Data belonging to "special" categories pursuant to Article 9 of the GDPR for the aforementioned purposes is justified by the aforementioned Authorization Provision.

4. Nature of the provision and consequences of any refusal
The communication and updating of some of your personal data, the provision of data and the related processing is voluntary, however, any refusal to provide the data (or your desire to request their cancellation), may make it impossible for the Personal Data Controller to initiate or continue the selection or evaluation procedure of your job application.

5. Recipients and data transfer
Your personal data, for the exclusive pursuit of the purposes specified above, may be shared with:
a) subjects within the Company who act as authorised by the Personal Data Controller;
b) external parties who carry out specific tasks on behalf of the Personal Data Controller and functional to the purposes indicated above (e.g. employment consultants, recruiting agencies, etc.);
c) third parties appointed by the Company to provide IT or storage services;
d) public bodies in compliance with regulatory obligations or specific requests.

The subjects belonging to the categories to which the data may be communicated will use them as "Personal Data Processors" specifically appointed by the Company pursuant to art. 28 of the GDPR or autonomous "Personal Data Controllers".

Apart from the above cases, your Personal Data will not be disclosed, nor will they be transferred to third parties outside the territory of the European Union. If, for the purposes indicated, the Company should in any case need to transfer your Personal Data outside the European Union, to countries not considered adequate by the European Commission, the Company will take the necessary measures to protect your Personal Data.

6. Data retention times
Your personal data are stored by the Company only for the period necessary for the purposes for which they are processed or within the terms provided for by applicable national and EU laws, rules and regulations. Your personal data will be stored for the purposes indicated in point 3 above for a maximum period of 2 years from their provision and may be used for contacts and any future interviews also in relation to open positions other than the one for which you have submitted your application. This is without prejudice to the possibility for the interested party to exercise the immediate right to erasure in the event that he or she does not obtain the position for which he or she has applied. At the end of this period, your data will be permanently deleted. If your application is accepted, your personal data will be stored and processed by the Company in accordance with the privacy policy prepared for employees.

7. Rights of the data subject
With regard to the processing of personal data carried out by the Personal Data Controller, it is possible, at any time, to exercise the rights provided for by the GDPR and in particular: the right to access personal data and to obtain a copy thereof (art. 15 GDPR); the right to rectification of personal data (Art. 16 GDPR); the right to erasure of personal data (Art. 17 GDPR); the right to restriction of the processing of personal data (Art. 18 GDPR); the right to data portability (art. 20 GDPR); the right to object to processing (art. 21 GDPR); (where applicable) the right to withdraw the consent freely given at any time without prejudice to the lawfulness of the processing based on the consent given before the withdrawal (art. 7 GDPR).

You may exercise your rights by sending a specific request to the Personal Data Controller by e-mail to the addresses above.

Requests relating to the exercise of your rights will be processed without undue delay and, in any case, within 30 days of receipt of the request.

In any case, you always have the right to lodge a complaint with the competent supervisory authority pursuant to Article 77 GDPR if you believe that the processing of your data is contrary to the applicable data protection legislation. For Italy, the supervisory authority is the Guarantor for the protection of personal data, which can be contacted following the indication of the following link: https://www.garanteprivacy.it/home/footer/contatti

Version updated to 15 May, 2025