Privacy policy pursuant to and for the purposes of Articles 7 and 13 of Legislative Decree 23/06/2003 and EU Regulation No. 679/2016

1) We wish to inform you that your personal data is subject to processing, in either paper form and/or through automated tools, telephone, electronic tools, magnetic tools, telematics or multimedia, via Internet-Intranet, ADSL or ISDN or wireless networks, in ways compatible with the purposes indicated below.
The data processing operations are carried out for the sole purpose of searching for and selecting personnel and using methods strictly related to these purposes.
Data collection occurs when our company receives personal information from data subjects related to their professional experience, in the form of a curriculum vitae (C.V.) sent by mail, fax or e-mail or by hand or through registration of the same on our website. The data subjects’ submission of their C.V. to our company may mean: a) a spontaneous application, b) the response to specific job search and selection announcements published by the Company in local, national or foreign newspapers or periodicals, or c) the response to any personnel research carried out by third parties on behalf and in the final interest of our Companies, sometimes viewed on other specialized websites/portals. In the event that the data is provided spontaneously by the data subject to our Company, therefore not in response to any specific insertion, the data subject is asked to give explicit consent to the processing of such data only if sensitive data is provided to our company or when the data subject wants his/her application to be considered in the context of subsequent selections. In this case, the data subject must use the formula set out in point 2 below: "In accordance with L. Decree 196/2003, given the information on the Company’s website, I give your Company my consent to process my data, even the sensitive ones, and eventually communicate it to third parties, for research and selection of personnel." In the event that the personal data provided by the data subject is related to a specific announcement, our Company will carry out the processing of such data, specifying reference to that particular inquiry for personnel. The action of sending a personal C.V. will mean that the data subject is giving implicit consent to the processing of his/her data by our Company, even without a written consent, while the processing of the same data for subsequent staff selections will be done by our company only in the presence of the explicit consent of the data subject, which should be attached to the curriculum or subsequently conferred by adding the following sentence to the standard formula above: "I authorise your Company to keep my C.V. also for other future opportunities.”
2) The data may also be communicated for the same purposes to institutions for training and selection of staff, labour, tax and legal consultants, and funding bodies for training initiatives that will process them and communicate them to each other and/or to our Company as independent appointees for the same purposes.
3) Before establishing a working relationship, the possible conferment of sensitive data (i.e. those that reveal racial and ethnic origin, religious, philosophical or other convictions, adherence to religious or philosophical associations, political opinions, membership of parties, unions, associations or organisations of political or trade union nature, or state of health) is never obligatory and therefore the failure to submit them will have no consequence. Any sensitive data provided spontaneously before the establishment of a working relationship is processed within the limits of the law for the preliminary evaluation of the candidate’s professional aptitudes, for the purposes of the possible establishment of a working or similar relationship with our Company.
Pursuant to Law No. 276/2003 (Biagi Law), it is forbidden to carry out any preselection of employees based on personal convictions, union or political affiliation, religious belief, sex, sexual orientation, marital or family status or pregnancy, age, handicap, race, ethnicity, colour, ancestry, national origin, language group, health status and any disputes with previous employers even with their consent, unless these are characteristics that may affect the way in which one works or which constitute an essential and determining requirement for the performance of the work activity.
4) The submission of personal data is optional. Even without consent, our company may process personal data, which have been spontaneously provided and communicate them to third parties for the purposes indicated. The data subject is nevertheless free to withdraw his/her consent to the processing at any time by contacting our Privacy Manager, but this will make it impossible to evaluate the attitudinal aptitudes for the aforementioned purposes.
5) Sensitive data is stored no longer than is strictly necessary for pursuing the aforementioned purposes. Other non-sensitive personal data are stored for a maximum of 12 (twelve) months, solely for the purpose of rationalising personnel selection and training procedures.
6) With regard to personal data, the data subject may exercise the following rights: Art. 7 L. Decree 196/2003: Paragraph 1. (...): obtain confirmation of the existence or nonexistence of data concerning oneself even if one is not yet registered and communicate in an intelligible form regarding such data; Paragraph 2 (...): obtain also the indication of a) the origin of personal data; b) the purposes and methods of processing; c) the logic applied in the case of processing carried out with the aid of electronic instruments; d) the identifying details of the data controller responsible for the processing; Paragraph 3 (...): obtain a) update, rectification or if interested, data integration; b) cancellation, transformation into anonymous form or blocking of processed data unlawfully, including data, the retention of which is unnecessary for the purposes for which they were collected or subsequently processed; c) attestation that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, to those to whom the data have been communicated or disseminated, except in the case where such fulfilment is proven impossible or involves the use of means manifestly disproportionate to the protected right; Paragraph 4 (...) object in whole or in part a) for legitimate reasons to the processing of personal data, even if pertinent to the purpose of collection; b) to the processing of personal data for the purpose of sending advertising material, direct sales or carrying out market research, or commercial communication. Art. 8 L. Decree 196/2003: Paragraph 1: The rights referred to in Art. 7 are exercised under a request made without formalities to the data controller or data processor and through a designated person, to whom appropriate feedback is provided without delay. Paragraph 2: The exercise of the rights referred to in Art. 7, when it does not concern data of an objective nature, may take place unless it concerns the rectification or integration of personal data of evaluative nature, relating to judgments, opinions or other subjective appraisals, as well as the indication of conduct to be held or decisions being taken by the data controller. Art. 9 L. Decree 196/2003: Paragraph 1. The request addressed to the data controller or data processor can be transmitted also a) by registered letter, fax or e-mail, b) if it concerns the exercise of the rights referred to Art. 7 paragraphs 1 and 2, then also orally and in this case it is noted briefly by the person in charge. Paragraph 2. In the exercise of the aforementioned rights, the data subject may confer, in writing, through a written proxy or power of attorney to individuals, bodies, associations or organizations. A trusted person can also assist the data subject. Paragraph 3. The rights referred to in Art. 7, referring to personal data concerning deceased persons, may be exercised by those who have a personal interest, or act to protect the data or for family reasons deserving protection. Paragraph 5. The request, pursuant to Art. 7 paragraphs 1 and 2, may be renewed by the data subject, and is subject to the existence of justified reasons, with an interval of no less than ninety days.
Please contact us for any request or clarification concerning the exercise of the rights referred to in Articles 7, 8 and 9 L. Decree 196/2003 through the data controller.
From 25 May 2018, the person concerned will have the right, in substitution for what has been described above, to ask the data controller for access to his/her personal data and to correct or erase them without undue delay or limitation of the processing that concerns him, or oppose their processing; he will also have the right to revoke at any time the consent for the processing of his/her personal data (ordinary and/or sensitive) for one or more specific purposes, it being understood that this will not affect the lawfulness of the processing based on consent given prior to revocation.
Furthermore, pursuant to Art. 20 of the EU Privacy Regulation 679/2016, starting from 25 May 2018, the data subject is entitled to receive, in a structured format and in a common and automatic way, the personal data concerned that was supplied to the Data Controller, and has the right to transmit such data to another data controller without hindrance by the Data Controller who provided them, if the following (cumulative) condition occurs:
a) processing is based on the consent of the data subject for one or more specific purposes (Article 6 paragraph 1 letter a) EU Reg. or upon the consent of the data subject regarding the processing of sensitive data that reveal the racial or ethnic origin, political opinions, religious or philosophical convictions, or union membership, genetic data, biometric data intended to uniquely identify a natural person, data related to health or to sexual life or sexual orientation (Art. 9 paragraph 2 letter a) EU Reg., or on a contract of which the data subject is part and the execution of which is necessary for the processing (Article 6 paragraph 1 letter b) of the EU Reg. and b) the processing is done through electronic means (software).
In exercising your rights to data portability in compliance to the above, the data subject has the right to obtain direct transmission of his/her personal data from one controller to another, if technically feasible.
The exercise of the right of the so-called law of portability illustrated above shall not prejudice the right of cancellation ("right to be forgotten") provided for by Art. 17 of EU Privacy Regulation 679/2016.
Starting 25 May 2018, for a complete examination of the rights one is entitled to, the data subject is advised to consult the text of articles 15, 16, 17, 18, 19, 20, 21, 22 of EU Privacy Regulation 679/2016.
7) The data controller who processes your personal data is A.L.M.A.G. S.P.A. with registered office in Via Vittorio Emanuele II n. 39, RONCADELLE (BS), in the person of its legal representative pro tempore, domiciled at the same, with email privacy@almag.it.
The data controller has also appointed various internal Managers, and a list of these can be made available upon written request of the data subject.

Roncadelle (Bs), 4 April 2018