CANDIDATE PRIVACY NOTICE In accordance with: -Legislative Decree n. 196/June 30 2003, modified by Legislative Decree n. 101/August 10 2018, Data Protection Code (referred to as “Privacy Code”); -EU Regulation n. 679/April 27 2016, which defines the terms of Personal Data Protection (referred to as “Privacy Regulation”). *** We wish to inform You that, when You send us Your resume and fill in the application form on the website www.rbw-cgi.it, for the purpose of evaluating Your possible recruitment, We collect and process Your personal data (as “Applicant”), which will be processed in accordance with the current legislation in matters of Personal Data Processing. Personal data is defined in art. 4 of the Privacy Regulation as: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”. Art. 9 of the Privacy Regulation defines some “special categories of personal data”, that is to say those that reveal a person's racial or ethnic origin, their political, religious or philosophical beliefs, or their trade union membership, but also data concerning a person's sex life or sexual orientation; basically, data that helps reveal a person's health (absence due to sickness, maternity, injury or invalidity) and assess whether they are eligible or not for certain positions. Data processing (art. 4 of the Privacy Regulation) means: “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;”. In particular it points out that, as far as data selection is concerned, Our Company, subject to Your consent, is allowed to process special categories of data because necessary to detect, for example, a general state of health or specific conditions, and reveal whether an Applicant might belong to a protected class; Subject to Your specific consent, and always in reference to data selection, we are also allowed to collect and store one or more of Your photographic images, which would be attached to the information collected during the job interview. Such images can be used for the purpose of an Applicant's easier identification and can be uploaded in the candidate management software. 1. Data Controller, Data Processors and Data Protection Officer. Data controller is Rainbow CGI Srl (referred to as the “Company” or the “Controller”), with registered office in Rome, Via della Bufalotta 374 – 00139 Rome, VAT number 08915471000, email info@rbw-cgi.it The up-to-date list of the data processors, if designated, will be provided to interested parties and/or Users upon written request. Where a Data Protection Office is appointed (in accordance with art. 37 of the Privacy Regulation), their address will be published on the Controller's website. 2. Purposes, modalities and duration of data processing. The Applicant's personal data is processed, in the context of a normal recruitment activity, to verify the possibility to actually hire the Applicant. Furthermore, Your personal data is processed for the purpose of evaluating Your application, contacting You for a possible job interview and carrying out any other activity necessary to the recruitment of new members or collaborators of the Company, pursuant to the principle of gender equality that states it is illegal to discriminate against an Applicant because of their gender, in accordance with Legislative Decree n. 198/11 April 2006 (Equal Opportunities Legislation), modified by Legislative Decree n.5/25 January 2010 and Law n. 183/4 November 2010. In reference to the aforesaid purpose, personal data is processed by specifically authorized entities that act in accordance with art. 28 and 29 of the Privacy Regulation and article 2-quaterdecies of the Privacy Code, and also by external entities (for example, recruitment agencies, external consultants for the processing of remuneration data, etc...), which can be designated as autonomous Controllers or as Data Processors. Data processing can be performed by way of IT tools, via internet or on paper, in accordance with the laws that guarantee safety and privacy, aimed at preventing any unauthorized access, theft, disclosure, modification or unauthorized destruction of the Applicant's data, and that guarantee the exactness, update and relevance of the personal data in reference to the stated purpose. The collected personal data will be stored in electronic and/or paper files in the Company's registered office, for the amount of time required to complete the recruitment procedure and, in any case, for no longer than 12 months after collection; at the end of this period of time Your data will be deleted. The Company reserves the right, only possible, to contact You before cancelling Your data to see if You are still interested in having Your data processed for the sole purposes stated in this privacy notice. Your data will be processed in Italy and within the EU. 3. Mandatory or optional nature of data provision, consequences of refusing and legal basis for processing In reference to the aforementioned purposes, personal data provision is mandatory, since without such data it would be impossible to hire the Applicant. Therefore, the legal basis for processing is the verification of the possibility to hire the Applicant (in accordance with art. 6, paragraph 1, letter b of the Privacy Regulation). In reference to the processing of special categories of personal data, because necessary to detect, for example, a general state of health or specific conditions (for example physical problems, allergies, belonging to a protected class, grade of disability), the legal basis for processing is Your explicit consent, in accordance with art. 9, paragraph 1, letter a of the Privacy Regulation. The provision of one or more photographic images to be attached to the information collected during the job interview for recruitment purposes is optional; not providing the images and not giving consent to use them does not result in the impossibility to take part in the recruitment procedure: the legal basis for processing is, therefore, Your possible consent (in accordance with art. 6, paragraph 1, letter a of the Privacy Regulation) 4. In what context and who we can share the Applicant's personal data with. Within the limits of the purposes stated in the present privacy notice, Your personal data will be shared where required by law, regulation or community legislation. In particular, Your personal data will be shared with the Bureau for Public Security, Public Authorities or private companies as required by legal obligations. Personal data will not be processed outside the European Union (EU) The aforementioned entities, which Your personal data will or may be shared with, (since they are not officially appointed as Data Processors) will process Your personal data as data Controllers in accordance with the current legislation, in full autonomy, being unrelated to the processing performed by the Controller. A detailed and constantly updated list of these entities (featuring their addresses) is always available at the Controller's registered office. Personal data will not be shared and disclosed to unwanted third parties. 5. The Applicant's rights You can exercise Your right to access Your personal data in accordance with art. 15 and ff. Of the Eu Regulation for what concerns the rectification and cancellation of personal data, restriction of processing of personal data, portability and objection to data processing. You can exercise Your right by writing to the following address: info@rbw-cgi.it. 6. Right to lodge a complaint by art. 77 GDPR If our Company does not respond within the time limit provided for by law or replies inappropriately, You can lodge a complaint to the Personal Data Protection Authority, using the following contacts: website www.gpdp.it or www.garanteprivacy.it, email garante@gpdp.it, fax (+39) 06.69677.3785, phone number (+39) 06.69677.1. The Controller Rainbow CGI Srl

I agree to the data treatment pursuant to article 13 of Legislative Decree 196/2003