POLICY REGARDING THE PROCESSING OF PERSONAL DATA OF CANDIDATES

PURSUANT TO ARTICLES 13 AND 14 OF UK GENERAL DATA PROTECTION REGULATION (UK GDPR) AND
NATIONAL LEGISLATION ON PRIVACY

DATA PROCESSING MET T&S Ltd

CONTROLLER 75-77 Brook Street, London W1K 4HX, (United Kingdom)
Registration n. 9029321; VAT: 198 4715 56
(“Company”).

PERSONAL DATA PROCESSED (COMMON DATA)

Personal, professional and any other information that you have included in your curriculum vitae and/or in
the questionnaire that you will complete during the interview, such as in the following non-exhaustive
details:
- name, surname, gender, place and date of birth, marital status, nationality, residence and/or domicile
address, personal telephone numbers and e-mails, details of identification documents (identity card
and/or passport) and, where applicable, residence and work permit, tax code and/or equivalent
national identification code, family members and their identification details;
- data contained in the CV, educational and professional experience and skills acquired and
memberships in any rolls/register and professional associations.

PARTICULAR CATEGORIES OF PERSONAL DATA PROCESSED (SENSITIVE DATA)

Information regarding health and membership in the so-called “Protected categories”.

SOURCE OF DATA AND CATEGORIES OF DATA COLLECTED AT THIRD PARTIES

The data are collected from the data subject (i.e. directly provided by you) or from head hunting companies
or companies that provide recruiting services, universities or employment centers, or professional
networks used by the Company, as well as European and/or non-European legal entities that belong to
the MAIRE group

PROCESSING PURPOSES LEGAL BASIS DATA RETENTION PERIOD

OF
PROCESSING
Purposes related or instrumental to the Performance to take steps at The entire duration of the selection activity.
personnel research and selection the request of the data subject
activity. prior to entering a contract.
Verification of the data provided to Legitimate interest. The entire duration of the selection activity.
evaluate professional aptitude and skills
according to the possible position to be
filled.
Keep the data for any future selections Legitimate interest (evaluation 10 years from the termination of the
in case the selection for which you are a of a future employment selection process.
candidate has negative outcome. The opportunity)
foregoing is without prejudice to the
possibility of opposing said processing.
In this case, the Data will be deleted at
the end of the selection process for
which you have applied.
Fulfilment of obligations or exercise of Need to comply with the legal The entire duration of the selection activity.
the rights of the Company or of the data obligations to which the The Data will be processed and retained
subject provided for by applicable Company is subject and, with for the period of time envisaged from time
legislation regarding labor law and social regard to particular categories to time by applicable law (including sector
security and social protection, or by of data in compliance with the law).
collective contracts, as well as provisions of article 9.2, letter
instructions given by legitimate b) UK GDPR.
authorities and supervisory and control
bodies.
If necessary, to ascertain, exercise Legitimate interest (defence in
In the case of judicial litigation, for the
and/or defend the rights of the Company front of the court) entire duration of the same, until the
in front of the court. exhaustion of the terms of practicability of
appeals
Once the retention terms indicated above have elapsed, the Data will be destroyed or made anonymous, consistent
with the technical procedures for deletion and backup.

DATA SUPPLY
Mandatory for personnel recruitment and selection activity. The refusal to provide data shall not allow
carrying out this activity and, therefore, considering your application.
 CATEGORIES OF DATA RECIPIENTS
The Data may be communicated to parties operating as autonomous controllers or processed on behalf of
the Company by parties designated as external data processors that are given appropriate operating
instructions. These parties are essentially included in the following categories:
- companies, including companies belonging to the same group, which the controller uses for the
selection, recruitment and evaluation of candidates;
- recruitment and consultancy companies for personnel recruitment;
- companies authorized to carry out staff leasing services.

PARTIES AUTHORIZED FOR PROCESSING

The Data may be processed by employees and collaborators of the Company, belonging to the Company
Departments responsible for the pursuit of the aforementioned purposes that have been expressly
authorized for processing and have received adequate operating instructions.

TRANSFER OF PERSONAL DATA

The Data may be transferred outside the U.K. to legal entities belonging to the MAIRE group or to other
subjects by virtue of a contractual or commercial relationship or for specific business requirements. The
transfer is occasional and necessary for the execution of the selection process.

RIGHTS OF DATA SUBJECT - COMPLAINTS TO THE CONTROL AUTHORITY

By contacting the Group Corporate Affairs, Governance & Compliance Department via e-mail
privacy@[Link] the data subject may:
- ask the data controller to have access to their data, the correction, integration or deletion thereof, as
well as the limitation of processing;
- oppose processing in the hypotheses of legitimate interest of the controller1;
- receive the data in a structured form that is commonly used and legible by an automatic device, and, if
technically feasible, transmission thereof to another controller without impediments (“right to data
portability”)2.
Data subject shall also have the right to file a complaint with the competent Supervisory Authority.

KNOWLEDGE OF THE PRIVACY POLICY

I have received and read the Privacy Policy.

Date __________________________ Sign __________________________

1
The right to limit processing consists of temporarily subjecting the data preservation, in the following cases pursuant to art. 18 of the UK
GDPR:
a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the
personal data;
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use
instead;
c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the
establishment, exercise or defence of legal claims;
d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the
controller override those of the data subject.
2
The right to data portability can be exercised if the processing is based on consent or a contract and it is carried out using automated
instruments.