PRIVACY POLICY STATEMENT

Poltrona Frau SpA, with registered headquarters at Via Busnelli 1, 20821 Meda (MB), Tax Code and VAT no. 05079060017, as data controller (hereinafter “Controller”), informs you, pursuant to EU Regulation 679/2016 (“GDPR”) and to the legislation, including national regulations, concerning the protection of personal data currently in force (“Privacy Legislation”), that your data will be processed in the following manner and for the following purposes:

1. Nature of data processed

The Controller will process your personal identification data (in particular, your name, surname, e-mail, telephone number, IP address, photograph, etc.) and any sensitive/specifically protected data (for example, the status of belonging to a protected category, etc.) – hereinafter referred to as “the Data” or “Personal Data” provided by you upon your registration to the “Careers” platform of the https://careers.cassina.com/privacy website (hereinafter referred to as “the Site”)

2. Purpose and legal grounds for data processing

1. Your Data is processed, without requiring your prior consent, for the following service-related purposes:

   1. To implement the contract or fulfil pre-contractual requirements, specifically:

      • to ensure your participation in the job selection for which you have submitted your application;
      • to guarantee the correct implementation of the process of employee selection (e.g. the management and evaluation of applications);
      • to contact you in order to invite you to a job interview;
      • to contact you in order to communicate the results of the application evaluation processes;
      • to ensure the fulfilment of any pre-contractual and contractual requirements necessary for the purpose of establishing an employer-employee relationship;
      • to store your CV in the appropriate database, for the purpose of evaluating it in view of other future positions that may interest you, and which are a fit for your experience and professional qualifications;

   2. To pursue the Controller's legitimate interests, specifically:

      • to include your application in the statistical analyses that we are conducting regarding the selection process;
      • to prevent or uncover fraudulent activity or abuse that may be harmful to the Site;
      • to fulfil the obligations set out by any law, regulation, community standard or order by the relevant authority;
      • to exercise the Controller's rights, such as the right to legal defense.

3. Modes of processing

The processing of your Data is undertaken – via electronic means – by the operations of collection, recording, updating, organization, preservation, consultation, elaboration, modification, selection, extraction, comparison, use, interlinking, blocking, erasure and destruction of the Data.

4. Data retention

The Controller will process your Data for the time necessary to meet your requests and fulfil the purposes set out above, and, in any case, for a period of:

5. Access to data

Your Data may be accessed for the abovementioned purposes by:

• the Controller's employees and/or collaborators, in their capacity as persons responsible for processing and/or internal data processing managers and/or system administrators;
• third-party companies or other parties (e.g. website providers, suppliers, hardware and software technicians, professional firms, etc.) which perform outsourced activities on behalf of the Controller, in their capacity as external data processors.

6. Data disclosure

Your Data may be communicated, even without your consent, for the purposes mentioned above, by way of example, to oversight bodies, law enforcement or judiciary institutions, which will process them, upon their own express request, acting as autonomous data controllers for institutional purposes and/or as required by law in the course of investigations and oversight activities.

7. Data transmission and storage location

8. Data submission

The provision of the Data is mandatory to enable the Controller to process your data for Service Purposes as described under A.1. and A.2. If you choose not to provide the Data, we cannot process your requests and provide our services to you.

9. Rights of interested parties

As an interested party, the Controller informs you that, with the exception of cases when legal limitations apply, you have the right to:

• obtain confirmation of the existence or non-existence of your Personal Data, even if not yet recorded, and have such data be made available to you in an intelligible form;
• receive and, where applicable, obtain a copy of information regarding: a) the origin and type of the Personal Data; b) the logic involved, in case of processing using electronic tools; c) the purposes and modes of processing; d) identifying information of the Data Controller and managers; e) the subjects or categories of subjects to whom the Personal Data may be communicated or who may come into contact with it, particularly if these are recipients located in third countries or international organizations; f) when possible, the data retention period or the criteria used to determine that period; g) the existence of an automated decision-making process, and, if this is the case, the logic involved, its significance and the consequences envisaged for the person concerned; h) the existence of adequate safeguards in the event of the transfer of the Data to a non-EU country or to an international organization;
• obtain, without undue delay, the updating and correction of inaccurate Data or, if you so require, the completion of incomplete Data;
• obtain the erasure, blocking or transformation into anonymous form, whenever possible, of Data in the following cases: a) it was processed unlawfully; b) it is no longer required for the purposes for which it was collected or subsequently processed; c) in case of the withdrawal of the consent on which the processing is based, and if there is no other legal basis for it; d) in the event you have objected to the processing and there is no prevailing legitimate justification for its continuance; e) if required to comply with a legal obligation; f) in the case of Data pertaining to minors. The Controller may refuse to erase the Data only in the following cases: a) the exercise of the right to freedom of expression and information; b) compliance with a legal obligation, the performance of a task carried out in the public interest or the exercise of public powers; c) public health reasons; d) archiving in the public interest, for scientific or historical research, or for statistical purposes; e) the exercise of a right in connection with a legal claim;
• have limits applied to the processing in the following cases: a) a dispute concerning the accuracy of the Personal Data; b) illegal processing by the Controller to prevent erasure; c) exercise of a right in connection with a legal claim; d) pending the verification whether the Controller's legitimate grounds take precedence over those of the interested party;
• receive, in the event that the processing is being carried out by automatic means, without impediment and in a structured, commonly used and readable format, the Personal Data relating to you, in order to transfer it to another Controller or – if technically feasible – to obtain the direct transmission of the Data from the Controller to another Controller;
• object, in whole or in part: a) on legitimate grounds, to the processing of your Personal Data, even if it is relevant for the purposes for which it is being collected; b) to the processing of your Personal Data for purposes of sending advertising or direct sales materials, or for carrying out market research or commercial communications, through automated calling systems not involving an operator, via e-mail and/or through traditional marketing channels via phone and/or mail;
• submit a complaint to the Data Protection Authority.

In the above cases, whenever necessary, the Controller will advise any third parties with whom your Personal Data has been shared regarding any exercise of rights by you, except in specific cases (i.e. when this proves impossible, or involves an effort that would be manifestly disproportionate to the right protected).

10. Procedures for the exercise of the rights

You may exercise these rights at any time by:

• sending a register letter with delivery confirmation to the Controller's address;
• sending an e-mail to dpo.poltronafrau@dpoprofessionalservice.it;

11. Data Controller and Data Processor

The Data Controller is Poltrona Frau SpA

The External Data Processor for the "Careers" platform is ALTAMIRA S.R.L., with registered headquarters at 1 Via G. Marradi, 20123 Milan.

The list of internal and outsourced External Data Processors, as well as that of system administrators, is available at the registered headquarters of the Controller at Via Busnelli 1, 20821 Meda (MB).

Poltrona Frau SpA