INFORMATION NOTICE PROVIDED PURSUANT TO ARTICLES 13–14 OF THE GDPR (GENERAL DATA PROTECTION REGULATION) 2016/679 TO CANDIDATES

This information notice is provided to individuals (“the Candidate” or “the Candidates”) who, either spontaneously or following a recruitment process carried out by TPS Group—acting in the name and on behalf of its affiliated companies, namely T.P.S. S.p.A., Aviotrace Swiss SA, Air Support International S.r.l., E.M.T.B. S.r.l., FORE S.r.l., HB Infrastructure S.r.l., HB Technology S.r.l., Omniaproject Engineering S.r.l., S.Te.L. S.r.l., Satiz Technical Publishing & Multimedia S.r.l. and Stemar Consulting S.r.l. (hereinafter: the “Companies” or the “Joint Controllers”)—submit or make available their curriculum vitae and other information relating to their professional experience, pursuant to Articles 13–14 of EU Regulation 679/16 – “European Regulation on the Protection of Personal Data” (“GDPR”).

Nature of the data processed and purposes: The personal, identification and curricular data, as well as any sensitive data, collected from the data subject or from third parties used by the Data Controllers for recruitment procedures, are processed and used to respond to the Candidate’s request and, specifically, to assess the requirements for potential hiring and/or the start of a collaboration. Only common data will be collected; therefore, the Candidate is not required to provide so-called special categories of data as defined in Article 9 of Regulation 2016/679 or data concerning health. An exception applies where such data must be known due to the nature of the employment relationship being established, particularly regarding potential inclusion in the category of disabled people or any mandatory pre-employment medical examinations.

Obligation or option to provide data: Providing data is optional and depends on the Candidate’s decision to submit their curriculum vitae. With regard to any data later requested by the Controllers, failure to provide such data will make it impossible to verify the requirements for hiring and/or initiating a collaboration and, therefore, to establish a relationship with the Controllers. Consent to processing is not required under Article 9(1)(c) of Legislative Decree 101/2018, since the processing concerns data included in the curriculum vitae voluntarily submitted by Candidates for the purpose of potentially establishing an employment or collaboration relationship. The same applies to any sensitive data voluntarily submitted by the Candidate, for which consent is also excluded under Article 9(2)(b) of Regulation 2016/679.

Communication and disclosure: The collected data will not be disseminated. Data may be communicated to specifically designated third parties pursuant to Article 29 of Regulation 2016/679 if necessary for the purposes indicated (e.g., recruitment and assessment agencies); furthermore, data may be shared with other companies within the TPS Group for participation in their recruitment processes.

Retention period: Data will be retained by the Controllers for no longer than sixteen months from the date of collection, unless an employment or collaboration relationship is established.

Transfer of data to non-EU countries: Personal Data may only be transferred to non-European countries if necessary and where the level of data protection has been deemed adequate by the European Commission pursuant to Article 45 of the GDPR, or based on the signing of Standard Contractual Clauses adopted/approved by the European Commission pursuant to Article 46(2)(c) and (d), or based on other safeguards pursuant to Articles 46 and 47 of the GDPR.

Your rights: As a data subject, you have the rights listed in Article 15 of the GDPR, specifically the right to:

• i. obtain confirmation as to whether or not personal data concerning you exists, even if not yet recorded, and receive such data in an intelligible form;
• ii. obtain information regarding:
  • a) the source of the personal data;
  • b) the purposes and methods of processing;
  • c) the logic applied to any processing carried out using electronic means;
  • d) the identification details of the Controller(s), processors, and designated representatives pursuant to Article 3(1) of the GDPR;
  • e) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it as designated representatives within the State, processors, or persons in charge of processing.
• iii. obtain:
  • a) the updating, rectification, or integration of the data;
  • b) the erasure, anonymization, or blocking of data processed unlawfully, including data for which storage is unnecessary for the purposes for which it was collected or subsequently processed;
  • c) certification that the actions under a) and b) have been communicated to those to whom the data was disclosed or disseminated, except where this proves impossible or involves the use of means manifestly disproportionate to the protected right.
• iv. object, in whole or in part:
  • a) on legitimate grounds, to the processing of personal data concerning you, even if relevant to the purpose of collection;
  • b) to the processing of personal data for the purpose of sending advertising material or direct sales communications or for market research or commercial communications, via automated calling systems without the intervention of an operator, via email and/or via traditional marketing means such as telephone calls and/or postal mail.

Where applicable, you also have the rights provided under Articles 16–21 of the GDPR (right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Supervisory Authority. At any time, you may request confirmation of the existence of personal data concerning you and request communication of such data and the purposes of the processing. You may also request the deletion, anonymization, or blocking of data processed unlawfully, as well as the updating, rectification, or—where you have an interest—integration of such data. You may object, on legitimate grounds, to the processing. We kindly ask you to promptly report any changes to your personal data to the company’s relevant office so that we may comply with the applicable legal regulations that require collected data be accurate and therefore properly updated.

Data Controller: The entities acting as joint controllers are the companies belonging to TPS Group:

• T.P.S. S.p.A., headquartered in Gallarate (VA), via Lazzaretto 12/C
• Air Support International S.r.l., headquartered in Turin, strada della Berlia 500;
• Aviotrace Swiss SA, headquartered in Mendrisio (Switzerland), via Rime 1;
• E.M.T.B. Engineering Machinery Tooling Bolzano S.r.l., headquartered in Bolzano, via Ipazia 2;
• FORE S.r.l., headquartered in Turin, corso Tazzoli 215/12B;
• HB Technology S.r.l., headquartered in Gallarate (VA), via Lazzaretto 12/C;
• HB Infrastructure S.r.l., headquartered in Gallarate (VA), via Lazzaretto 12/C;
• Omniaproject Engineering S.r.l., headquartered in Pisa, via Alessandro Gherardesca 4;
• S.Te.L. S.r.l., headquartered in Collesalvetti (LI), via Spagna 46;
• Satiz Technical Publishing & Multimedia S.r.l., headquartered in Turin, corso Tazzoli 215/12B;
• Stemar Consulting S.r.l., headquartered in Turin, corso Tazzoli 215/12B.

The Data Controller, to whom you may address requests to exercise your rights and/or for clarifications regarding personal data protection, can be contacted at: privacy@tps-group.it.

This information notice may be:

• delivered in person and signed as acknowledgment by the Candidate;
• viewed and fully read if the Candidate intends to participate in a recruitment process available through the “Work with us” section of the TPS Group website or that of any of its affiliated companies. In such cases, the procedure requires the Candidate to confirm that they have read the notice.

Headquarters of the Data Controller, 2 January 2025