Object: Notice regarding the processing of personal data (pursuant to article 13 of the Regulation (EU) 679/2016) and the
consent to the processing of personal data (pursuant to article 7 of the Regulation (EU) 679/2016)

Dear Mr. / Mrs. / Ms. [•], pursuant to the Regulation (EU) 679/2016 (hereinafter referred to as “GDPR”), Kilpatrick S.r. l., as data controller, (hereinafter referred to as “Kilpatrick” or “Data Controller”), would like to inform you about the following.
Taskforce – Kilpatrick S.r. l. is a company specialised in the research, selection and validation of suitable candidates for vacancies in both national and international companies from all sectors.

1. The purpose of the data processing and the legal basis. Your personal data is processed by Kilpatrick, on behalf of its clients, in
order to adequately manage the processes of recruitment, selection and validation of suitable candidates for job vacancies. All your personal data, processed by Kilpatrick, have been voluntarily provided, or they refer to information regarding your professional expertise or your personal development which is in the public domain and was collected through searches performed by Kilpatrick on the internet or on the social media (e.g. Facebook, Google, LinkedIn, Twitter, etc.), provided that such
information is relevant for your application to a certain job vacancy in relation to which the search was performed.
All the information referred to above is considered “Information regarding the Applicant” and is processed by Kilpatrick in accordance with the procedures set out below. The “Information regarding the Applicant” is processed by Kilpatrick in
order to perform job searches, until the moment you decide to revoke your consent regarding the processing of your personal data by Kilpatrick. In case you decide to revoke your consent regarding the processing of your personal data, Kilpatrick will discontinue using such data and will arrange for their deletion from all archives.
Any processing, by the Data Controller, of any special categories of personal data (for example, the fact that the data subject belongs to a “protected group”), which you have voluntarily provided, will comply with the provisions in article 9.2 paragraph a) of the GDPR.

2. The purpose of the data processing and the legal basis. Kilpatrick and the companies belonging to the Group process the
following types of “Information regarding the Applicant”:
a) your contact details (name, surname, address, telephone number, e-mail address, etc.);
b) your biographical data;
c) information regarding your professional training;
d) information regarding your formal qualifications, professional diplomas and certificates;
e) your professional background and remuneration history;
f) information related to your suitability to occupy vacancies advertised by the clients of Kilpatrick, resulting from the assessment of your professional profile;
g) information regarding your professional expertise and personal background, which is publicly available on social media (for example, Facebook, Google, LinkedIn, Twitter, etc.), or which can be found on the internet and which may be important in determining whether your application is successful for a certain job;
h) any sensitive/specific information that you have chosen to communicate and disclose to Kilpatrick.
The “Information regarding the Applicant” may be processed by Kilpatrick for the following purposes:
i) to perform research for potential job applicants on behalf of clients with job vacancies;
j) to verify if the job applicant is suitable for the job vacancies indicated by clients of Kilpatrick;
k) to inform the job applicants regarding a job that might suit their skills and abilities;
l) to introduce the job applicant to the clients, with a view to a possible validation and inclusion of such applicant in their organisation;
m) to verify the information regarding the academic background and professional training, either directly declared by the job applicant or available in the public domain;
n) to perform searches related to the job applicant’s professional and personal background information made public on social networks (e.g. Facebook, Google, LinkedIn, Twitter, etc.) or directly provided by the job applicant, as long as such searches are relevant for the selection process regarding a job vacancy;
o) to follow and monitor the process of integration of the job applicant in the new company, to contact the involved parties and to provide them with the appropriate support, in order to allow them to reach their full potential in their new position, as soon as possible;
p) to contact the job applicant, after his/her start in the new position, in order to obtain reference information which allows Kilpatrick to assess the possibility to provide the new company with other job applicants, or in order to source information regarding potential job applicants for other clients;
q) to manage the database where the “Information regarding the Applicant” are archived.

3. Data processing.
In order to ensure transparency and compliance with the principles outlined in article 12 of the GDPR, it should be noted that the “processing of personal data” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or
combination, restriction, erasure or destruction. The processing of your personal data may be performed with or without electronic or automatic means, and it will also include their communication to the entities indicated in the following paragraph 6, within the limits and the conditions outlined in the GDPR.
The “Information regarding the Applicant” is archived in databases located in Italy or in other member countries of the European Community. The “Information regarding the Applicant”, stored in the databases, can be accessed only by Kilpatrick’s employees or associates, or by other persons who have been expressly authorised and appointed as “Data processors”, acting on behalf of Kilpatrick, in order to manage the recruiting and selection process for the clients of Kilpatrick.

4. Methods for the processing of personal data.
The personal data undergoing processing:
a. are processed lawfully and fairly, by entities authorised to perform such activities, entities which are permanently identified, properly trained and made aware of their obligations pursuant to the GDPR;
b. are collected and recorded for determined, explicit and legitimate purposes, and are used in other data processing operations in conditions which are compatible with such purposes;
c. are exact and updated, if necessary;
d. are relevant, complete and not excessive in relation to the purposes for which the data were collected or subsequently processed;
e. are stored in a form that allows the identification of the data subject for a time period not exceeding the time necessary for the purposes for which the data were collected or subsequently processed;
f. are processed using paper-based documents, automatic or computerised means, using safety measures in order to guarantee the confidentiality of the data subject to whom the personal data refer to and to avoid undue access by unauthorized third parties or company personnel.

5. Nature of the data disclosure and the consequences of the refusal to reply.
Your personal data need to be provided in order to allow Kilpatrick to manage the recruiting, selection and job integration activities. In case of refusal to disclose the personal data requested, or in case of opposition to the processing of the disclosed personal data, it will not be possible for Kilpatrick to manage the above-mentioned activities.

6. Disclosure of personal data.
All the “Information regarding the Applicant” are mainly processed by Kilpatrick. However, taking into consideration the type of personnel research that might be performed by Kilpatrick, it is possible that “Information regarding the Applicant” are processed, on behalf of Kilpatrick, by clients and other subsidiary companies located in other member countries of the European Community. Moreover, the “Information regarding the Applicant” may be shared with the clients of Kilpatrick, in order to establish if the said clients are interested in your application with reference to a certain researched job position. Thus, the “Information regarding the Applicant” which will be provided to Kilpatrick will be limited to the information which is strictly related to such purpose.

7. The transfer of personal data to third countries.
In the context of the disclosure activities indicated in the above paragraph 6, your personal data may be transferred to third countries, outside the European Economic Area (EEA), pursuant to specific provisions in the applicable laws, regarding the transfer of personal data to foreign countries.

Your personal data may be transferred to another country than the one they were collected in, as follows:
• when you have expressly granted your consent and, if sensitive data are concerned, your written consent;
• when this is necessary in order to perform obligations under a contract to which you are a party, or to fulfil your specific requests before the contract is concluded, or to enter into or perform a contract signed on your behalf.
• when this is necessary in order to perform defensive investigations pursuant to the Law no. 397 of 7 December 2000 or, in any case, in order to defend a right in a judiciary process, on condition that the data are transferred exclusively for such purposes and for the time period strictly necessary for such investigations, in compliance with the applicable requirements regarding corporate and industrial secrecy.
• the personal data are transferred to countries which ensure an adequate level of protection of such data; for example, the data are transferred to countries within the European Union or to countries which otherwise guarantee an adequate level of protection of personal data;
• the personal data are transferred among companies belonging to the same group of companies, pursuant to the Binding Corporate Rules (BCR), where applicable;
• the transfer is made towards third countries, based on an agreement which includes standard terms regarding the protection of personal data, as defined in the applicable norms.

8. Rights of the data subject.
Under articles from 15 to 19 and 21 of the GDPR, you will be able to exercise specific rights, among which the right to request the access to your personal data in an intelligible form, as well as the right to the rectification, update or erasure of your personal data. Additionally, you will have the right to request the Company to restrict the processing of your personal data, and to object to such processing, based on legitimate grounds. Should you consider that the processing of your personal data violates the
GDPR norms, you have the right to bring a claim before the Privacy Authority guaranteeing the protection of personal data, pursuant to article 77 of the GDPR.
8.1 The right to data portability.
Pursuant to article 20 of the GDPR, you have the right to receive your personal data in a structured, commonly used and machine-readable format and you have the right to transmit those data to another data controller of your choice, as long as this operation is technically feasible and cost-effective.

9. The personal data controller.
The data controller, pursuant to article 4, paragraph 7) of the GDPR, is Kilpatrick S.p.A., in the person of its interim legal representative, Ms. Claudia Paoletti. In order to exercise your rights pursuant to the GDPR, as indicated in paragraphs 8 and 8.1 of this notice, you may contact the data controller at the following address:

Kilpatrick S.r.l.
No. 14, Corso Europa
20122, Milan
E-mail: privacy@kilpatrick.one

The complete list of data processors and the categories of entities responsible for the processing of personal data are available upon request.
1) hereby declare that I have read and understood in full the contents of the present notice and I understand that the processing of my personal data for the purposes indicated in paragraph 1 refers to the personal data that I voluntarily provided or which is available in the public domain, and thus it does not require the consent from the data subject, pursuant to article 6 of the Regulation (EU) 679/2016;
2) I hereby express my freely given consent, pursuant to article 7 of the Regulation (EU) 679/2016, for the processing of the special categories of my personal data, as defined in article 9 of the Regulation (EU) 679/2016, which I have voluntarily provided, on condition that such data processing is performed for the specific purposes indicated:
3) I hereby express my freely given consent, pursuant to article 7 of the Regulation (EU) 679/2016, for the transfer of my personal data to third parties, as defined in paragraph 6 of this notice:
4) I hereby express my freely given consent, pursuant to article 7 of the Regulation (EU) 679/2016, for the transfer of my personal data to third countries, as defined in paragraph 7 of this notice:
5) I hereby express my freely given consent, pursuant to article 7 of the Regulation (EU) 679/2016, allowing Kilpatrick to send me newsletters and marketing and promotional messages.
The consent granted above may be revoked at any moment, by sending a request to the e-mail address: privacy@kilpatrick.one and indicating the object and the details of the relationship in which the said consent was given.