Statement on the processing of personal data of job applicants pursuant to Articles 13 and 14 of Regulation (EU) 2016/679.

This statement on the processing of personal data is provided, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter the "Regulation" or the “GDPR”), by Italia Trasporto Aereo SpA, with head office at Via XX Settembre No. 97, Rome (RM) 00187, Tax and VAT No. 15907661001; REA (Economic and Administrative Index) No. RM-1622937, in its capacity as Data Controller (hereinafter for brevity also “ITA”, the “Company” or the “Data Controller”).

In this statement, we will explain the purposes and methods by which the Company collects and processes your personal data, which categories of data are processed, what the rights of the data subject are, and how they can be exercised. Processing may be carried out by computer/automated and/or manual/paper methods.

1. Categories of data processed
The Company collects and processes the personal data in the curriculum vitae you provide voluntarily or in response to personnel recruitment initiatives by ITA, together with any further personal data that you provide during an interview.

The Company may therefore collect your data either through voluntary applications or through personnel recruitment initiatives undertaken by ITA directly or, if necessary, through persons or entities appointed in advance as Data Processors (pursuant to Article 28 of the GDPR).

We may also receive your data from independent data controllers (see Article 4 below), such as employment agencies carrying out personnel recruitment and selection mandates, or training companies. In particular, the Data Controller will process your personal details, your contact details (mobile phone number, email address or certified email address) together with information on your educational and professional qualifications and work experience. In addition, if relevant for the purposes of a selection process, the Company may obtain data in particular categories pursuant to Article 9 of the Regulation, such as for example data on to your membership of protected categories pursuant to Law No. 68 of 12 March 1999.

The provision of the personal data indicated is necessary to enable the Company to assess your application for possible employment positions. The said personal data will be processed by the Company exclusively for the purposes and within the limits indicated in the following paragraph.

2. Purpose and legal basis of processing
Your personal data will be processed by the Company exclusively for the purpose of assessing your suitability for employment vacancies in the Company and for purposes connected with or instrumental to personnel search and selection processes.

Such data processing is necessary, pursuant to Article 6(1)(b) of the GDPR, in order to assess, at your specific request or following a referral from independent data controllers, whether the conditions are met for employment with our company.

If personal data concerning membership of protected categories are acquired, the processing of this type of data is carried out for the fulfilment of specific obligations in the field of labor law, pursuant to Article 9(2)(b) of the Regulation. Any judicial data will be obtained in full compliance with applicable legislation, as provided in Article 10 of the GDPR and Article 2-octies of Legislative Decree No. 196/2003, as amended.

3. Retention period
Your data will be stored in a special folder and deleted 12 months after any interview or receipt of your CV. In the event of a positive assessment and your subsequent recruitment, in any capacity, to the Company, your data will be subject to the specific terms and conditions for the processing of employees, for which reference is made to the ad hoc policy statement. After the retention period has expired, your data will be deleted or anonymised.

4. Categories of persons to whom personal data may be disclosed and purposes of disclosure
The Data Controller may disclose some of your data to third parties that it engages to perform tasks related to the management of the contractual relationship. In particular, your data may be communicated to external companies that provide administrative and logistical services to the Company, and to external consultants. Such companies will process your data as Data Processors, appointed in advance pursuant to Article 28 of the GDPR. In addition to entities to which disclosure is permitted by virtue of legal obligations, the Data Controller may also disclose your Data to public administrations, competent authorities, legal advisers, supervisory bodies and law enforcement agencies. Your Data will be processed by the Data Controller through its employees and/or collaborators, who will act as authorized data processors (Article 2-quaterdecies of Legislative Decree 196/2003). The names of the Data Processors may be obtained by writing to dpo@ita-airways.com.

5. Transfer of data outside the EU
Your Data will not be transferred outside the European Union. All processing takes place on servers located within the territory of the European Union, at the disposal of the Data Controller or of third-party companies appointed in advance as data processors pursuant to Article 28 of the GDPR. The servers are currently located in Italy. Should the Data Controller decide to transfer the data outside the EU, it will ensure that the transfer takes place in full compliance with the applicable legislation (Article 44 et seq. of the GDPR).

6. Rights of data subjects
Please note that, in accordance with the applicable legislation, you have the following rights:

• to request and obtain information on the existence of your personal data, the purposes of its processing, as well as access to such data (Article 15 GDPR);
• to request and obtain the amendment and/or correction of your personal data if you believe it is inaccurate or incomplete (Article 16 GDPR);
• to request and obtain the deletion - and/or a limitation on the processing - of your personal data if it is not necessary - or no longer necessary - for the purposes indicated above (Article 17 GDPR);
• to request and obtain a restriction of processing in cases of unlawful processing and the data subject’s opposition to the deletion of data (Article 18 GDPR);
• to request and obtain notification in the event of rectification or deletion of personal data or restriction of processing (Article 19 GDPR);
• to request and obtain the portability in a structured, commonly used and machine-readable format of personal data processed by automated means, and to request its transfer to another data controller (Article 20 GDPR).

Such requests may be addressed to Italia Trasporto Aereo SpA, head office Via XX Settembre, No. 97, Rome (RM), 00187, or by email to dpo@ita-airways.com providing, as an attachment to the request, a copy of an identity document to enable the Company to verify the origin of the request.

Pursuant to Article 12 of the GDPR, the Data Controller will provide the information requested in a concise, transparent, intelligible and easily accessible form, without undue delay (within one month at the latest).

Finally, please note that you may make a complaint regarding the processing of your personal data to the Italian Data Protection Authority, in accordance with applicable legislation.