Information on the processing of personal data

Candidate — art. 13 and 14 of Regulation (EU) 2016/679 (GDPR)

1. Holder of the treatment

Holder of the treatment is the ARCA DEFENSE ITALY spa, with legal headquarters in Via Cino del Duca 5, 20122 Milano (MI) operational headquarters in the C. by the Terms snc, 66021 Casalbordino (CH), C. F. and P. IVA 02835800695, tel +39 0873 918150, e-mail direzione@arcadefenseitaly.it, PEC direzione.arcadefenseitaly@pec.it in the person of its legal representative pro tempore.

The Company has appointed dr. Noè MELE which the data protection officer (DPO).

Point of contact privacy: e-mail dpo@arcadefenseitaly.it, PEC dpo.arcadefenseitaly@pec.it.

2. The processed data and source

The Company processes the personal data provided by the candidate using the form on the “Work with us” of the website www.arcadefenseitaly.it (first name, last name, phone, e-mail address, content of the message, and the attached curriculum vitae) or by spontaneous application transmitted by e-mail or hand-delivered, as well as data collected from employment agencies or third parties authorized, within the limits ofart. 14 GDPR.

Please do not insert it into the curriculum special categories of data (e.g. health data, except as needed for lbelongs to the categories protected under law 68/1999, religious beliefs, political opinions): any data in excess of, and not relevant will not be considered and will be deleted. The data relating tobelonging to protected categories are processed pursuant toart. 9, par. 2) (b) GDPR.

3. Purposes, legal basis and nature of the provision

The data are processed for the search and selection of staff, the assessment of the professional profile to open positions or for the future, and the reply to the application. Legal Base is theexecution of pre-contractual measures adopted at the request of theinterested person (art. 6, par. 1, letter b) of the GDPR) and, for the conservation to the next application, which is the legitimate interest of the Company to be a basin of profiles for similar needs (art. 6, par. 1 (f) GDPR).

The processing of the application does not require the consent of theinterested party. The conferment of data is optional, but necessary for the assessment of the application: the failure to provide the data requested in the forms it prevents thesending.

In the course of the selection, the Company does not adopt the decision-making processes exclusively automated or backs profiling pursuant to art. 22 GDPR. A possible verification of subjective requirements required by the regulations of the sector (public safety, raw materials and explosive) are performed only in the final stages of the selection, in the cases and to the extent permitted by law, subject to specific information to the candidate.

4. Methods of the processing and the recipients

The data are processed with it tools and manuals from the authorized personnel of the human resources function and the company representatives involved in the selection. The website is managed, as responsible of the treatment pursuant to art. 28 GDPR by WebZone s.r.l. (hosting, and maintenance); mail services and storage are provided by Microsoft Ireland Operations Ltd. The data are not disclosed to other entities, nor popular; the data may be shared with companies of the group only if necessary for positions at the same, subject to prior evidence of the candidate.

5. Transfers to third Countries

The data of the candidates are not transferred outside of the european economic area.

6. Conservation

The curricula and the related data are kept for 24 months from the reception, to allow the assessment in terms of positions compatible; after this period of time are deleted, except the establishment of the employment relationship (in which case included in the dossier of the staff), or enter again, on the part ofthe person concerned.

7. Rights of theinterested

Linterested party may exercise, in respect of the Holder, of the rights provided for by art. 15-22 GDPR and, in particular:

  • access to the personal data and information on the processing (art. 15 GDPR);
  • rectification of inaccurate data and the integration of incomplete ones (art. 16 GDPR);
  • cancellation, in the cases provided for byart. 17 GDPR;
  • limitation of processing, in the cases provided for byart. 18 GDPR;
  • portability of data processed by automated means on the basis of the agreement, or consent (art. 20 GDPR);
  • the opposition, for reasons related to your particular situation dellconcerned, to processing based on legitimate interest (art. 21 GDPR);
  • the revocation of consent, where the processing is based on consent, without prejudice to the lawfulness of the processing prior to the revocation (art. 7, par. 3, GDPR).

Requests can be sent to e-mail dpo@arcadefenseitaly.it, PEC dpo.arcadefenseitaly@pec.it the Company found within one month, extendable for two months, in cases of particular complexity (art. 12, par. 3, GDPR). It remains the right to lodge a complaint with the Guarantor for the protection of personal data (www.garanteprivacy.it) pursuant toart. 77 GDPR, or referring the matter to the lto the judicial authority.

8. Updates

Version 1.0 of the 01/09/2026. This privacy policy is posted on the page “Work with us” of the website and is invoked in the form of application by a declaration of acceptance.