PRIVACY POLICY according to ARTICLE 13 of the GENERAL DATA PROTECTION REGULATION UE 2016/679

for applicants

For us, data protection is an important issue, so we would like to inform you about the way in which your data is processed and the rights you can exercise under the current data protection legislation, in particular the EU Regulation 2016/679 (hereinafter also referred to as “GDPR”).

1. Data Controller

SV Laboratoires Suisse S.A.

Operational Office: Via ai Prati n.2 6930, Bedano (CH)

Registered Office: Corso Pestolazzi n. 3, 6901, Lugano (CH)

Contatto e-mail: [email protected]

1. Categories of personal data processed by the Controller

The data processed by the Controller (pursuant to article 4.1 of GDPR) could be, by way of example only, but certainly not exhaustive:

• Identification data (such as name, date of birth, nationality, social security number, profession, etc.);
• Contact data (such as, address, e-mail address, phone number, etc.);
• Data relating to education and previous professional experiences;
• Data relating to the provided services such as to respond to questions regarding products provided by the Controller.

1. Purposes and legal basis for personal data processing
   
   1. Purposes based upon a legal obligation (ex-art. 6, par. 1 (c) of the GDPR)

Processing’s purpose is to evaluate the candidate’s application, for a specific job opening or a spontaneous one, and, in particular, for the following purpose:

1. Fulfillment of legal obligations regarding the application and the potential professional insertion (e.g. verification regarding the pertinence to a protected category)

The data retention period for this section’s purpose is:

For purpose a: 12 months from the acquisition of the information.

1. 1. Purposes based upon the performance of a contract or for precontractual measures (ex-art. 6, par. 1 (b) of the GDPR)

1. Management of the selection process concerning one or more job openings, which can lead to the establishment of an employment contract (e.g., including the evaluation and the selection of one or more subjects to employ and the collection of information to perform the employment contract) (including the processing of special categories of personal data, regarding Gen. Aut. N.1/2016 and the following Provv. 146 del 5 giugno 2019 of the Italian Data Protection Authority).

The data retention period, regarding the purposes listed in this section is:

For purpose a: 12 months from the acquisition of the information, safe for an eventual employment (in such case, the retention period will follow its established or necessary terms in relation to the specific established legal relationship and the specific privacy policy).

1. 1. Recipients or categories of recipients of personal data (pursuant to article 13.1 (e) of the GDPR) *

In relation to the mentioned purpose, the Data Controller can communicate your personal data to:

• Internal offices and authorized personnel;
• Companies and professionals which offer IT related services, like electronic processing of data, software management, website management and of IT consultancy;
• Companies in the field of personnel selection;
• Occupational Doctor (if a preventive visit is necessary or any other initiative in favor to the NHS).

*More information regarding recipients (pursuant of art. 4.9 of the GDPR) is available on request to the Controller at the address above listed.

1. Recipients or categories of recipients of the personal (pursuant of art. 13 paragraph 1(f) of the GDPR) and data transfer outside the EU

The Controller does not intend to transfer your personal data to Countries which are not member of the EU or the EEA for the above-mentioned purpose.

1. The Data Subject’s rights

The data subject can exercise the following rights, in relation to personal data mentioned in this privacy policy, as stated by the GDPR:

• • Right of access by the data subject [art. 15 of EU Regulation] (right to be informed on the processing carried out on his/her personal data and, if necessary, receive a copy of them);
  • Right to rectification [art. 16 of EU Regulation] (data subject has the right to rectify incorrect data concerning him/her);
  • Right to erasure without unjustified delay (“right to be forgotten”) [art. 17 of EU Regulation] (data subject has the right to have deleted his/her personal data);
  • Right to restriction of processing, as provided by article 18 of EU Regulation, among the other cases, in case of illicit processing or contestation of the accuracy of personal data by the data subject [art. 18 of EU Regulation];
  • Right to data portability [art.20 of EU Regulation], (data subject has the right to receive the personal data concerning him/her, which he/she or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, as provided by the same article);
  • Right to object to processing [art. 21 of EU Regulation] (the data subject has the right to object processing of personal data as provided by article 21 of EU Regulation);
  • Right to not be subject to automated individual decision-making [art. 22 of EU Regulation] (The data subject shall have the right not to be subject to a decision based solely on automated processing).

Regarding those purposes which require consent, the data subject can revoke his/her consent at any time, and it will affect processing from the moment of revocation, safe for conservation periods established by law. Generally, revocation of consent affects only future processing.

The above-mentioned rights can be exercised as established by the GDPR contacting the controller at the above listed addresses.

SV Laboratoires Suisse S.A., in compliance to art. 19 of the GDPR, when it is possible, communicate to the recipients, to which personal data has been transferred, any corrections, cancellations or limitation of processing as requested by the data subject.

1. Right to lodge a complaint (art. 13 paragraph 2 (d) of the GDPR)

If the data subject considers that his/her right has been compromised, he/she has the right to lodge a complaint to the supervisory authority (or Data protection Supervisor), according to the methods indicated by the same authority. If you are Italian you can refer to the following link: http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524 or by lodging a complaint to the Italian Authority for the Protection of Personal Data

1. Potential consequences of failure to provide personal data and nature of the providing of data (art. 13 paragraph 2 (e) of the GDPR)
   
   1. In case of compliance with a legal obligation to which the Data Controller is subjected to or for performing a contract

It must be known that when the purpose has, as a legal basis, a legal obligation or a contractual one (or even a precontractual one), the data subject must necessarily provide the required personal data.

On the contrary, it will be impossible for the Controller to proceed with the specific personal data processing purposes.

When data is no longer needed, it will be deleted. If its deletion is impossible or only possible with a disproportionate effort due to a particular storage method, the data cannot be processed and must be stored in inaccessible areas.

1. 1. Presence of an automated decision-making process (included profiling activity)

The use of a purely automated decision-making processes as detailed by Article 22 of the GDPR is currently excluded. Should it be decided in the future to establish such processes on a case-by-case basis, the data subject will be notified separately if this is required by law or if this information notice is updated.

1. Methods of data processing

Personal data will be processed both in analog and electronic format and inserted in the applicable data bases which can be consulted and processed by the operators and processors designated by the Data Controller who will be able to carry out the consultation, use, handling, comparison and any other appropriate operation, direct or automatic, respecting the legal requirements necessary to guarantee the confidentiality and the security of the data, as well as their accuracy, updating, and their relevancy to the declared purposes.