PRIVACY POLICY FOR CANDIDATES

MI Stadio Srl, with registered office in Piazzale Angelo Moratti snc, 20151 Milan (MI), (“MI Stadio”), is committed to protecting the privacy of users who submit their applications for job positions offered by MI Stadio (“Candidates”) through the “Work with Us” section of the website www.sansirostadium.com (“Website”). This document (“Privacy Policy”) has been prepared to inform you of how your personal data (“Personal Data”) will be processed by MI Stadio during the personnel search and selection process.

In general, any information or Personal Data you provide to MI Stadio for personnel recruitment and selection purposes will be processed in accordance with internationally recognized principles of lawfulness, fairness, transparency, purpose and retention limitation, data minimization, accuracy, integrity, and confidentiality, as set forth in Regulation (EU) 2016/679 (“GDPR”) and, in general, applicable data protection legislation.

Identity and contact details of the Data Controller and the Data Protection Officer (DPO)

MI Stadio, as identified at the beginning of this Privacy Policy, is the Data Controller of all Personal Data processed in the context of the Candidate selection process. You can reach out to the Data Controller:

• by regular mail, to the registered office address indicated above;
• by email, to privacy@sansirostadium.com .

MI Stadio, as the Data Controller, has appointed a Data Protection Officer (hereinafter “DPO“), who is available to provide any information regarding the processing of your personal data and the exercise of your rights as a data subject. The DPO can be contacted at the following email address: dpo@sansirostadium.com .

Categories of Personal Data and source of the Personal Data processed

MI Stadio will process your Personal Data, such as your name, surname, professional qualifications, certifications obtained, identification number, online ID, or one or more elements specific to your physical, physiological, economic, or cultural identity that allow you to be identified either individually or together with other information collected.

The Personal Data processed by MI Stadio are the following:

a. Applications

By submitting your application through the “Work with us” section of the Website or during the job interview, you may provide MI Stadio with professional/work-related information (for example, the information requested in the form in the “ Work with us ” section of the Website such as name, surname, email address, telephone number, place and date of birth, position for which you are applying and other information such as the university you attended, your knowledge of foreign languages, your professional qualifications, your expectations, references to your professional profile on social networks), as well as your photo and your cover letter (“Application”).

MI Stadio may also ask you to have an interview via remote electronic devices (via webcam). In this case, your image and voice will also be processed.

Any untrue statements you make in your Application and/or when receiving a job offer may result in the offer being revoked.

b. Special categories of personal data

By submitting your Application, you may disclose (voluntarily or otherwise) special categories of personal data, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. This information may also include (voluntarily or otherwise) other types of special categories of data about you, such as genetic data, biometric data, or data concerning health, sex life, or sexual orientation.

We inform you that, if your Application contains Personal Data belonging to the special categories referred to in Article 9, paragraph 1, of the GDPR – which MI Stadio is not required to process in compliance with the regulatory obligations (pursuant to Article 9, paragraph 2, letter b, of the GDPR) to which MI Stadio is subject, or personal data not relevant to the purposes pursued – MI Stadio will not process such information in compliance with data protection legislation.

c. Data provided voluntarily by the interested party

As indicated in the previous paragraph, through your Application you may (spontaneously or otherwise) communicate to MI Stadio information of various types, which may include personal data relating to other individuals (for example, reference contacts).

If you share personal data relating to third parties, you will be considered the independent data controller of that personal data, subject to all legal obligations and responsibilities. You hereby fully indemnify MI Stadio against any complaints, claims, requests for compensation for damages resulting from processing, etc., that may be received from third parties whose personal data has been processed in violation of applicable data protection laws. In any case, if you provide or otherwise process third-party personal data, you hereby guarantee – and assume all related liability – that such specific processing is based on an appropriate legal basis that legitimises the processing of the information in question.

Purpose of the Processing

MI Stadio will use your Personal Data for the following purposes:

• to examine the Applications received and to contact the Candidates for a possible interview and, in general, to manage your Application (“Personnel recruitment and selection activities”);
• to fulfill any obligations established by applicable laws, regulations or EU legislation, or satisfy requests from the authorities (“Compliance”);
• to satisfy any defensive needs, possibly connected to the detection, prevention, mitigation and ascertainment of fraudulent or illegal activities (“Abuse/Fraud”).

Legal basis of the Processing

The legal basis used by MI Stadio to process your Personal Data, according to the purposes indicated in the previous paragraph, are as follows:

• Staff recruitment and selection activities: Processing for this purpose is necessary to allow MI Stadio to consider submitting a job offer to you and, therefore, to follow up on your application with a view to entering an employment contract with you. Providing your Personal Data for this purpose is not mandatory; however, if you refrain from providing them, MI Stadio will not be able to consider your application. The legal basis for this purpose are Article 6, paragraph 1, letter b) and Article 9, paragraph 2, letter b) of the GDPR.
• Compliance: Processing for this purpose is necessary for MI Stadio to fulfill its legal obligations, pursuant to Art. 6, paragraph 1, letter c) of the GDPR. When you provide Personal Data to MI Stadio, it must be processed in accordance with applicable law, which may involve retaining it and disclosing it to authorities for accounting, tax, or other purposes.
• Abuse/Fraud: The information collected for this purpose will be used exclusively to prevent and/or identify any fraudulent activity or abuse, as well as to allow MI Stadio to protect its interests and rights in court and/or out of court. The legal basis for this processing is therefore the pursuit of a legitimate interest of MI Stadio pursuant to Art. 6, paragraph 1, letter f) of the GDPR.

Categories of recipients of Personal Data

Your Personal Data may be shared with the entities listed below (the “Recipients”):

• persons authorized by MI Stadio to process personal data pursuant to art. 29 of the GDPR (e.g., the personnel responsible for managing the Application);
• third parties who, in the provision of services (for example, hosting providers or parties delegated to perform technical maintenance activities), typically act as data processors pursuant to Article 28 of the GDPR;
• subjects, entities or authorities to whom it is mandatory to communicate your Personal Data for Compliance, Abuse or Fraud purposes, or by order of the authorities.

Transfer of Personal Data

Regarding any transfer of personal data to third countries, MI Stadio ensures that the processing of your Personal Data by these Recipients will be in compliance with applicable law. Indeed, transfers will be carried out through the adoption of appropriate safeguards, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission, or other safeguards deemed appropriate.

Further information is available by writing to the Data Controller at privacy@sansirostadium.com.

Data retention period

Personal Data processed for the purposes of recruitment and selection will be retained by MI Stadio for the time strictly necessary to achieve the aforementioned purpose and, in any case, for a period not exceeding two years from receipt of the Application or its last update. MI Stadio may contact Candidates before the expiration of this period to request an extension of the retention period or its update. If there is no response, MI Stadio will delete the collected Personal Data.

Personal Data processed for Compliance purposes will be retained by MI Stadio for the period required by specific legal obligations or applicable regulations.

The Personal Data processed for the purpose of preventing Abuse/Fraud will be retained by MI Stadio for the time strictly necessary for the aforementioned purpose and therefore until such time as MI Stadio is required to retain them to protect itself in extrajudicial and/or judicial proceedings or to communicate such data to the competent Authorities.

Rights of the interested party

You have the right to ask MI Stadio, at any time:

• to access to your Personal Data (or a copy of such Personal Data), as well as further information on the processing being carried out on them;
• the rectification or updating of your Personal Data processed by MI Stadio, where they are incomplete or out of date;
• the deletion of your Personal Data from MI Stadio databases;
• the limitation of the processing of your Personal Data by MI Stadio;
• to obtain the Personal Data concerning you in a structured, commonly used and machine-readable format;
• to object to the processing of your Personal Data by MI Stadio.

In addition to the above, you can also exercise your rights by writing to MI Stadio at the following email address privacy@sansirostadium.com.

In any case, you always have the right to lodge a complaint with the competent Supervisory Authority or appeal to the Judicial Authority if you believe that the processing of your Personal Data violates applicable law.