Privacy Policy – Unicredit

The purpose of the following privacy notice is to provide an overview of the use of your personal data by UniCredit SpA and your rights pursuant to the General Regulation on Protection of Personal Data - EU Regulation 2016/679 (henceforth also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Processing Controller is UniCredit S.p.A- with legal headquarters in Piazza Gae Aulenti n. 3, Tower A, 20154 Milano (UniCredit).

The Data Protection Officer (DPO) may be contacted via:

UniCredit S.p.A.

Data Protection Office,

Piazza Gae Aulenti n. 1, Tower B, 20154 Milano,

E-mail: Group.DPO@unicredit.eu, PEC: Group.DPO@pec.unicredit.eu.

1. PURPOSE AND LEGAL BASIS FOR THE PROCESSING

UniCredit processes the personal data in its possession, collected directly from the data subject, or by third parties, for the following purposes:

1. Processing of the data you have conferred in order to enable you to take part in the DesiGenZ event.

This need represents the legal basis that justifies the relative processing. The conferral of the personal details required for said purposes is not compulsory, however, failure to provide them may entail the impossibility of taking part in the event.

1. Processing of the data you have conferred in order to enable you to be selected to enter into an employment or collaboration relationship (including, by way of example, a traineeship) with UniCredit S.p.A. In particular, your personal data may be processed to enable your participation in interviews and/or tests (in a classroom and/or online) that, by way of example, are designed to assess your professional aptitude or your level of understanding of the English language etc.

The legal basis that justifies the processing is your consent, which you are free to provide or not and that you may in any case revoke at any time.The conferral of the personal data required for this purpose is not compulsory, but failure to provide them will entail the impossibility of taking part in the aforementioned interviews and/or valuation tests and, as a result, to participate in the selection process.

1. Processing of the data you have conferred including the images and the photos taken during the event that will be published on the UniCredit and other sites managed by third parties over which UniCredit has no control such as Linkedin, Facebook, Youtube, Twitter.

The legal basis that justifies the processing is your consent, which you are free to provide or not and that you may in any case revoke at any time. The conferral of the data required to these ends is not compulsory and the failure to provide the same shall not in any way prejudice your participation in the event.

1. CATEGORIES OF DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties, that include, by way of example, biographical data (i.e. name, surname, address, data and place of birth), contact data (i.e. e-mail address, land line and mobile phone numbers) as well as data related to your Curriculum Vitae.

1. BENEFICIERIES OR CATEGORIES OF BENENEFICIARIES OF PERSONAL DATA

Natural persons or legal entities including in the list which may be consulted in the Privacy section of the www.unicredit.it website, may become privy to your data as data processors, as well as the natural persons belonging to the following categories who have been authorised to process the personal data, relative to the data required to perform the tasks assigned to them:

• employees or outsourced workers or trainees assigned to UniCredit's HR function, consultants and other natural persons who are occasionally assigned to UniCredit’s HR function;
• employees, temporary employees, trainees and consultants of external companies appointed by the data processors.

1. TRANSFERRAL OF DATA TO THIRD COUNTRIES

UniCredit informs you that the personal data may even be transferred to countries that are not part of the European Union or the European Economic Space (so called Third Party Countries) that are recognised by the European Commission as having an adequate level of personal data protection or, otherwise, only if the UniCredit suppliers located in a Third Party Country contractually guarantee a level of personal data protection that is in line with that of the European Union (i.e. by signing the standard contractual clauses foreseen by the European Commission) and that the rights of the data subjects are always guaranteed.Further information may be requested by writing to Group.DPO@unicredit.eu.

1. PROCESSING PROCEDURE

The processing of the personal shall take place using manual, computer and remote tools and adopting criteria that are closely linked to the purposes in question and, in any case, in a manner that guarantees the security and confidentiality of the same data.

1. RIGHTS OF THE DATA SUBJECTS

The GDPR assigns you the right to know which data that concern you are in UniCredit's possession, as well as how they are used and to obtain, if the conditions allow, a copy of them, their cancellation or updating, their rectification or, if of interest to you, the integration of the data as well as the right to portability.

7.1 TIMEFRAME OF DATA CONSERVATION AND RIGHT TO CANCELLATION

If the data is conferred in order to present a candidacy for a generic position, UniCredit processes and retains your personal data for a maximum period of thirty six (36) months starting from the date of the last time the data subject logged on to their profile created on the UniCredit portal, to enable them to be called to take part in the selection procedure for any professional positions in line with their professional profile.

If the data is conferred in order to present a candidacy for a specific position, UniCredit shall retain the personal data collected and used for the above purpose for a maximum period of thirty six (36) months starting from the date of the closing of the selection procedure for the specific position to enable you to be called up to take part in the selection procedure for any professional positions in line with their professional profile.

At the end of the applicable conservation period, the personal data referred to you shall be cancelled or retained in a form that does not allow identification (i.e. irreversible anonymization), unless they need to be processed further for one or more of the following purposes: i) the settlement of pre-litigation and/or litigation entered into before the expiry of the conservation period; ii) in order to follow up on investigations/inspections by internal control functions and/or external authorities begun prior to the expiry of the conservation period; iii) to follow up on requests forwarded by Italian or foreign public authorities received/notified to UniCredit prior to the expiry of the conservation period.

1. HOW TO EXERCISE YOUR RIGHTS

In order to exercise the above rights the data subject may turn to: best.practice@unicredit.eu

The term for a reply is one (1) months, which may be extended to two (2) months in particularly complex situations; in this case, UniCredit provides an interim communication within one (1) month.

Exercising ones rights is, in principle, free of charge.

9. COMPLAINTS OR REPORTS TO THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

UniCredit informs you that you have the right to present a complaint or make a report to the Guarantor for the Protection of Personal Data or alternatively present an appeal to the Judicial Authorities. The contact details for the Guarantor for the Protection of Personal Data may be consulted on the website http://www.garanteprivacy.it.

FORM FOR THE ACQUISITION OF CONSENT TO THE PROCESSING OF PERSONAL DATA