Job applicants privacy

Notice on the processing of personal data – Candidates for job positions

(pursuant to Arts. 13 and 14 of EU Regulation 2016/679 – “GDPR”)

Thank you for the interest you have shown in a possible professional opportunity at Banco Energia S.p.A. (the “Company”).

The Company processes candidates’ personal data in compliance with Regulation (EU) 2016/679 (“GDPR”) and with the applicable legislation on the protection of personal data.

This Notice describes the methods of collection and processing of personal data in the context of the selection process, including applications sent spontaneously by e-mail or submitted through professional platforms such as LinkedIn and managed through the IT tools used by the Company.

1. Controller and contact details

Banco Energia S.p.A., a company incorporated in Italy with registered office at Sestiere Santa Croce 466/B, 30135 Venezia (VE), VAT Number 04319830271 (hereinafter, the “Company”), is responsible, as controller, for the collection and processing of information relating to potential, current and past candidates for job positions at the Company (hereinafter, the “Personal Data”).

If you have any comments, requests or questions regarding this notice or wish to exercise the rights granted by Regulation (EU) 2016/679 (“GDPR”), we invite you to contact us:

• by e-mail at: [email protected]; or
• by post to the following address: Banco Energia S.p.A., Sestiere Santa Croce 466/B, 30135 Venezia (VE).

2. Categories and types of data collected and processed

With reference to potential, current and past candidates, the Company may process the following categories of personal data:

• identification and personal details (first name, last name, date and place of birth);
• contact details (e-mail address, telephone number, domicile);
• information relating to educational and professional background (educational qualification, work experience, qualifications, skills, language skills);
• curriculum vitae, cover letters and further information voluntarily provided in the context of the application;
• assessments and internal notes relating to interviews and to any selection tests.

The Company may also become aware of special categories of personal data within the meaning of Art. 9 GDPR (for example data concerning health or membership of protected categories), where such information is provided by the candidate or proves necessary for the purposes of managing the application. Such data will be processed only when relevant and necessary and where one of the conditions laid down in Art. 9(2) GDPR is met, in particular for the fulfilment of obligations and the exercise of rights in the field of employment and social security and social protection law.

• Where the application is made through professional platforms (e.g. LinkedIn), the Company may process the information made available through such platforms and transferred to its internal tools for the management of the selection process.

If the selection process is successful, the personal data of the selected candidate will be further processed in accordance with the notice dedicated to employees and collaborators, which will be provided at the time the relationship is established. In most cases personal data are collected directly from the data subject. However, the Company may also receive data from third parties, such as recruitment agencies or publicly accessible sources, in compliance with applicable legislation.

3. On what legal bases and for what purposes we process personal data

The Company will always process your Personal Data for specified purposes and in compliance with the principles of lawfulness, fairness and transparency laid down in Regulation (EU) 2016/679 (“GDPR”), limiting the processing to only the data that are relevant and necessary in relation to the purposes pursued.

1. Your Personal Data are processed when this is necessary to follow up on your application and to take pre-contractual measures at your request. In particular, the Company may carry out screening and assessment of curricula vitae and professional profiles, including by means of the IT tools used to manage applications, in order to verify the consistency of the declared experience, skills and qualifications with the requirements of the position sought, to manage interviews and any selection tests and, if the outcome is positive, to prepare a job offer. Screening serves the selection of candidates and does not involve, unless otherwise stated in a specific notice, decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject.
2. In the context of the Company’s legitimate interest
   Where appropriate and with respect for your rights and fundamental freedoms, the Company may process your Personal Data in pursuit of its own legitimate interests or those of affiliated companies. Such interests may include, among other things:
   • the carrying out of selection activities, including the assessment of the candidate’s suitability for the position sought and any verification of situations that may constitute conflicts of interest or other conditions relevant to the establishment of the employment relationship;
   • the verification of the accuracy and consistency of the information provided during the selection process, including by means of proportionate checks;
   • the management of the records and archives relating to the HR function and the sharing of applications with other affiliated companies where the position proves to be more consistent with other entities;
   • the protection and security of the IT systems, the technology infrastructure and the tools used to manage applications;
   • the disclosure of data to potential parties involved in extraordinary transactions (such as mergers, acquisitions or transfers of business units), to the extent strictly necessary for such transactions.

   Where appropriate and with respect for your rights and fundamental freedoms, the Company may process your Personal Data on the basis of its own legitimate interest, pursuant to Art. 6(1)(f) GDPR, for further purposes compatible with the selection process, such as protecting the security of the systems and infrastructure used to manage applications, preventing abuse or fraud and, where necessary and proportionate, verifying the accuracy and consistency of the professional information provided by the candidate. Such processing is carried out after an assessment of the balance between the Company’s interest and the rights and freedoms of the data subject.

3. On the basis of your consent
   Should the Company request your consent for specific further purposes, the processing will be carried out on the basis of Art. 6(1)(a) GDPR. Consent is optional and may be withdrawn at any time; withdrawal does not affect the lawfulness of the processing carried out before it.
4. By virtue of legal or regulatory obligations or to protect vital interests
   Your Personal Data may be processed where necessary to comply with legal or regulatory obligations applicable to the Company, as well as, where relevant, to protect your vital interests, for example in order to ensure adequate conditions of access to the premises on the occasion of interviews or meetings.

Where the Data requested are necessary to enable the Company to comply with legal obligations, conclude a contract or pursue legitimate interests connected with the selection process, failure to provide them could prevent the Company from continuing the selection procedure or from establishing the contractual relationship.

4. Who has access to your data and how they will be processed

Your Personal Data may be shared to the extent strictly necessary for the purposes indicated above and in compliance with applicable legislation.

a) Within the affiliated companies

Your Personal Data may be shared with the Human Resources functions and with the other competent corporate functions (for example line managers or heads of function) of the Company and, where relevant, of other affiliated companies, in order to assess your application, verify the information provided and contact you in relation to open positions consistent with your profile.

Your contact information may also be used to improve the application experience and the selection process, for example by inviting you to take part in any questionnaires or surveys relating to the selection procedure. Participation in such initiatives is entirely optional.

Your Personal Data may also be processed for legal, regulatory or statistical purposes, to the extent permitted by applicable legislation.

If your application is successful, your Data will be further processed for purposes connected with the establishment and management of the employment or collaboration relationship, in accordance with the dedicated notice that will be provided to you.

If your application is not successful, the Data submitted may be retained and used in connection with any future applications or to contact you should new professional opportunities compatible with your profile become available.

b) Outside the affiliated companies

The Company may disclose your Personal Data to external third parties, solely for the purposes indicated in this Notice and in compliance with the security and protection measures provided for by applicable legislation. Such parties may include:

• providers of IT, hosting, cloud, e-mail or database management services, including the parties that support the tools used to manage applications, which operate on the basis of specific contractual agreements protecting the Personal Data;
• consultants or professionals who assist the Company in the selection process;
• parties involved in any extraordinary corporate transactions (such as mergers, acquisitions or disposals), to the extent strictly necessary for such transactions;
• references indicated by you during the selection process;
• public authorities or other recipients entitled by law.

5. Transfer of personal data to other countries

The Company processes Personal Data mainly within the European Economic Area (EEA).

However, should a transfer of Personal Data to countries located outside the EEA become necessary in the context of the tools used for the selection process or in the context of IT services provided by third parties, such transfer will be carried out in compliance with the provisions of Arts. 44 et seq. of Regulation (EU) 2016/679 (“GDPR”).

In particular, the Company will adopt appropriate safeguards in order to ensure an adequate level of protection for the Personal Data, such as:

• the use of Standard Contractual Clauses approved by the European Commission;
• the transfer to countries that are the subject of an adequacy decision of the European Commission;
• the adoption of further technical and organisational measures, where necessary.

You may request further information regarding data transfers and the safeguards adopted by exercising your rights as indicated in this Notice.

6. How long your data are retained

The Company retains Personal Data for a period of time not exceeding that necessary to achieve the purposes for which they were collected, as well as to comply with any applicable legal, regulatory or organisational obligations.

The Personal Data of candidates who are not selected will, as a rule, be kept for a maximum period of twenty-four (24) months from the end of the selection process or from the last significant contact with the candidate, in order to be able to consider the profile for any compatible future professional opportunities. After this period, the data will be deleted or anonymised, unless their further retention is necessary to comply with legal obligations or for the establishment, exercise or defence of a right in court.

Personal Data relating to selected candidates will be processed in accordance with the notice on the processing of personal data of employees and collaborators, which will be provided at the time the relationship is established.

This is without prejudice to the possibility for the candidate to request at any time the erasure of their Personal Data from the database dedicated to personnel selection, by exercising the rights in the manner indicated in the dedicated section of this Notice. The request will be assessed in compliance with applicable legislation.

7. What your rights are and how you can exercise them

You have the right to obtain from the Company confirmation as to whether or not Personal Data concerning you exist and, if so, to access such Data and to receive a copy of them.

If you believe that the information in our possession is inaccurate or incomplete, you have the right to request its rectification or updating.

You may also:

• object to the processing of your Personal Data in the cases provided for by applicable legislation;
• request the erasure of your Personal Data;
• obtain the restriction of processing in the cases provided for by Art. 18 GDPR;
• withdraw at any time any consent you may have given, without affecting the lawfulness of the processing carried out before the withdrawal.

The Company will act on requests within the time limits and in the manner provided for by the legislation on the protection of personal data. These rights are not absolute and may be subject to limitations or exceptions provided for by law.

In order to be able to respond to you, we may ask you to verify your identity or to provide us with further information necessary to understand and handle the request correctly. Should it not be possible to grant your request in full, we will provide you with adequate reasons.

To exercise your rights, you may contact us at the contact details indicated in the section dedicated to the controller.

If you believe that the processing of your Personal Data infringes applicable legislation, you have the right to lodge a complaint with the Italian Data Protection Authority (Autorità Garante per la protezione dei dati personali) or with the competent authority in the country of residence.

8. How we protect personal data

The Company adopts appropriate technical and organisational measures designed to ensure the security of the Personal Data and to protect them against unauthorised or unlawful processing, as well as against accidental loss, destruction or damage.

Such measures are defined taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of natural persons, in accordance with Art. 32 of Regulation (EU) 2016/679 (“GDPR”).

In particular, the Company adopts measures suitable for limiting access to Personal Data to authorised and duly instructed personnel only, as well as for ensuring adequate levels of confidentiality, integrity and availability of the information processed through the tools used to manage applications.

The Company also promotes training and awareness-raising activities on the protection of personal data, in order to ensure that the Data are not communicated or disclosed to unauthorised parties.

9. Updates to this notice

This Notice was last updated on 25 September 2026.

The Company reserves the right to amend or update this Notice at any time, including in light of any regulatory changes or organisational and technological developments.

Any updates involving substantial changes to the processing of Personal Data will be communicated to you through the usual communication channels used for the selection process or by publication of the updated version on the Company’s website.