Information Notice for Clients in accordance with the General Data Protection Regulation (EU GDPR) 2016/679

The following companies: Manpower S.r.l., Experis S.r.l., Talent Solutions S.r.l., Manpower TBO S.r.l., with headquarters in Milan, Via G. Rossini 6/8, as Joint Data Controllers (hereinafter referred to as “Joint Controllers”), hereby provide the following information, in compliance with General Data Protection Regulation (EU) no. 679 of 27 April 2016 (hereinafter referred to as “the Regulation”), regarding the use of your personal data (hereinafter “Data”), collected from you before or while performing the contract.

A.PERSONAL DATA PROCESSING PRINCIPLES

The Regulation establishes the rules on the protection of natural persons with regard to personal dataprocessing and the rules concerning the free flow of personal data. It protects the fundamental rights andfreedom of natural persons and especially their right to personal data protection. Your personal data will becollected only as far as compatible with the purposes described in the following paragraph and theirprocessing will be based on the principles of fairness, lawfulness and transparency.

B.PROCESSING PURPOSES AND LEGAL BASIS

Your personal data (which may also include judicial data), may be processed in relation to the activitiescarried out by the single joint data controller companies for the following purposes:

1. Collection of pre-contractual information, including economic and financial evaluations; correctmanagement of the contractual relationship and its obligations, as well as for purposes in any casestrictly required and related to the fulfilment or non-fulfilment of the contract itself; management ofcorrespondence, also via e-mail and fax;
2. Compliance with legal, accounting, tax or other mandatory obligations, associated with abovepurposes;
3. Establishment and management of financial relationships regarding the contracts themselves,including checking the positive outcome of the payments made by you;
4. Management of litigation, disputes and complaints;
5. Collection of information about the service provided exclusively for improving the quality of theservices delivered by the Group Companies (*).
6. Other purposes connected to and/or necessary for managing the business relationship with theGroup Companies, such as invitations to sports or cultural events/shows, free forwarding ofcommercial and promotional communications, periodical publications, market surveys and statisticalstudies also via fax, e-mail, SMS and MMS.

The processing of your personal data by the Company for the purposes under points 1, 2, 3, 4 is lawful because:

• it is necessary for the execution of the contract;
• it is necessary to comply with the legal obligations which the Data Controller is subject to.

C.DATA PROCESSING METHODS

Your data will be processed by the Joint Controllers in accordance with articles 4-6 of the GDPR, bothmanually (processing of documents and paper documents) and using IT methods and procedures,

(*) The term “the Group” refers to all the companies, operating both in Italy and abroad, directly or indirectly controlled or in which a stake is held by the Joint Controllers or by the parent companies of the Joint Controllers, by their subsidiaries and/or affiliates, as well as by their parent companies, either directly or indirectly.

including with the aid of electronic means, telephone, electronic or automated tools, as well as automated calling systems, fax, e-mails, SMS or MMS messages or other, solely in order to pursue the purposes for which they were collected. In our companies, data are processed by employees and staff as part of their functions and in compliance with the instructions received, always and solely for achieving the specific purposes indicated in this privacy information notice. Personal data are not disclosed.

In performing their processing operations, the Companies undertake to:

• guarantee the accuracy and updating of the processed data, and promptly implement any correctionsand/or additions requested by the data subject;
• adopt security measures to ensure adequate data protection, taking into account the potential impactof the processing operations on the respect for the data subject’s rights and fundamental freedom;
• inform the data subject, according to the deadlines and cases provided for by law, of any violations ofpersonal data;
• guarantee that the processing operations comply with applicable legal requirements.

D.SCOPE OF PERSONAL DATA CIRCULATION AND DISCLOSURE

The employees of Joint Data Controllers who need the data to perform their duties or as a result of theirposition, or other entities that provide services for the Joint Data Controllers and have been specificallyappointed as Data Processors or Persons in charge of Data Processing, may have access to your Data.Such persons, in relation to their duties will only have access to Data related to their job.

1. The Joint Data Controllers may disclose data regarding you:
   • to companies providing credit management services; to consultants and/or self-employed workers in order to receive opinions on the correct applicationof the contracts, and consultancy on judicial and extra-judicial matters;
   • to companies dealing with document management and workflow services;
   • to providers delivering services on behalf of the Joint Data Controllers, for example, traininginstitutes.
   
   
2. Your data may also be disclosed, after receiving your explicit consent:
   ▪ to marketing or consulting firms offering DMs, e-mail and SMS forwarding services, and also forthe purpose of collecting information about the quality of the service provided to you;
   ▪ to event management companies.

E.TRANSFER OF DATA ABROAD

As part of the purposes described in this information notice, the Company may transmit the data you haveprovided to other Group companies (*), or its suppliers, even in countries outside the European Union. Anytransfer of data regarding the data subject to countries outside the European Union will, in any case, becarried out in compliance with suitable and appropriate guarantees for the purposes of the transfer itself inaccordance with applicable legislation and especially with articles 45, 46 and 47 of the Regulation. Thedata subject will have the right to obtain a copy of the data held abroad and to receive information aboutthe place where they have been stored, expressly submitting a request to the joint data controllers asdescribed in the “Contact” paragraph of this information notice.

F.RETENTION PERIOD

Except in cases of completion of the contract, the Joint Controllers will carry out a review after twenty-fourmonths from the registration date in order to check whether the data should continue to be processed orshould be deleted. If you believe that the processing purpose no longer applies, you may inform the JointControllers in writing even before the deadline. They will immediately delete the personal data concerningyou which no longer need to be processed for the purposes indicated under point B 2, 3 and 4. The Joint Data Controllers have appointed natural persons as Data Processors.

G.EXERCISE OF RIGHTS

According to the Regulation (articles 15-22), the data subject may exercise the following rights vis-à-vis theData Controller:

(*) The term “the Group” refers to all the companies, operating both in Italy and abroad, directly or indirectly controlled or in which a stake is held by the Joint Controllers or by the parent companies of the Joint Controllers, by their subsidiaries and/or affiliates, as well as by their parent companies, either directly or indirectly.

1. Right of Access: The data subject has the right to access the personal data regarding him or her thatare being processed in order to check whether his or her personal data have been processed incompliance with the law.
2. Right to Rectification: The data subject has the right to obtain the rectification of any inaccurate orincomplete data regarding him or her in order to ensure the accuracy of such information based on thepurposes of the processing operations.
3. Right to Erasure: The data subject has the right to request that the Data Controller erase informationregarding him/her and no longer process such data.
4. Right of Restriction of Processing: The Data Subject has the right to request that the DataController restrict the processing of his or her data.
5. Right to Data Portability: The data subject has the right to receive personal data in a structured,commonly used and machine-readable format and has the right to transmit those data to another datacontroller.
6. Right to object to the processing: The data subject has the right to object to the processing of his orher data in the cases referred to in the GDPR, at any time and with no need to justify his/her decision.
7. Right not to be subject to automated decision-making: The data subject has the right not to besubject to a decision based solely on automated processing, including profiling, which produces legaleffects concerning him or her, or similarly significantly affects him or her. Where the processing is based on consent, pursuant to art. 7 of EU Regulation 2016/679, the data subject may withdraw his or her consent at any time, without affecting the lawfulness of processing before its withdrawal. If the data subject believes that the processing that concerns him violates the Regulation, he/she has the right to lodge a complaint with the Supervisory Authority of the Member State in which he/she resides or works, or of the State in which the alleged violation occurred.

H.CONTACT

If you wish to receive more information about the processing of your personal data, please contact the DataController or Data processor at the Joint Controllers’ offices in Via Gioacchino Rossini 6/8 – 20122 Milan –teamprivacy@manpower.it.

Instead, if you wish to exercise the rights listed in the previous section, you may do so by accessing thespecific Form via the link in the Privacy Notices (Informativa privacy) published on the websites www.manpower.it or www.experis.it