REGARDING THE PROTECTION OF PERSONAL DATA PURSUANT TO ART. 13 OF EU REGULATION 679/2016 AND ITALIAN LEGISLATIVE DECREE 196/2003 AS AMENDED BY ITALIAN LEGISLATIVE DECREE 101/2018

Our Company has always been highly attentive to the protection of personal data and to respecting the principles of privacy and the dignity of individuals.

With this in mind, we kindly ask you to read the following information notice.

Gambini S.p.A., with registered office at Via Carducci 16, 20123 Milan (MI), tax code and VAT no. 00456660463, in its capacity as Data Controller, through its legal representative pro tempore, pursuant to and for the purposes of EU Regulation 679/2016, hereby informs the data subject that the personal data collected concerning him/her, acquired by the Data Controller or that will be subsequently requested and/or communicated by third parties, are necessary and will be used for the purposes indicated below.

PURPOSE AND LAWFULNESS OF PROCESSING

The purpose for which the data are collected is to assess the conditions for a potential employment or collaboration.

LEGAL BASIS OF THE PROCESSING

The processing is lawful as it follows the receipt of personal data within the context of a spontaneous job application.

METHODS OF PROCESSING AND CONFIDENTIALITY OBLIGATION

The processing of data is carried out using IT tools and/or paper media, by subjects bound to confidentiality, with logic related to the purposes and in any case in such a way as to guarantee the security and confidentiality of the data. The data collected will not be disclosed or disseminated to third parties pursuant to the law.

COMMUNICATION TO THIRD PARTIES

Your personal data may be communicated to third parties known to us solely and exclusively for the aforementioned purposes and, in particular, to the following categories of subjects:

– External companies and professionals providing services on our behalf.

– Authorities and public administrations for compliance with legal obligations;

– Professionals who may provide support in fulfilling legal obligations.

These subjects will process the personal data as Data Processors or independent Data Controllers.

DATA RETENTION PERIOD

Pursuant to Article 5 of EU Regulation 2016/679, “Principles relating to the processing of personal data,” personal data are kept in a form that allows the identification of the data subjects for no longer than is necessary to achieve the purposes for which they are processed and, in any case, for no more than two and a half years from the moment of their receipt.

The personal data of the data subjects may also be retained for longer periods in compliance with applicable legal obligations (for example, for accounting purposes) while in any case applying all technical and organizational measures aimed at activating mechanisms to anonymize the data.

RIGHT OF THE DATA SUBJECT

Pursuant to the applicable legislation, the data subject may exercise his/her rights against the Data Controller, as expressed in Art. 15 et seq. of EU Regulation 679/2016. In addition to these rights, the data subject has the right to lodge a complaint with the Supervisory Authority in cases provided by law.

For further information regarding the methods of exercising these rights, please refer to the “Procedure for Data Subject Rights” on the gambini.group website.

DATA CONTROLLER AND PRIVACY COMMUNICATIONS

The Data Controller is Gambini S.p.A..

For any communication pursuant to the articles mentioned above of EU Regulation 679/2016, the Data Controller provides the following contact details: Via Carducci 16, 20123 Milan (MI). Phone +39 0583 2776; email info@gambini.group.

Lucca, 3 April 2026