Candidate Privacy Notice

Privacy notice for candidates pursuant to Articles 13 and 14 of Regulation (EU) 679/2016 on the protection of personal data

Last updated: 9 July 2026

Herholdt Controls S.r.l., with its registered office at Via Mestre 13, 20132 Milan (MI), VAT and Tax Identification Number 07482370157 (hereinafter also referred to as “Herholdt Controls”, the “Company” or the “Data Controller”), recognises the importance of protecting personal data and proactively undertakes to process them responsibly and in compliance with the applicable principles and provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “Regulation”) and/or applicable national legislation.

For this reason, the Company, in its capacity as Data Controller, is required to provide you, as a “data subject” — namely, the person to whom the data being processed relate — with specific information on how Herholdt Controls processes your personal data, which are collected, organised, used, stored or otherwise processed for the purposes of your application for a position with the Company, including through your Curriculum Vitae, whether sent or delivered to the Company on your own initiative or made available to it in response to a recruitment process conducted by Herholdt Controls.

To properly manage the selection process for candidates seeking employment with the Company, Herholdt Controls needs to obtain and process your personal data, including, where applicable, special categories of personal data, provided that their processing is lawful and complies with the Regulation (hereinafter “Personal Data” or “Data”). In particular, these Personal Data will be processed for the purposes set out in section D below and, where necessary, you will be asked to provide written consent to processing for the purposes described in that same section D of this Notice, using the consent declaration form attached to this Notice.

Accordingly, in compliance with the Regulation, we provide you with the following information in this privacy notice for candidates (the “Notice”).

A. Data controller

The Data Controller is HERHOLDT CONTROLS S.r.l., with its registered office at Via Mestre 13, 20132 Milan (MI), VAT and Tax Identification Number 07482370157.

The person delegated by the Data Controller for Personal Data protection matters, whom candidates may contact for clarification and to exercise the rights under Articles 15–22 of the Regulation specified below, is Mr Matteo Maggi.

The delegated person may be contacted by post at the registered office of Herholdt Controls S.r.l., Via Mestre 13, 20132 Milan, or by email at privacy@hhcontrols.com.

B. Categories of personal data processed

The Personal Data that are or may be processed by the Company are described below.

Ordinary personal data

This is information relating to you directly or indirectly that identifies you or makes you identifiable.

Examples include: identification or contact details (first name, surname, date of birth, residential address, telephone number, other contact details, etc.) or email addresses; tax or social security data (e.g. tax identification number); photographs or Data that allow indirect identification (such as a user ID, landline or mobile telephone number, etc.); Data relating to professional training received or planned, or previous professional experience; income/financial Data (such as remuneration received in previous employment); Data relating to your educational background (e.g. education received, qualifications obtained, knowledge of foreign languages); and Data relating to your job application (such as the position you are applying for, the application and related documentation/correspondence, cover letters and employment references, and information about you obtained from interviews and telephone screening, etc.).

Ordinary Personal Data also include so-called “metadata” and technical information associated with the management of your application and communications with the Data Controller. For example, the following may be collected and processed: the date and time an application is submitted or received, unique application or user identifiers, access and authentication logs, IP addresses, information on the device and browser used, data relating to the uploading, viewing or amendment of submitted documents, and other technical information generated by the use of IT systems and platforms used to manage the selection process.

Special categories of personal data

These are Personal Data classified by the Regulation as “special categories” (and referred to as “sensitive data” under previous data protection legislation). They are specific types of Personal Data considered to be more sensitive, and their processing must comply with the conditions and limits established by the Regulation.

Examples include: Data revealing membership of legally protected categories (e.g. disability status); Data revealing trade union or political affiliation; Data revealing health status (for example, fitness or unfitness to perform certain duties, or data on the use of prosthetic aids or similar medical devices); and Data revealing religious beliefs (for example, to grant any statutory leave for religious holidays following potential employment).

Please note that, during recruitment and selection, Herholdt Controls does not normally need to collect special categories of Data. You are therefore asked not to include such data in your Curriculum Vitae, unless they are essential to better assess your suitability for available positions, particularly in relation to membership of legally protected categories.

In this case, the Regulation requires you to give the Company your consent to the processing of your special categories of Personal Data for the purposes described in section D, using the consent declaration form attached to this Notice.

Judicial data

The Data Controller may also collect judicial data (i.e. data relating to the enforcement of judicial measures, criminal convictions, the commission of offences, the imposition of security measures or other measures restricting personal liberty), where permitted and in accordance with applicable laws.

Browsing data collected automatically

If you apply through the Data Controller’s website, https://www.hhcontrols.com/it, using the dedicated “Contact us–Work with us” section, the Company may automatically collect certain information about you from the personal computer or electronic device you are using, such as your IP address, device type, device identification number, browser type, web preferences, addresses in URI (Uniform Resource Identifier) format, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s response (successful, error, etc.) and other technical information.

For further information on the Personal Data collected through www.hhcontrols.com and the types of cookies and other tracking technologies used by the Data Controller on its website, please consult the relevant privacy and cookie notice at: https://www.hhcontrols.com/privacy-and-cookie-policy/.

C. How personal data are collected

The Company collects Personal Data from candidates both when they apply in response to a specific vacancy and when they submit an unsolicited application. This information is generally provided directly by the candidate or entered by the candidate into the systems of the Hager Group, headed by Hager Italia Partecipazioni S.p.A., of which Herholdt Controls is a member.

In particular, this may take place:

• by delivering a Curriculum Vitae directly to the Company during an interview or a visit to its premises;
• by sending an unsolicited Curriculum Vitae to the Company by email, post or fax;
• by accessing https://www.hhcontrols.com/it through the dedicated “Contact us–Work with us” section. Interested candidates will be asked to enter their personal contact details and, where applicable, their Curriculum Vitae, so that they can submit their application.

In some cases, the Company collects candidates’ Personal Data from third parties. This may occur:

• through third-party websites (i.e. public recruitment websites) or social network platforms (such as LinkedIn, Indeed, etc.);
• through employment agencies, recruitment firms or other parties that bring your application to the Company’s attention;
• by obtaining information and feedback about you from your previous employers.

Please also note that the optional, explicit and voluntary submission of documents, certificates, reference letters and curricula vitae through the recruitment channels made available by the Data Controller entails the subsequent collection of Personal Data. Sending this information may, among other things, result in the incidental processing of third parties’ Personal Data by the Data Controller. In this case, you act as an independent data controller and assume all the related obligations and responsibilities under the law.

Once submitted, your Data will be processed for the purposes described in section D below.

D. Purposes and legal bases of processing

Your Personal Data will be processed in accordance with the principles of fairness, lawfulness and transparency, while safeguarding your privacy and your rights.

In all cases, the collection of Personal Data is intended solely to enable the Company to carry out the activities listed below. You may always ask the Data Controller to clarify the specific legal basis for each processing activity and, in particular, to specify whether processing is based on the law or on a contractual obligation to which you are a party.

1. Recruitment and selection purposes

Your Personal Data are collected to enable the Data Controller to: (i) recruit, select and assess staff, including, for example, organising and conducting interviews and tests after receiving your Curriculum Vitae through the channels described in section C above, with a view to potentially establishing an employment or other working relationship with the Company; (ii) verify the information you provide and check the references listed in your Curriculum Vitae; and (iii) manage and improve the Data Controller’s recruitment and hiring processes.

Legal bases

Processing for the above purposes is carried out on the following specific legal bases: (i) your express, freely given and independent consent — Article 6(1)(a) of the Regulation; (ii) taking steps prior to entering into a contract — Article 6(1)(b) of the Regulation; and (iii) the Data Controller’s legitimate interest in assessing your application — Article 6(1)(f) of the Regulation.

2. Purposes relating to compliance with legal requirements and/or obligations or to the exercise of the Data Controller’s rights of defence

Your Data may be processed: (i) for administrative and management purposes and to fulfil and comply with obligations imposed by law, regulations, EU legislation or an order issued by an authority to which Herholdt Controls is subject; and (ii) to establish, exercise or defend legal claims.

Legal bases

Processing for these purposes is carried out on specific legal bases: compliance with legal obligations to which the Data Controller is subject — Article 6(1)(c) of the Regulation — and the Data Controller’s legitimate interest in defending its rights in legal proceedings, with full respect for your rights and freedoms as a data subject — Article 6(1)(f) of the Regulation.

E. Processing methods

The collection of your Personal Data, as necessary to achieve the purposes set out in section D of this Notice, is limited to Data relevant to the assessment of your candidacy.

The Data Controller processes and will process Personal Data both on paper and using electronic or online tools, in all cases equipped with security measures suitable for safeguarding the data subject’s rights and freedoms and the confidentiality, integrity and availability of the information processed, in accordance with the Regulation, the law and internal company rules.

F. Whether the provision of data is mandatory or optional

You are free to decide whether or not to provide your Data.

If you refuse to provide them, the sole consequence is that the Company will be unable to achieve the stated purposes. Herholdt Controls will therefore be unable to manage your account and/or assess your application and/or properly carry out the associated activities, such as contacting you to arrange an introductory interview and subsequently conducting that interview.

If you have any doubts as to whether providing your Personal Data is mandatory or optional, please contact the Company using the contact details in section A of this Notice.

G. Categories of recipients of personal data

Your Personal Data will not be disseminated, meaning that they will not be made known to unidentified persons in any manner, including by making them available or accessible for consultation.

Your Personal Data may be disclosed to the following categories of recipients, who may use them exclusively for the purposes described in section D above:

• employees and collaborators of the Data Controller within the Company’s departments who are entrusted with processing Personal Data and act under the Data Controller’s authority or delegation as authorised or delegated persons, and who need to process them in order to perform their duties or delegated responsibilities and/or because of the positions they hold (e.g. line managers, people working in Human Resources, or other departments that may require your services, etc.). The number of such persons will be kept as limited as possible. They will have access only to the Data relevant to their assigned tasks and will act in accordance with instructions provided by the Data Controller;
• the parent company, Hager Italia Partecipazioni S.r.l., or other Italian or foreign companies within the Hager Group, to enable, where the relevant conditions are met, the proper and effective management of your profile at worldwide group level in connection with staff selection and recruitment processes or Information Technology services;
• service providers or consultants appointed by the Data Controller to install, maintain, update or manage the web server;
• any competent judicial or administrative authority, including regulatory and supervisory authorities, where disclosure is necessary (i) to comply with applicable laws or regulations, (ii) to establish, exercise or defend the Data Controller’s rights, or (iii) to protect your vital interests or those of any other person. These parties will process the Data as independent data controllers.

Where these recipients process Data on behalf of Herholdt Controls, they will be appointed as external Data Processors under a specific contract or other legal instrument binding them to the Company and providing the safeguards required by Article 28 of the Regulation to protect the data subject’s rights and freedoms.

The complete list of Data Processors appointed under Article 28 of the Regulation is available at Herholdt Controls’ registered office.

Please also note that any information concerning you may be accessible, directly or indirectly, to professionals individually identified by the Company and expressly designated as System Administrators. These are technical personnel whose work involves managing and maintaining the data processing system or its components (for example, overseeing the resources of a computer operating system or a database and enabling their use, managing system access credentials, organising network flows, performing backups, and adopting protective measures, etc.).

H. Location of processing and data transfers

Your Personal Data are processed, for the purposes described in section D of this Notice, on servers located at the registered office at Via Mestre 13, Milan (MI), or at the premises of other Hager Group companies within the European Union/European Economic Area.

Since Herholdt Controls operates worldwide, your Personal Data may, for the purposes set out in section D of this Notice, be transferred to companies within the Hager Group, of which Herholdt Controls is a member, located both within and outside the European Union/European Economic Area.

In the latter case, any transfer of Personal Data by the Data Controller to countries outside the EU/EEA will take place in accordance with the appropriate safeguards applicable to the transfer under Articles 45 and 46 of the Regulation, or under the derogations provided for in Article 49(1) of the Regulation, with suitable confidentiality and security safeguards.

I. Personal data retention period

Your Personal Data will be retained for the period strictly necessary to achieve the purposes described in section D above and until the purpose for which they were collected and subsequently processed has been fulfilled.

However, the Data Controller reserves the right to retain the Data beyond that point if it considers that further legitimate purposes and interests continue to exist, up to a maximum of 12 months from collection.

To manage any disputes or litigation and, in any event, to establish, exercise or defend legal claims, your Personal Data may be retained for a further period corresponding to the applicable limitation period for the relevant right.

If you are hired by the Company following your application, the Data Controller will use your Personal Data to complete the hiring process and will provide you with a separate privacy notice in your new capacity as an employee.

At the end of the retention period applicable to the purposes described in section D above, the Personal Data will be erased. For this reason, once that period has expired, the rights described in section J below can no longer be exercised.

In any event, you may at any time ask the Data Controller to erase your Personal Data and immediately cease processing them.

J. Rights of the data subject

Under Articles 15–22 of the Regulation, as a data subject you have the right to obtain confirmation from the Data Controller as to whether or not Personal Data concerning you are being processed and, if so, to:

• obtain access to your Personal Data and to the following information: the source, purposes, categories and methods of processing; the logic involved where processing is carried out using electronic tools; the categories of your Personal Data being processed; the identity of the Data Controller and the persons delegated to process Personal Data or appointed data protection officers; the recipients or categories of recipients to whom your Personal Data have been or will be disclosed; and, where possible, the retention period for your Personal Data or the criteria used to determine it;
• obtain: (a) the updating, rectification or, where you have an interest in doing so, completion of your Personal Data under Article 16 of the Regulation; (b) the erasure or removal of your Personal Data under Article 17 of the Regulation; (c) the anonymisation or blocking of your Data that have been processed unlawfully, including Data whose retention is unnecessary for the purposes for which they were collected or subsequently processed, or restriction of the processing of Data concerning you by the Data Controller; and (d) confirmation that the actions referred to in points (a) and (b), including their content, have been communicated to those to whom your Data have been disclosed or disseminated, unless this proves impossible or involves an effort manifestly disproportionate to the right being protected;
• obtain, upon request, the portability of your Data, namely to receive them from the Data Controller in a structured, commonly used and machine-readable format and transmit them to another data controller without hindrance, subject to Article 20(3) and (4) of the Regulation;
• object, on legitimate grounds, to the processing of your Data by the Data Controller and object to automated processing of your Personal Data, including any profiling;
• receive, without undue delay, notification of a breach of your Personal Data;
• withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• lodge a complaint with the supervisory authority (the Italian Data Protection Authority) regarding the Data Controller’s processing of your Data.

K. Minors

The application services offered by the Data Controller on its website are not intended for persons under the age of 18. If you are under 18, please do not submit unsolicited applications or provide your Personal Data on the Data Controller’s website.

L. Updates and amendments to this privacy notice for candidates

The Data Controller reserves the right to amend and update this Notice to reflect regulatory, technical or business changes. You are therefore advised to check it regularly and refer to the latest version available in the relevant section of the Data Controller’s website: https://www.hhcontrols.com/candidate-privacy-notice/.

The date on which this Privacy Notice for Candidates was last updated will be shown at the top of the Notice.

This Notice cancels and replaces in full all previous notices, which must therefore be regarded as superseded.

Thank you for your attention.