Notice on the Processing of Candidates' Personal Data and Management of Job Applicationse

1. Data Controller and Contact Details

The Data Controller is Hypermeteo S.r.l. (hereinafter the “Controller”), with registered office at Via Nazionale, 181, 00184 Rome (RM), Italy, Tax Code and VAT No. 16159021001; it processes personal data in compliance with Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

Contact details:

• Contact e-mail: info@hypermeteo.com

• Certified e-mail (PEC): hypermeteo@pec.hypermeteo.com

2. Source and Categories of Data

Personal data are collected directly from the Candidate (hereinafter the “data subject”) when submitting a curriculum vitae through the “Work with us” form, by sending an unsolicited application via e-mail, or by hand delivery.

The data processed may include:

• identification and contact data (first name, last name, e-mail address, phone number);

• data relating to education and professional background (qualifications, certifications, work experience, technical skills);

• any additional data included in the CV or cover letter;

• any special categories of data pursuant to Art. 9 GDPR (e.g., membership of protected categories), where voluntarily provided by the data subject and relevant to the position applied for.

Data subjects are advised to include in their documents only data that is adequate, relevant, and not excessive in relation to the position applied for.

3. Purposes and Legal Bases

Personal data will be processed by the Controller for the following purposes:

• a) Assessment of the application and conduct of recruitment activities (Art. 6(1)(b) GDPR): analysis of the professional profile, management of contacts with the data subject, organization of interviews, and performance of pre-contractual measures requested by the data subject.

• b) Possible inclusion of the CV in a candidate database for future recruitment (Art. 6(1)(a) GDPR): retention of the data subject’s profile for subsequent recruitment opportunities and sending of any follow-up contacts, subject to explicit, freely given consent, revocable at any time.

• c) Fulfilment of legal obligations relating to recruitment and the possible establishment of an employment or collaboration relationship (Art. 6(1)(c) GDPR): management of regulatory and administrative requirements set out by legislation or competent authorities.

Where special categories of data (Art. 9 GDPR) are provided by the data subject, they will be processed only to the extent necessary to fulfil obligations and exercise the rights of the Controller or of the data subject in the field of employment and social security law, pursuant to Art. 9(2)(b) GDPR.

4. Processing Methods and Security Measures

Personal data are processed using both paper-based and IT/telematic tools, in a manner strictly related to the purposes indicated, with documented procedures and technical and organizational measures appropriate under Art. 32 GDPR.

Processing is carried out in compliance with the principles set out in Art. 5 GDPR and in accordance with a privacy-by-design and privacy-by-default approach (Art. 25 GDPR), ensuring lawfulness, fairness, transparency, data minimization, accuracy, and integrity, with periodic checks on the relevance and updating of the information retained.

5. Data Recipients

Personal data may be disclosed exclusively to parties that provide services to the Controller, in compliance with the purposes set out in this Notice and with Articles 28 and 29 GDPR. Such parties will be appointed as Data Processors by means of a specific contractual instrument, or will act as independent controllers, within the limits of their respective institutional purposes.

The following may have access to personal data, within the limits of their respective duties and in accordance with documented authorizations:

• employees and staff of the Controller, expressly authorized and instructed, acting under the Controller’s direct responsibility and supervision;

• external parties involved in the operational and administrative management of the relationship (non-exhaustive list): HR consulting firms, IT service providers, application/recruitment management platforms.

Data will be disclosed exclusively to parties with whom the Controller maintains a formal legal relationship (appointment as Data Processor under Art. 28 GDPR, or as an independent controller), and disclosure will be limited to the data strictly necessary to carry out the relevant activities.

The updated list of Data Processors is available upon request by writing to info@hypermeteo.com.

6. Transfers Outside the EU

Personal data are managed within an operational perimeter entirely located in the European Economic Area, so as to avoid transfers to third countries.

Should it become necessary, for specific technical or operational needs (e.g., server location, cloud services, corporate coordination, or group activities), to transfer data to countries outside the European Union, the Controller will ensure full compliance with Chapter V of the GDPR and Articles 44–46, adopting appropriate safeguards, including: verification of the level of protection in the destination country; where applicable, adoption of the Standard Contractual Clauses (SCCs) approved by the European Commission; and, where applicable, reliance on a European Commission adequacy decision, where one exists.

7. Retention Period

Personal data are retained for the time strictly necessary to achieve the purposes for which they were collected and, once those purposes have been fulfilled, are deleted or irreversibly anonymized, unless further retention is required for legal protection purposes or under regulatory obligations. Retention periods are determined in compliance with the principles of purpose limitation and data minimization, based on an assessment carried out by the Controller in relation to the various purposes pursued.

8. Nature of the Data Provision

The provision of data is optional but necessary for the assessment of the application. Failure to provide essential information may result in the Controller being unable to consider the application.

9. Data Subject Rights and Complaints

As a data subject, the individual may exercise at any time the rights set out in Articles 15–22 of the GDPR, including the right to obtain access to personal data, rectification or erasure, restriction of processing, data portability, as well as the right to object to processing and to withdraw any consent given.

Requests may be sent to: info@hypermeteo.com. The Controller will respond within 30 days of receipt of the request.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

10. Automated Decision-Making

Personal data acquired in the context of managing applications are not subject to automated decision-making processes or to profiling activities capable of producing legal effects or significantly affecting the data subject. The company’s application ecosystem uses artificial intelligence systems solely for operational support purposes and to improve process efficiency, without any legal or significant impact on the data subject.

11. Updates

The Controller reserves the right to modify or update this Notice at any time. The version published on the website is the version currently in effect.

Notice version: 1.0 – updated November 2025