Candidate Privacy Notice

The Data Controller is: AIDEA STUDIO S.R.L.S. VAT and tax code 04324400136 Registered office: Via dei Mille 2, 22070 Appiano Gentile (CO), Italy For any question about this notice or to exercise your rights, write to: privacy@aideastudio.it AIDEA Studio has not appointed a Data Protection Officer (DPO), as it is not required in our case.

We process the data you provide, directly or through LinkedIn, and the data generated during the selection process: • Identification and contact data: name, surname, email, phone, city or area of residence • Professional data: CV, experience, skills, education, languages, LinkedIn profile, portfolio, links to GitHub or published work • Collaboration data: day rate, availability, VAT registration • Answers to the screening questions of the opening • Data collected during the selection: interview notes, results of any technical exercises, final evaluation We do not ask for special categories of data (such as health, religious or political beliefs, ethnic origin, sexual orientation) or data on criminal convictions. Please do not include them in your CV. No photo is needed either. If you send them anyway, we do not use them for the selection and we delete them, unless required by law. If your CV lists references — names and contact details of other people — please make sure they are informed. We contact them only with your agreement. Data collected from public sources. In some cases we may collect your public professional profile from platforms such as LinkedIn or GitHub, to contact you about a role for which your profile seems suitable. In this case the data does not come from you but from the platform, and consists exclusively of information you have made public for professional purposes: contact details, experience, skills and profile link. We process it on the basis of AIDEA Studio's legitimate interest in identifying professionals suited to ongoing projects (Art. 6.1.f GDPR). This notice is published at the address indicated in point 11 and is referenced in the message we use to contact you. If you are not interested, the profile is deleted upon your request or in any case within 6 months of first contact.

• Evaluating your application for the role you applied for and for other ongoing roles suited to your profile, organising interviews and informing you of the outcome → Pre-contractual measures taken at your request (Art. 6.1.b GDPR). For spontaneously submitted CVs, Art. 111-bis of the Italian Privacy Code also applies and does not require consent. • Keeping your profile in the AIDEA network after the selection, to contact you about future opportunities → Your consent, separate and optional (Art. 6.1.a GDPR). • Entering into and managing the collaboration, if you are selected → Performance of the contract (Art. 6.1.b) and legal tax and accounting obligations (Art. 6.1.c). • Defending our rights in case of disputes related to the selection → Legitimate interest of AIDEA Studio (Art. 6.1.f). Providing the data in point 2 is not mandatory, but without it we cannot evaluate your application. Consent for the network is entirely optional: if you do not give it, your application is evaluated exactly like the others.

Applications are read and evaluated by people. We do not use artificial intelligence systems to select, classify, filter or evaluate candidates. We do not make decisions based solely on automated processing, including profiling, under Art. 22 GDPR. We only review the information you provide and the professional profiles you indicate, such as LinkedIn, GitHub or your portfolio. We do not look for information about your private life.

• AIDEA Studio people involved in the selection, authorised to process data and bound by confidentiality. • External professionals collaborating on the selection, for example those conducting technical interviews. They act as data processors under an Art. 28 GDPR agreement and only see the data needed for their task. • Technology service providers who process data on our behalf as data processors, in particular Google (email and document storage). • LinkedIn, if you apply through the platform. LinkedIn processes your data as an independent controller under its own privacy policy, which we invite you to read. • Legal, tax advisors and authorities, only where necessary for legal obligations or to defend our rights. We do not share your profile with our clients without first asking your consent for that specific project. We do not sell or transfer your data to third parties for commercial purposes.

We store data on services based or with infrastructure in the European Union where possible. Some providers, such as Google and LinkedIn, may process data outside the European Economic Area as well. In these cases transfers take place with the safeguards under Articles 45 and 46 GDPR: European Commission adequacy decisions, such as the EU-U.S. Data Privacy Framework, or standard contractual clauses. You can ask us about these safeguards by writing to the address in point 1.

• Ongoing selection → for the whole duration of the selection. • Completed selection, without network consent → deleted within 6 months of the closing of the selection. This period only serves to handle possible disputes. • Completed selection, with network consent → 24 months from the date of consent. At expiry we ask whether you want to renew it; if you do not reply, we delete the profile. • Profile collected from public sources, unsuccessful contact → deleted within 6 months of first contact. • Selected candidate → data moves to the management of the collaboration. Contractual and accounting documents are kept for the duration of the contract and then for 10 years, as required by tax and corporate law. The CV and interview notes do not fall within this period and are deleted within 6 months of the closing of the selection, unless you have given consent for the network. If you withdraw consent, we delete the profile from the network without delay, and in any case within 30 days.

Data is accessible only to authorised people, on accounts protected by two-factor authentication, with access limited to those who need it for the selection. We do not store CVs on unprotected personal devices.

At any time you can ask us to: • Give you access to your data and a copy of it (Art. 15) • Rectify or update it (Art. 16) • Erase it (Art. 17) • Restrict its processing (Art. 18) • Receive it in a structured format and transmit it to another controller, for data processed on the basis of consent or contract (Art. 20) • Object to processing based on legitimate interest (Art. 21) • Withdraw consent for the network, without consequences for ongoing applications and without affecting the lawfulness of processing already carried out (Art. 7.3) To exercise them, write to: privacy@aideastudio.it — We reply within one month. If you believe the processing violates the GDPR, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the supervisory authority of the country where you live or work.

Our selections are aimed at adult professionals. We do not knowingly process data of people under 18.

We may update this notice. The current version is always published at this address, with the date of the last update.

Optional and separate from the application. Declining consent does not affect the evaluation in any way. "I consent to my profile being kept in the AIDEA Studio professional network for 24 months, so that I can be contacted about future collaboration opportunities, as described in point 7 of the Candidate Privacy Notice. I know I can withdraw consent at any time by writing to info@aideastudio.it." Consent is collected at the time of application; you can withdraw it at any time by writing to info@aideastudio.it.