Information on the processing of personal data pursuant to Article 13 of EU Regulation No. 2016/679 ("GDPR")

This Information notice on the processing of personal data (the "Privacy Policy") is addressed to those who access MC Engineering S.r.l.'s MCtalent application (the "App") on Meta's "Horizon" platform, as they intend to attend a job interview in the so-called "virtual reality" or "metaverse" (the "Interview"). MC Engineering S.r.l., as Data Controller, invites you to carefully read this Privacy Policy which contains important information on the Processing of your Personal Data, in order to make informed, free and conscious choices. This document has been drawn up in accordance with Article 13 of the EU Regulation no. 2016/679 ("GDPR") in order to allow you to know the privacy policy of MC Engineering, to understand how your personal information is processed when you use the App and to inform you that the processing carried out by the Data Controller will be based on the principles of lawfulness, fairness, transparency, purpose limitation and storage, data minimization, accuracy, integrity and confidentiality referred to in Article 5 of the GDPR. Terms marked with a capital letter have the meaning given to them in the GDPR, unless otherwise specified in this Policy.

1. Data Controller _____________________________________________________________________

The Data Controller, who issues this Privacy Policy, is MC Engineering S.r.l., with registered office in Orbassano (TO), Strada Torino n. 43, fiscal code and VAT no. 08725660016, who can be contacted at the Data Protection Officer's email address: dpo@mcengineering.eu.

2. Processed Personal Data _____________________________________________________________________

Following access to the App and during the Interview, MC Engineering will process the below listed Personal Data: a. Data voluntarily provided by the Data Subject The Data Controller processes the following categories of Personal Data provided by you: - personal data: name, surname, age, date of birth, address; - contact details: telephone number and email address; - information relating to educational background and knowledge of languages; - information about professional experience; - Curriculum Vitae and photo, as contained in the Curriculum Vitae; - further Personal Data that you may provide during the Interview. In addition, the Data Controller may process Special Categories of Personal Data as referred to in Article 9 (1) of the GDPR, such as, but not limited to, data relating to your health status (e.g. if you belong to a protected 2 category), political opinions, trade union membership etc. or, pursuant to Article 10 of the GDPR, personal data relating to criminal convictions and offences, as required by law. Such Data will only be processed to the extent that such information is voluntarily provided by you and your free, explicit and documented consent has been given pursuant to Section 9(2)(a) of the GDPR, and/or it is strictly necessary for the Data Controller pursuant to Section 9(2)(b) and (h) of the GDPR. b. Navigation Data and Data related to the functioning of the App The computer systems and software procedures used to operate the App acquire, during their normal use and operation, some Personal Data whose transmission is implicit in the use of Internet communication protocols and functional to the use of the App itself. This category of Data includes: - oculus ID; - graphic and virtual representation (so-called "avatar") and voice of the user.

3. Purpose of the Processing _____________________________________________________________________

The purpose of the Processing of your Personal Data is to allow MC Engineering the search and selection of employees and collaborators - aimed at the possible establishment of a contractual employment relationship - through the Interview supported in the so-called virtual reality. This includes activities with the following purposes: a. evaluation of the candidate's professional profile; b. administrative-accounting in the preparatory phase to the possible establishment of an employment relationship; c. to fulfil specific legal obligations or to perform specific tasks provided for by laws, regulations, national collective bargaining employment contracts, or by European regulations, in particular for the purposes of compliance with legislation on social security and assistance, or on hygiene and safety at work, as well as on tax and health protection.

4. Legal basis of the Processing _____________________________________________________________________

The legal bases of the Processing are: - Article 6(1)(b) of the GDPR, insofar as necessary for the execution of pre-contractual measures taken at the request of the Data Subject. Any failure to provide such Data or the provision of incorrect Data would, indeed, make it impossible to assess your application for a job position or collaboration with MC Engineering; - Article 6 (1) (c) of the GDPR, where necessary for the fulfilment of a legal obligation to which the Data Controller is subject. 3

5. Recipients of Personal Data _____________________________________________________________________

The Personal Data will be collected and/or disclosed to the personnel of MC Engineering in charge of recruitment and selection, as well as to authorized collaborators for the purposes set out in clause 3 above, who are subject to a legal obligation of confidentiality. The Personal Data referred to in point 2.a above may be shared with parties, entities or authorities, independent data controllers, to which the access to such Personal Data is recognized by law or orders of the authorities. You have freely chosen to access the App and to participate in the Interview, aware of the manner in which the same is carried out. Therefore, you are aware that the use of the App necessarily entails the use of third parties’ platforms, tools and accessories. Such use may entail the processing of your Personal Data by such third parties, which have their own privacy policy, to which MC Engineering is extraneous. The user is recommended to carefully read such information and policies.

6. Processing method and Data Retention _____________________________________________________________________

The Personal Data referred to in clause 2.a are processed by the personnel and collaborators of MC Engineering expressly authorised to do so, using manual, paper, computer and/or telematic tools, with organizational methods and logic strictly related to the purposes indicated in clause 3 above and will be organised in databases or archives. Such Data will be kept for the entire duration of the recruiting process. Should the application have a negative outcome, the Data will be kept for a period of 12 months and may be evaluated with reference to other job positions and/or applications other than those for which the Data were provided. You shall always have the right to request, at any time, the deletion of such Data and you may exercise any other right as specified in clause 7 below. In case of a successful application, the Data will be stored and processed in accordance with the information provided at the time of employment. The Personal Data under clause 2.b are processed by automated and non-automated means and will be kept only for the period of use of the App, as they are functional to it, and then immediately deleted. Specific security measures are observed to prevent Data loss, unlawful or incorrect use and 3nauthorized access.

7. Data Subject’s Rights _____________________________________________________________________

Pursuant to Art. 15 et seq. of the GDPR, you have the right to request at any time access to your Personal Data, its rectification or deletion, the restriction of Processing in the cases provided for by Art. 18 and the portability of the Data in the cases provided for by Art. 20, as well as to lodge a complaint with the competent 4 supervisory authority pursuant to Art. 77 (The Italian Data Protection Authority) if you believe that the Processing of your Data infringes the relevant legislation. In addition, you can make a request to object to Processing of your Data pursuant to Art. 21 in which you have to give evidence of the reasons that justify the objection: the Data Controller reserves the right to evaluate the request, which would not be accepted in case of legitimate reasons to proceed with the Processing that override your interests, rights and freedom. Requests should be addressed in writing to the Data Controller, at the email address provided in clause 1 of this Privacy Policy.

8. Privacy Policy updates and changes _____________________________________________________________________

This Policy is effective as of 1 November 2022. The Data Controller reserves the right to modify or update its content, in whole or in part, also due to changes in applicable legislation, therefore invites you to visit this section on a regular basis in order to stay up to date.