Information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679

With this document (‘Information Notice’) the Data Controller, as defined below wishes to inform you about the purposes and methods of the processing of your personal data and about your rights granted to you by Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on their free movement (‘GDPR’). This Policy may be supplemented by the Controller where any additional services requested by you entail further processing.

1. Data Controller and Data Processor, DPO

Il Titolare del trattamento è:

THEBEAUTY GROUP S.R.L.

The Data Controller is

THE BEAUTY GROUP S.R.L.

Tax code/VAT number 13650200960

Head Office Address VIA FRATELLI GABBA, 5 CAP 20121 MILAN (MI)

The Data Controller and the DPO, also through the designated structures, will take charge of your your request and provide you, without undue delay and, at the latest, within one month of receipt of the same, the information relating to the action taken in respect of your request. We inform you that should the Controller have any doubts as to the identity of the individual making the submitting the request, it may request further information necessary to confirm the identity of the person concerned. Categories of Data Subjects: Natural persons, legal persons, public and private organisations.

2. Treatments

2.1. WEB treatment

PROCESSING: WEB – NAVIGATION DATA

The computer systems and software procedures used to operate this website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified interested parties, but which by their very nature could, through processing and association with data held by third parties, allow the identify users. This category of data includes the IP addresses or domain names of the computers used by users who connect to the site, addresses in URI notation (Uniform Resource Identifier) notation of the resources requested, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response numeric code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and computer environment. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to control its correct functioning and are deleted after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the site. computer crimes against the site. Nature of data provision: Compulsory Consequences of refusal to provide data Failure to provide data will result in the impossibility for the company to provide the web service provided. Minimum data protection measures: To be indicated Personal data retention period: Your personal data will be actively processed for the duration of the first and third party analytical systems. Reference processing rules: The legal basis for registration to the Site and the provision of related services is the necessity of execution of your request, in compliance Article 6(1)(b) GDPR. Therefore, the acquisition of your Your prior consent to the processing.

2.2. Trattamento WEB

PROCESSING: WEB – SENDING CURRICULUM VITAE

Through the ‘Work with us’ section of the Site you may provide your personal data and CV to the Holder in order to apply for open positions or possible future positions. Your personal data processed exclusively for the management of your application and related activities. related activities. Nature of data provision: Obligatory Consequences of refusal to provide data Failure to provide consent will result in the impossibility for the Data Controller to receive your Curriculum Vitae and to perform the activities aimed at managing your application. activities aimed at managing your application. Minimum data protection measures: password, firewall, antivirus, reCAPTCHA Personal data storage period: Your personal data processed for the management of your CV will be kept for N months after receipt or negative result of a selection, in order to be considered for possible future positions. Reference processing rules: The legal basis for registration to the Site and the provision of related services is the necessity of execution of your request, in compliance Article 6(1)(b) GDPR. Therefore, the acquisition of your Your prior consent to the processing.

2.3. Trattamento WEB

PROCESSING: WEB – SENDING CURRICULUM VITAE

TREATMENT: WEB – COMMERCIAL NEWSLETTER

Should you wish to be updated on the latest products and services offered by the Data Controller or third party companies, you will be able to join our marketing initiatives, allowing the Controller to send you the newsletter and further commercial communications. commercial communications. Nature of conferment: Optional Consequences of refusal to provide data: Failure to provide data will not affect the satisfaction of your requests and the use of web services but will make it impossible for the Data Controller to send you commercial communications. Minimum data protection measures: password, firewall, antivirus, reCAPTCHA Personal data retention period: Your personal data will be actively processed for the time necessary for the management of the existing relationship and/or the execution of the contract. The information collected for the evaluation of the conclusion of the contract, in the event of non completion, will be deleted within N months..

‍