PRIVACY NOTICE FOR APPLICANTS

Arrigo Recordati International
Prize for Scientific Research – 2026 Edition

Pursuant to Articles 13 and 14 of Regulation (EU) no. 679/2016 (“GDPR”) and other applicable data protection laws, Recordati Industria Chimica e Farmaceutica S.p.A. has drawn up this document (the “Privacy Notice“) to describe how it processes personal data in relation to applications for the Arrigo Recordati International Prize for Scientific Research – 2026 Edition (the “Initiative”).

For additional processing activities, such as those related to the website https://prize.recordati.com, or participation in the Initiative’s award ceremony, we invite you to consult the relevant privacy notice as provided from time to time.

This Privacy Notice applies to the processing of personal data pertaining to:

• applicants who submit the documentation and information required to take part in the Initiative (“Applicant(s)”); and
• individuals mentioned in the materials submitted by the Applicants, such as co-investigators of the research; and
• point of contact at the institution of reference for shortlisted Applicants

(hereinafter jointly referred to as “Data Subjects” or “you”).

If the Applicant submits documentation and information containing personal data of other individuals to apply to the Initiative, the Applicant should provide those individuals with a copy of this Privacy Notice.

1. Data Controller and Data Protection Officer

The data controller is Recordati Industria Chimica e Farmaceutica S.p.A., a company of the Recordati Group, with registered office at Via Matteo Civitali 1, Milan – Italy (“Recordati” or “Data Controller” or “we”).

The Data Protection Officer of the Recordati Group can be contacted for any privacy issue or question arising or in connection with the processing of personal data at the following email address: groupDPO@recordati.com.

2. Types of data processed

The following personal data will be processed (hereinafter “Personal Data”):

1. identification data, such as first and last name, ID details;
2. contact details, such as email address and phone number;
3. academic background and work experience, including highest degree, current title, institutional affiliation, research experience, publications, and collaborations, as well as any other information contained in the CV or shared during the application process;
4. information regarding grant support, including current or pending applications, as well as the grant period;
5. any other personal data provided voluntarily by the Applicant.

Scientific research data submitted by the shortlisted Applicants, which may include health and other special categories of personal data, is handled by Recordati in a fully anonymized format, ensuring that no individual can be identified directly or indirectly.

3. Purpose of processing and legal basis

Your Personal Data will be processed for the following purpose with the corresponding legal basis indicated:

Provision of your Personal Data is mandatory and in failure you will not be able to submit your application and participate in the Initiative.

4. Processing methods and storage period

The processing of your Personal Data will be based on the principles of lawfulness, fairness, transparency, proportionality and minimization and will be carried out electronically, using suitable tools to guarantee the security and confidentiality of your data.

Your Personal Data will be retained for different terms, depending on whether the Applicant is awarded the Initiative prize. In this case, Personal Data will be retained for a period of ten years following the conferral of the Initiative’s prize, unless such Personal Data are relevant for archival and historical purposes; in such case, they will be included in our archives and retained for as long as necessary to achieve the intended purposes.

For Applicants who are not selected for the Initiative prize, Personal Data will be maintained for one year after the prize has been awarded. In case of incomplete or late applications,

5. Communication and transfer of Personal Data

Your Personal Data may be accessed by Recordati employees and collaborators, specifically designated as persons authorised to process it, where necessary for the pursuit of the purposes described above.

Your Personal Data will be shared with the persons in charge to assess your application (the “Reviewing Committee”) in their capacity as independent data controllers. In addition, your Personal Data may also be communicated or made accessible to consultants and third-party suppliers of technical or organizational services, functional to the purposes described above, in their capacity as our data processors, specifically designated and instructed on the basis of a specific contract.

Your Personal Data may also be accessed by authorities or other public bodies by virtue of legal provisions or secondary or EU legislation, in their capacity as independent data controllers, for their respective institutional purposes.

Personal Data will be transferred outside the European Economic Area[1], . For the latter,

6. Rights of the Data Subject

The Data Controller informs you that you can exercise, at any time, the following rights by contacting the Data Controller or the DPO at the addresses indicated above:

1. the “right of access” to your Personal Data and, in particular, to obtain confirmation of the existence or otherwise of Personal Data concerning you;
2. the “right to rectification”, i.e. the right to request the rectification of inaccurate data or the completion of incomplete data;
3. the “right to erasure”, i.e. the right to request the erasure, the transformation into anonymous form of data processed in violation of the law, including those whose retention is not necessary in relation to the purposes for which the Personal Data were collected or subsequently processed;
4. the “right to restriction of processing”, i.e. the right to obtain from the Data Controller the restriction of processing in certain cases provided for pursuant to the privacy legislation;
5. the “right to data portability”, i.e. the right to receive (or to transmit directly to another data controller) Personal Data in a structured, commonly used and machine-readable format;
6. the “right to object”, i.e. the right to object, in whole or in part:

• to the processing of Personal Data carried out by the data controller for its own legitimate interest;
• to the processing of Personal Data carried out by the data controller for marketing or profiling purposes.

The exercise of the above rights is not subject to any formal constraint and is free of charge. The Data Controller may ask you to verify your identity before taking further action following your request to exercise the rights referred to above.

You may also lodge a complaint with the competent Supervisory Authority (in particular in the Member State of your habitual residence, place of work or place of the alleged violation), if you are of the opinion that your Personal Data are being processed in such a way as to result in violations of privacy legislation. You may also contact the Supervisory Authority if the exercise of your rights is subject to delay, limitation or exclusion by the Data Controller.

You may also contact the relevant supervisory authority if the exercise of your rights is subject to delay, limitation or exclusion by the data controller.

In order to facilitate the exercise of the right to lodge a complaint, please find below the name and contact details of the supervisory authority in Italy:

• website: https://www.garanteprivacy.it/;
• email address: protocollo@gpdp.it;
• phone number: +3906696771.

The name and contact details of the supervisory authorities of the European Union are available at the following link: Our Members | European Data Protection Board (europa.eu).

If Legislative Decree No. 196/2003 as subsequently amended and supplemented by Legislative Decree no. 101/2018 (“Italian Privacy Code”) applies to the processing of your Personal Data, in case of Data Subject’s death, the aforesaid rights relating to their Data may be exercised by anyone who has a personal interest, or acts to protect the Data Subject as its representative, or for family reasons worthy of protection pursuant to article 2-terdecies of the Italian Privacy Code. Data Subjects may expressly prohibit the exercise by its assignees of some of the rights above by written notice to be sent to Recordati as described above, without prejudice to their right to withdraw or modify such expressed intention later on according to the same procedure.

7. Changes to this Privacy Notice

This Privacy Notice is valid from the date of effectiveness provided below. However, the Privacy Notice may subsequently be updated or integrated, from time to time, also as consequence of possible subsequent amendments and/or integrations of the applicable laws. Changes will be notified in advance and Data Subjects will be able to consult the constantly updated version of this Privacy Notice on Recordati’s website.

[1] The European Economic Area (EEA) consists of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Republic of Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden.