Privacy policy for applicants in accordance with Articles 13 and 14 of EU Regulation no. 2016/679 (“GDPR”) Version dated 15 June 2023 This privacy policy is provided by the companies that are part of the Lifestyle DESIGN Group (as indicated at clause 1 below) as joint controllers of the personal data of applicants who send their Curriculum Vitae to one of the companies that are part of the Group, or that, in another way, participate in selection procedures aimed at establishing employment or collaboration relationships with one of the Joint Controllers (hereafter, the "Applicants" or the "Data Subjects"). 1. Joint Controllers - DPO (Data Protection Officer) The Joint Controllers are:  Poltrona Frau S.p.A. with single member, with registered office at Via Busnelli 1, 20821 Meda (MB), Italy, VAT no. 05079060017;  Poltrona Frau UK Ltd with registered office 148-150 St John Street, EC1V 4UD London (UK);  Frau France S.a.r.l. with registered office at 260 boulevard Saint Germain ,75007 Paris, France;  Poltrona Frau Group North America Inc. with registered office at 151 Wooster street, 2nd floor, New York, NY, 10012, EIN n. 20-2552657;  Poltrona Frau India Private Ltd with registered office at 101, Wakefield House, Sprott Road, Ballard estate Mumbai 400 001, India;  Poltrona Frau ASIA-PACIFIC Pte.Ltd. with registered office at 10 Anson Road #18-21 International Plaza 079903 Singapore;  Pf Emirates Interiors LLC with registered office at Suite 3201, Tower 1, Sheikh Mohamed Bin Rashid Boulevard, Downtown Dubai, Dubai, Emirati Arabi Uniti;  DieciDieci S.r.l. with registered office at via Alessandro Manzoni 30, 20121 Milan, Italy;  Cassina S.p.A., with registered office at Via Busnelli 1, 20821 Meda (MB), Italy, VAT no. 00976180968.  Cassina France S.a.r.l. with registered office at 236 Boulevard Saint Germain, Paris, France;  Cassina Pacific Ltd. with registered office at Unit 2005, 20/F CRE Centre, 889 Cheung Sha Wan Road, Kowloon, Hong Kong;  Cassina (SHANGHAI) Trading CO.LTD with registered office at Room A205, Block 4, Zhangjiabang Road N. 88, Pudong New District, Shanghai, Republic of China;  Cap Design S.p.A. with single member, with registered office at Via Busnelli 5, 20821 Meda (MB), Italy, VAT no. 04311900965.  Ceccotti Collezioni S.r.l. with registered office at Viale Sicilia, 4/a, 56021 Cascina (PI), Italy, VAT no. 01452600503.  Janus et Cie S.r.l., with registered office at Via Busnelli 5, 20821 Meda (MB), Italy, VAT no. 09873360961.  Janus Et Cie Inc. USA with registered office at Santa Fe Springs (CA), 90670, United States, Corporate no. 95- 3150326;  JANUS et Cie of Florida, Inc., with registered office at Santa Fe Springs (CA), 90670, United States, FEIN 20- 3234636;  JANUS et Cie of Massachusetts, Inc., with registered office at Santa Fe Springs (CA), 90670, United States, FEIN 20-0646641  Janus et Cie de Mexico, S. de R.L. de C.V., with registered office at Culican 123, Piso 6, Hipodromo Con Mexico D.F., 06170 Mexico, Tax ID JEC090721QA9;  Janus et Cie of Australia, llc with registered office at 50 McLachlan Ave Rushcutters Bay Sydney, NSW 2011 Australia, ABN 46606790434  Luminaire LLC with registered office at 8950 NW 33rd St Doral, FL 33172, United States  Luminaire (Chicago), LLC, with registered office at 8950 NW 33rd St Doral, FL 33172, United States, FEIN 58-1857039  Luminaire (LA), LLC, with registered office at 8840 Beverly Boulevard, West Hollywood, CA 90048, United States, FEIN 82-3044713;  Luminaire (Miami), LLC, with registered office at 8950 NW 33rd St Doral, FL 33172, United States, FEIN 59-1779022  Luminaire (San Francisco), Inc., with registered office at 128 Utah Street, San Francisco, CA 94103, United States, FEIN 20-3144562  Karakter Aps with registered office at Gammel Lundtoftevej 1C, 2800 Kongens Lyngby, Denmark. 1

 Club House Italia S.p.A., with registered office at Via Balzella, 5647122 Forlì (FC), Italy, VAT no. 06271501006.  Luxury Living S.r.l. , with registered office at Via Durini 23, 20122 Milan (MI), Italy, VAT no. 03341380404;  Luxury Living Group S.r.l., with registered office at Via Balzella, 5647122 Forlì (FC), Italy, VAT no. 10046911003.  Luxury Living France Sàrl with registered office at 16/18, Avenue George V, 75008 Paris - France, R.C.S. Paris 507 471 308;  Luxury Living Contract & Projects Limited with registered office at Lynton House 7-12 Tavistock Square, London WC1H 9BQ. Company no. 09115909;  Luxury Living of USA, LLC with registered office at Miami Design District, 50 NE, 39th Street, Miami, FL 33137 USA, Tax ID n. 75-3253309;  Luxury Living of Los Angeles, LLC with registered office at 8833 Beverly Boulevard, West Hollywood, CA 90048 USA, FEIN 47-4133113;  Luxury Living of New York, LLC with registered office at 153 Madison Avenue, New York, NY 10016 USA, FEIN 46-1178507;  Luxury Living China (Beijing) Trading Co. LTD, with registered office at F10 No. 1 Building 8 Yard, North Road of the Workers stadium, Chao Yang District, Beijing, corporate no. 911101050918530837  Interni S.p.A., with registered office at via Filippo Turati 8, 20122 Milano (MI) - Italy, C.F. 06185940159;  Twenty Twenty PFG Design SL with registered office at Calle Lagasca N. 28, Planta Baja Y Primera Madrid, 28001 Spain, NIF B87545745 (hereinafter, jointly or severally, the "Joint Controllers") The Joint Controllers have entered into an agreement for joint control of the Data (as defined below) in accordance with Art. 26 of the GDPR, whose essential contents can be viewed by the data subjects upon request to be sent to the email privacy@poltronafraugroup.com . The companies Poltrona Frau, Cappellini, Cassina and Club House Italia have appointed a DPO who is responsible for supervising compliance with the personal data protection regulations and, insofar as is of interest here, the processing carried out under the regime of joint control with the other companies of the Lifestyle DESIGN Group mentioned above. The interested party may contact the DPO securely and privately, at any time, if there are any general questions on the processing of his personal data, or to exercise the rights as specified below and, finally, to request information on the organisational structure of the Lifestyle DESIGN Group, by email dpo.poltronafrau@dpoprofessionalservice.it to the address 2. Which Data are processed and on what occasion? The Joint Controller(s) will process the personal data of Applicants (“Data”) as described below:  Data provided voluntarily for the creation of a user profile and registration to the reserved area: applicants can create a profile on the website https://careers.lifestyledesign.poltronafraugroup.com/ ("Website"), specifying their name, surname, age, date of birth, residence (State, street, county/province), and contact details (telephone number, email address);  Data provided voluntarily via the "open positions" section of the Website to apply for a specific position or to make a spontaneous application. On this point, applicants must complete the online application, specifying: ➢ For open positions in Italy: name, surname, age, date of birth, residence (State, county/province) contact details (telephone number, email address), information on training and education (qualifications and related subjects); information on professional experience (role and years of experience therein; and upload, using the specific function, their CV and cover letter (if any). ➢ For open positions in the rest of the world: name, surname, age, residence (State, county/province) contact details (telephone number, email address), information on training and education (qualifications and related subjects); information on professional experience (role and years of experience therein; and upload, using the specific function, their CV and cover letter (if any). 2

The Data processed will be all those provided by applicants in that section. Alternatively, applicants can apply via the "Apply with LinkedIn" function; in that case, the Joint Controllers will have access to the Data contained in the Data Subject's LinkedIn profile. If the Data Subject inserts text contents containing personal data of other persons (e.g., referee contact details), the Data Subject declares to accept all legal obligations and responsibilities, indemnifying the Joint Controllers from any dispute, demand, or compensation claim for damages in that sense.  Data provided voluntarily by sending an email or by post: the Data processed will be those contained in the communication sent by Applicants and contained in their CV and/or cover letter.  Data communicated to the Joint Controller by third parties, such as employment agencies, head-hunters: the Data processed will be those contained in the CV and/or cover letter of the Applicant provided by the third party.  Data provided voluntarily by Applicants during the interview whether in person or remotely or through an online test proposed by the Joint Controllers: the Data processed will be all those additional personal data that must be provided by Applicants during the selection phase, therein including data that are collected during the selection process. Any Special Categories of Data, known as "Sensitive Data" (e.g. data revealing mental-physical suitability for certain jobs, relating to handicaps or invalidating pathologies, allergies or membership of certain protected categories, as well as membership of and any roles covered in trade unions and associations, even philanthropic, any institutional roles covered, whether elective or not), will be processed exclusively to examine the application and only where this is strictly necessary, in accordance with applicable legislation. The Data Subjects are advised not to provide Data that are not necessary to pursue the purposes indicated in this Privacy Policy. In particular, the Joint Controllers, during the selection, do not process in any way, so-called "Judicial Data" of the Applicants during the selection; therefore, please do not attach this information to the application (e.g., do not attach to the Curriculum Vitae an extract of the criminal record).  Browsing data: the IT systems and software procedures that run the Website acquire, during their normal operation, some Data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified data subjects, but that, by its very nature, could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of the computers used by users who connect to the Website, addresses in URI (Uniform Resource Identifier) notation of the requested resources, time of the request, method used to submit the request to the server, size of the file obtained in response, numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the IT environment of the user. These Data are used for the sole purpose of obtaining anonymous statistical information on use of the Website and to control its correct functioning, to identify anomalies and/or misuse, and they are erased immediately after processing.  Cookies: Information on the use of cookies present on the Website can be viewed in the specific section https://careers.poltronafrau.com/cookiespolicy.htm 3. For what purposes are the Data processed and on what legal basis? The Data of the Data Subjects will be processed for the following purposes:  Creation of a user Profile and registration in the personal area of the Website: creation of the profile relating to the Applicant within the Website, for the purposes of sending the application. The legal basis for processing of the Data is Art. 6 paragraph 1) letter b) of the GDPR, to perform a contract to which the Data Subject is party.  Selection and assessment of the professional profile of the Applicant: to execute the pre-contractual obligations of which the Applicant is party, for the purposes of possibly establishing the employment relationship, therein including, merely by way of example, the assessment of the professional profile of the Applicant and the conduct of administrative/accounting duties in the phase preparatory to signing the employment/collaboration contract. The legal basis of the Data processing is Art. 6 paragraph 1) letter b) of the GDPR, to perform a contract to which the data subject is party or in order to take steps at the request of the same prior to entering into a contract; for Special Categories of Data, the legal basis is Art. 9 paragraph 2) letter b) namely the need to carry out the obligations and to exercise the specific rights of the controller or of the data subject in relation to employment law. 3

(the purposes indicated above are jointly known hereafter as the "Contractual Purposes")  to comply with any obligations of law or regulations. The legal basis of the Data processing is Art. 6 paragraph 1) letter c) of the GDPR, to comply with a legal obligation to which the Joint Controller(s) is/are subject (hereafter the "Legal Purposes").  to store the Curriculum Vitae of the Applicant: if the application has been unsuccessful, to assess the suitability to cover positions other than that for which the Applicant had sent the application, in view of the opening of new employment positions, both at the respective Joint Controller and at the other Joint Controllers. The legal basis of the Data processing is Art. 6 paragraph 1) letter f) of the GDPR, pursuit of the legitimate interest of the Joint Controller(s) (hereafter, the "Legitimate Interest Purposes"). 4. What is the nature of the Personal Data processing (optional or mandatory)? The processing of the Applicant's Data is mandatory with reference to the Contractual Purposes and the Legal Purposes. If the Applicant does not wish his/her Data to be processed for those purposes, the Joint Controller cannot procedure in creating the user profile on the Website and/or will not assess his/her profile or the outcome of the application may be prejudiced. The processing for Legitimate Interest Purposes is not mandatory and the Applicant may object to that processing by the methods indicated in paragraph 9 below, but if the Applicant objects to that processing, his/her Data may not be used for storing the application with a view to possible similar open positions at other Joint Controllers. 5. How are the Data processed? In relation to the purposes indicated above, the Data will be processed by manual or automated methods, both in digital and paper form, by persons authorised to process within the company organisation of each of the Joint Controllers, in respect of all applicable existing legislation and so as to guarantee the security and confidentiality of the data. During the selection phase and following an initial interview, the Joint Controllers will propose the candidate an online test to identify characteristics of independence, sociability, pace and approach to work, the result of which will be assessed by the human operator in charge of the selection in addition to what was discussed during the interview. The test in particular will help the operator to evaluate which characteristics may or may not be suitable for a given role and how to guide subsequent interviews. The result of the test may be made available upon request by the Data Subject. The Data, therein including any "Sensitive Data" will not be subject to profiling. 6. To whom are the Data communicated? The Data collected for the purposes indicated in paragraph 3 may be used by the Joint Controllers described herein. The Data will not be disseminated and, again in relation to the purposes indicated in paragraph 3, they may be communicated to the following categories of entities:  providers of instrumental or support services to those performed by each Joint Controller and therefore, by way of example but without limitation, experts, consultants, lawyers, auditing companies, providers of technological services, in the capacity of autonomous controllers or processors.  providers of services on outsourcing and/or external consultants trusted by the Joint Controller which provide staff search and selection services relating to the purposes indicated above in this privacy policy which, more specifically and depending on the circumstances, may act as autonomous controllers or processors.  transferees of businesses or business branches, companies resulting from mergers, demergers or other transformations of the Controller, as autonomous controllers; and  entities that may access the Data by virtue of legal provisions within the law of the European Union or the Member State to which the Controller is subject. The list of those entities is available upon request by email to one of the Joint Controllers using the contact details indicated in paragraph 9. 4

7. Is the Data transferred abroad? The Data may, in respect of applicable rules, be transferred abroad even to countries not belonging to the European Economic Area and, in particular, to the countries in which the other Joint Controllers are based as set out at clause 1. Any transfer of Data to countries located outside the European Economic Area will occur, in any case, in respect of the appropriate and adequate guarantees for the purposes of that transfer, in accordance with Articles 44 et seq. GDPR. In this regard, the Data Controllers inform the Data Subjects that they have adopted the standard data protection contractual clauses approved by the European Commission for the transfer of personal information outside the EEA (these are the clauses approved pursuant to Article 46(2) of the GDPR). 8. What is the Data storage period? The Data will be stored for the period of time necessary to pursue the purposes for which those Data were collected. In any case:  The Data of Applicants collected for the Contractual Purposes are stored for the whole period in which the position for which the application was sent is still open (for any further storage if the employment/collaboration relationship is established following a successful application, see the respective privacy policy provided by the recruiting Joint Controller at that time). The Applicant's online profile will be erased once 24 months have elapsed from the last change made. The Joint Controller(s) reserve(s) the right to contact the applicants before the expiry of that period to ask them to extend the storage period of their Data or to request an update. If no response is received, the Joint Controller(s) will erase the Data collected.  The Data of Applicants collected for the Legal Purposes are stored for the period envisaged by specific legal obligations or by the applicable legislation.  The Data of Applicants collected for the Legitimate Interest Purposes are stored for two years after the end of the selection phase, taking account of the frequency of the availability of new positions within the Group of the Joint Controllers, or for a period of five years for purposes of defending legal claims of the Joint Controller. In any case, upon the expiry of the storage period, the Data will be erased or made anonymous. 9. What are the rights of the Data Subject? In relation to the above Data processing, the Data Subject may exercise, at any time and under the conditions and within the limits indicated in Articles 12 and 13 of the GDPR, the following rights: (i) Right of access (Art. 15 GDPR); (ii) Right of rectification of inaccurate Data and completion of incomplete Data (Art. 16 GDPR); (iii) Right of erasure (Art. 17 GDPR); (iv) Right to restriction of processing (Art. 18 GDPR); (v) If the processing is based upon consent or on the contract and is carried out using automated tools, the right to receive the personal data in a structured, commonly used and machine-readable format, as well as, if technically feasible, to transmit them to another controller without impediments in accordance with Art. 20 GDPR; (vi) Right to object to processing carried out in accordance with Art. 6, paragraph 1, letters e) or f) GDPR (Art. 21 GDPR); The data subject will also have the right to lodge a complaint with the competent Supervisory Authority (Guarantor for the Protection of Personal Data in Italy) at the contact details indicated on the website www.garanteprivacy.it if the presuppositions are in place (Art. 77 GDPR). Applicants can exercise their rights by writing to the email address of the DPO indicated in point 1 and/or to each Joint Controller which can be contacted at the following email address privacy@poltronafraugroup.com 10. Amendments and updates This Privacy Policy is valid from the effective date. The Joint Controllers may, however, make changes and/or additions to this Privacy Policy, including as a result of any subsequent regulatory changes and/or additions. The changes will be published on the Website; Applicants are therefore asked to monitor the same to take note of the most recent and updated version of the Privacy Policy. 5