Customer and supplier information

CLIENTS/SUPPLIERS PRIVACY NOTICE PURSUANT TO ARTICLE 13 OF REGULATION (EU)

2016/679 (“GDPR”)

Dear Sirs, we wish to inform you that Regulation (EU) 2016/679 (the GDPR) provides for the protection of individuals in relation to the processing of personal data.

In accordance with the mentioned law, this processing will be based on the principles of fairness, lawfulness, and transparency, safeguarding your privacy and your rights.

Pursuant to Article 13 of the aforementioned Regulation, we hereby provide the following information.

PROCESSED PERSONAL DATA, SOURCE OF DATA, PURPOSE OF DATA PROCESSING, LEGAL BASIS OF PROCESSING AND RETENTION PERIOD

By “Data” we mean data related to individuals processed by Nastrotex-Cufra S.p.A. for the conclusion and execution of the contractual relationship with its clients/suppliers, such as, for example, data of the legal representative of the client/supplier signing the contract on behalf of the latter, data of the employees/consultants of the client/supplier involved in the activities specified in the contract, data of the companies in the client/supplier group for which the latter signs the contract with the necessary powers of representation, as well as any other information necessary for the execution of the contract and/or the provision of the service(s) (also referred to hereinafter).

The source of the Data is the client/supplier.

In particular, these Data will be processed for the following purposes:

A. Management of the contractual/commercial relationship, such as: fulfilling specific requests from the data subject before the conclusion of the contract; conclusion, amendments, execution of the contract; provision and management of related services; handling complaints.

The legal basis for processing is:

– Execution of the contract for the Data of the legal representative of the client/supplier

– Legitimate interest for the Data of the employees/consultants of the client/supplier involved in the activities specified in the contract.

Retention period of the Data: contractual duration and, after termination, for an additional 10 years. In case of judicial dispute, for the entire duration of the dispute, until the expiration of the appeal terms.

B. Administrative – accounting purposes, such as: invoicing; management of payments, delays, and non-payments; communication of such Data between group companies, for organizational, administrative, financial, and accounting purposes related to the aforementioned activities.

The legal basis for processing is the necessity to comply with a legal obligation to which Nastrotex-Cufra S.p.A. is subject.

C. Compliance with obligations or exercise of rights under national or European Union law or collective agreements in accordance with national law, such as compliance with obligations under community and national regulations, particularly laws, regulations, including emergency provisions for the protection of public order, the investigation and repression of crimes.

The legal basis for processing is the necessity to comply with a legal obligation to which the data controller is subject.

Via S. Statale Soncinese, 2 – 24050 Covo (BG) – Italy

Tel. +39 0363 938167 – Fax +39 0363 93798 – www.nastrotex‐cufra.it – email: info@nastrotex‐cufra.it

P.IVA 01613040169 ‐ Cap. Soc. € 1.000.000,00 – R.E.A BG n. 223374

D. Out-of-court credit recovery (for clients), such as: protection and potential recovery of credit, directly or through third parties (collection agencies/credit recovery companies), to whom the data will only be communicated for this purpose.

The legal basis for processing is legitimate interest.

E. If necessary, to ascertain, exercise and/or defend rights in judicial proceedings.

The legal basis for processing is legitimate interest.

F. Commercial/promotional communications, such as, by way of example, sending promotional/commercial communications, offers upon request from the client/supplier, and invitations to fairs, via email contact.

The use of the email contact details of employees/collaborators of clients/suppliers provided in the context of the sale of a product or service for direct sales of similar products or services is permitted for sending information and offers.

The legal basis for processing is the execution of pre-contractual measures upon request from the data subject.

Retention period of the Data: the reference data (personal and contact details) of clients/suppliers will be retained until a request for opposition to communications is made, for a maximum period of 5 years.

G. Security, pursuant to Legislative Decree 81/2008. With particular reference to the identification data voluntarily provided by the guest/visitor at our premises (name, surname, company or entity), the processing has the sole purpose of ensuring compliance with the company’s security procedures formally applied, also in compliance with current legal provisions (e.g., registration in the visitor log/database, assignment of temporary identification badges, compliance with legal obligations related to workplace safety).

The legal basis for processing: necessity to comply with legal obligations to which the data controller is subject.

Retention period of the Data: the data will be retained for the period required by law.

After the retention periods mentioned above, the Data will be destroyed or anonymized, in line with the technical procedures for deletion and backup.

SCOPE OF COMMUNICATION, AUTHORIZED PERSONS FOR PROCESSING

The Data may be communicated to external entities acting as data controllers, such as public authorities and bodies of supervision and control, and in general to public or private entities authorized to request the Data (e.g., banks and credit institutions; public administrations and other public authorities).

The Data may be processed, on behalf of the controller, by external entities designated as data processors, who perform specific activities on behalf of the controller, such as the distribution network, companies and agents performing credit recovery activities for the controller, legal, fiscal, and administrative consultants.

The Data may be processed by employees of the corporate functions responsible for achieving the purposes mentioned above, who have been expressly authorized for processing and have received adequate operational instructions. The Data will not be subject to dissemination.

PROVISION OF DATA

The provision of Data by the client/supplier is optional, but the refusal to provide such Data may result in the non-fulfillment or partial fulfillment of the contract/service.

Via S. Statale Soncinese, 2 – 24050 Covo (BG) – Italy

Tel. +39 0363 938167 – Fax +39 0363 93798 – www.nastrotex‐cufra.it – email: info@nastrotex‐cufra.it

P.IVA 01613040169 ‐ Cap. Soc. € 1.000.000,00 – R.E.A BG n. 223374

DATA CONTROLLER AND PROCESSORS

The Data Controller is Nastrotex-Cufra S.p.A., with registered office in Covo (BG) Via S.S. Soncinese, 2.

An updated list of the Data Processors is available at the Data Controller’s legal office.

RIGHTS OF THE DATA SUBJECT

By contacting Nastrotex-Cufra S.p.A. via email at privacy@nastrotex-cufra.it, the data subject may request access to the Data concerning them, the correction of inaccurate Data, the integration of incomplete Data, the deletion of the Data, the limitation of processing, as well as the portability of the Data.

The data subject has the right to object, in whole or in part, to the processing of the Data, for legitimate reasons, including for profiling purposes. The data subject also has the right to withdraw consent for processing.

If the data subject believes that their rights under the GDPR have been violated, they have the right to lodge a complaint with the Data Protection Authority.

CHANGES TO THIS PRIVACY NOTICE

This Privacy Notice may be modified. In case of changes, a new version of the document will be provided.