EU Regulation No. 2016/679 (hereinafter, “GDPR”)
INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

Subject of the Processing

1. Irritec S.p.A. processes personal and identifying data (for example, first name, last name, company name, address, telephone number, e-mail, bank and payment details) – hereinafter, “personal data” or also “data”) communicated by you in any manner.

2. Purposes of the Processing

Your personal data is processed:

1. Without your express consent (Art. 6 letters b), e) GDPR), for the following Service Purposes:
   1. to conclude contracts for goods and services provided by Irritec S.p.A.;
   2. to fulfill pre-contractual, contractual, and tax obligations arising from existing relationships with you;
   3. to fulfill obligations provided for by law, regulations, EU legislation, or orders of Authorities (for example, anti-money laundering regulations);
   4. to exercise the rights of Irritec S.p.A., such as the right of defense in legal proceedings.
2. Only with your specific and separate consent (Art. 7 GDPR), for the following Marketing Purposes:
   1. to send you, via e-mail, post and/or SMS and/or telephone contacts, newsletters, commercial communications and/or advertising material regarding products or services offered by the Data Controller, and to measure satisfaction with the quality of services;
   2. to send you, via e-mail, post and/or SMS and/or telephone contacts, commercial and/or promotional communications from third parties (for example, service providers, business partners, other companies within the Group).

Please note that, if you are already our customer, we may send you commercial communications relating to services and products of the Data Controller similar to those you have already used, unless you object.

3. Methods of Processing

The processing of your personal data is carried out by means of the operations indicated in Art. 4(2) GDPR, namely: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure, and destruction of data. Your personal data is processed both in paper form and electronically and/or through automated means. For each of the processing purposes listed above, the table below specifies the maximum retention period of your personal data, after which we will no longer process your data for the aforementioned purposes.

At the end of the processing period, your data will be deleted or destroyed.

4. Access to data

Your data may be made accessible for the purposes referred to in Art. 2.A) (contractual obligations) and 2.B) (advertising communications):

• to employees and collaborators of the Data Controller or Group companies in Italy and abroad, in their capacity as persons in charge of processing and/or internal data processors and/or system administrators;
• to third-party companies or other entities (by way of example, banks, professional firms, consultants, etc.) that perform outsourced activities on behalf of the Data Controller, in their capacity as external data processors;
• to third-party companies that have entered into specific Joint Controllership Agreements with Irritec S.p.A.

4.1 Joint Controllership Agreements
Pursuant to Art. 26 GDPR, Irritec S.p.A. has entered into joint controllership agreements for the processing of collected personal data. The purposes and means of processing have been jointly determined in individual contracts signed between the parties. A summary of the content of the agreements is provided below:

5. Communication of Data

Without the need for express consent (Art. 6 letters b) and c) GDPR), Irritec S.p.A. may communicate your data for the purposes referred to in Art. 2.A) to supervisory bodies, judicial authorities, as well as to those entities to whom communication is mandatory by law for the fulfillment of such purposes. These entities will process the data as independent data controllers. Your data will not be disclosed.

6. Data Transfer

Personal data is stored on servers located in Italy, within the European Union (EU). It is understood, however, that the Data Controller, if necessary, may transfer the servers outside the EU. In such cases, Irritec S.p.A. ensures that the transfer of data outside the EU will take place in compliance with applicable legal provisions, subject to the execution of the standard contractual clauses provided by the European Commission.

7. Nature of Data Provision and Consequences of Refusal

The provision of data for the purposes referred to in Art. 2.A) is mandatory. Without such data, we will not be able to provide the Services referred to in Art. 2.A).

The provision of data for the purposes referred to in Art. 2.B) is optional. Consent may be given by signing a specific information notice. You may therefore decide not to provide any data or subsequently withdraw consent for data already provided. In such cases, you will not receive newsletters, commercial communications, or advertising material relating to products and services offered by Irritec S.p.A. You will, however, continue to be entitled to the Services referred to in Art. 2.A).

8. Rights of the Data Subject

In your capacity as a data subject, you have the rights referred to in Art. 15 GDPR, including the right to:

• obtain confirmation as to whether or not personal data concerning you exists, even if not yet recorded, and their communication in an intelligible form;
• obtain information on:

1. the origin of the personal data;
2. the purposes and methods of processing;
3. the logic applied in the case of processing carried out with the aid of electronic tools;
4. the identification details of the data controller, data processors, and the representative designated pursuant to Art. 3(1) GDPR;
5. the entities or categories of entities to whom the personal data may be communicated or who may become aware of them as designated representatives, processors, or persons in charge;

• obtain:
  1. updating, rectification, or, where relevant, integration of the data;
  2. erasure, anonymization, or blocking of data processed unlawfully, including data whose retention is not necessary for the purposes for which they were collected or subsequently processed;
  3. confirmation that the operations described above have been notified, including their content, to those to whom the data were communicated or disclosed, unless this proves impossible or involves a manifestly disproportionate effort;
• object, in whole or in part:
  1. on legitimate grounds, to the processing of personal data concerning you, even if relevant to the purpose of collection;
  2. for legitimate reasons, to the processing of personal data concerning you, even if relevant to the purpose of the collection; to the processing of personal data concerning you for the purposes of sending advertising material or direct sales, or for carrying out market research or commercial communication, by means of automated calling systems without the intervention of an operator, by e-mail and/or by means of traditional marketing methods such as telephone and/or paper mail. Please note that the data subject’s right to object, as set out in point (b) above, to direct marketing carried out through automated means also extends to traditional methods, and that the data subject retains the right to exercise the right to object even only in part. Therefore, the data subject may decide to receive communications only through traditional methods, or only through automated methods, or through neither type of communication.

Where applicable, you also have the rights set out in Arts. 16–21 GDPR (right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Supervisory Authority.

9. Methods of Exercising Rights

You may exercise your rights at any time by sending:

• an e-mail to privacy@irritec.com.

In the event of such requests or any complaints regarding the processing of your personal data, you may also send an e-mail to privacy@irritec.com.