Privacy notice for website browsing and cookies - Articles 12 and following of Regulation (EU) 2016/679 (GDPR)

Foreword

In compliance with Regulation (EU) 2016/679 (hereinafter GDPR), we provide the following information regarding the processing of personal data provided by the data subject, in relation to the relationships with the companies of the Zucchetti Group, which includes Zucchetti Spa and the companies controlled, affiliated, or owned by this company, as well as the companies controlling it (hereinafter the Companies). This notice is provided pursuant to Article 13 of the GDPR.

1. Identity and contact details

With regard to the various areas in which the processing will be carried out for the purposes of this notice, the Companies may act as Data Controller pursuant to Article 4 of the GDPR or as Joint Data Controllers pursuant to Article 26 of the GDPR.

The list of Joint Data Controllers can be found at the following links ( httPS://www.zucchetti.it/website/cms/group-companies.html / httPS://www.zucchetti.it/website/cms/zucchetti-about-us.html) , and the joint controller agreement is available upon request from the data subject, who can send an email to ufficio.privacy@zucchetti.it.

The Companies can be contacted at the following contact details: Piazza Mino Zucchetti n. 1 - 26900 Lodi (LO), tel: 0039 0371/5941; email: ufficio.privacy@zucchetti.it.

2. Contact details of the Data Protection Officer (DPO)

The Data Protection Officer for the companies of the Group that have made the designation is Dr. Mario Brocca, phone: 0039 0371/5943191, email: dpo@zucchetti.it; certified email (PEC): dpogruppozucchetti@gruppozucchetti.it.

For any other designations of Data Protection Officers related to the Companies, further clarifications can be requested at the email address ufficio.privacy@zucchetti.it.

3. Purposes of the processing for which the personal data are intended

For all website users, personal data may be used for:

- Enabling navigation through the public web pages of the website;

- Responding to requests received through the email addresses published on the website;

- Gathering anonymous statistical information on the use of the website (e.g., analysis of the most visited pages);

- Gathering anonymous statistical information on the geographical areas of origin;

- Monitoring the proper functioning of the website;

- Verifying any liabilities in case of unlawful activities committed against the website.

Personal data of users who register on the website will be processed, in addition to the purposes described above, for purposes related to the services requested, and specifically for:

- Requesting information about the products and services of the Companies;

- Viewing informational material and product/service demos of the Companies;

- Enabling navigation through the restricted web pages of the website;

- Registering users for the requested service;

- Fulfilling the contractual obligations of the requested service, where applicable;

- Sending technical communications and/or those related to the management and provision of the requested services;

- Marketing and remarketing purposes;

- Sending advertising and promotional information via email;

- Direct sales through the web.

4. Cookies

It is hereby informed that by browsing the website, technical cookies will be downloaded, namely:

- Session cookies used to 'fill the shopping cart' in online purchases; authentication cookies; cookies for multimedia content such as Flash Player that do not exceed the duration of the session; personalization cookies (e.g., for selecting the navigation language), etc.;

- Cookies (so-called 'analytics') used to statistically analyze website accesses/visits, which are pursued exclusively for statistical purposes and collect information in an aggregated form.

Statistical and profiling cookies, including third-party cookies, are also present, to which users may be redirected during navigation.

The complete and updated list of cookie types is available in the banner of the tool for detecting and managing them.

5. Legal basis for the processing

This website processes data based on consent. By using or consulting this website, the data subject implicitly consents to the storage of only those cookies strictly necessary (hereinafter 'technical cookies') for the operation of the site. For other types of cookies, consent can be given or denied through the appropriate flags in the banner that appears when the site is opened.

Specifically regarding the commercial banners managed by Google Ads, it is specified that consent can be denied directly within the banner in the marketing and/or statistics section.

6. Retention period of your data

Like all websites, this site also uses log files, where information collected automatically during user visits is stored. The information collected may include the following:

Internet Protocol (IP) address;

Type of browser and device parameters used to connect to the site;

nome dell'internet service provider (ISP);

Date and time of visit.

Visitor's referral and exit webpage.

Possibly the number of clicks.

The aforementioned information is processed automatically and collected in order to verify the proper functioning of the site, for statistical purposes, and for security reasons.

For security purposes (spam filters, firewalls, virus detection), the data automatically recorded may also include personal data such as the IP address, which could be used, in compliance with current laws, to block attempts to damage the site or harm other users, or to prevent harmful activities or criminal offenses. Such data is never used for user identification or profiling but only for the protection of the site and its users.

The computer systems and software procedures responsible for the operation of this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's response (success, error, etc.), and other parameters related to the user's operating system and computing environment.

Apart from the navigation data specified above, the user is free to provide additional personal data beyond those previously mentioned by registering on the site.

Failure to provide personal data may result in the inability to obtain the requested information, the inability to provide certain services, and the browsing experience on the website may be compromised.

Finally, by accessing the site, anonymous data will be recorded in order to understand the user's experience.

The companies specify that they do not collect any sensitive data from the individuals concerned.

7. Personal data collected and the mandatory or optional nature of providing the data, as well as the consequences of any refusal

Like all websites, this site also uses log files, where information collected automatically during users' visits is stored. The information collected may include the following:

• Internet Protocol address (IP);
• Type of browser and device parameters used to connect to the site;
• Name of the Internet Service Provider (ISP);
• Date and time of visit;
• Referring webpage and exit webpage;
• Possibly the number of clicks.

The aforementioned information is processed automatically and collected to verify the proper functioning of the site, for statistical purposes, and for security reasons.

For security purposes (spam filters, firewalls, virus detection), the data automatically recorded may also include personal data such as the IP address, which may be used, in accordance with applicable laws, to block attempts to damage the site or harm other users, or to prevent harmful activities or criminal acts. Such data is never used for user identification or profiling, but solely for the protection of the site and its users.

The computer systems and software procedures responsible for the operation of this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's response (success, error, etc.), and other parameters related to the user's operating system and computing environment.

Aside from the navigation data specified above, the user is free to provide additional personal data beyond those previously mentioned by registering on the site.

Failure to provide personal data may result in the inability to obtain the requested services, the inability to deliver certain services, and the browsing experience on the website may be compromised.

Finally, by accessing the site, anonymous data will be recorded in order to understand the user's experience.

The companies specify that they do not collect any sensitive data from the individuals concerned.

8. Methods of processing

According to and for the purposes of Articles 12 and following of the GDPR, the personal data of the individuals concerned will be recorded, processed, and stored in the electronic archives of the Companies, adopting technical and organizational measures aimed at protecting the data itself. The processing of personal data of the individuals concerned may consist of any operation or set of operations listed in Article 4, paragraph 1, point 2 of the GDPR.

The processing of personal data will be carried out using tools and procedures suitable to ensure their security and confidentiality, and may be performed directly and/or through third parties delegated with the assistance of computer or electronic means.

9. Scope of knowledge of your data

The data of the concerned individual may be processed by employees of the Company departments responsible for pursuing the above-mentioned purposes. These employees have been expressly authorized to process the data and have received appropriate operational instructions in accordance with and for the purposes of Article 29 of the GDPR.

The data may also be communicated by the Companies to:

• Zucchetti Group companies;
• Commercial Partners;
• Consulting companies
• Zucchetti Academy offices
• Providers of fiduciary services offered by Zucchetti.

10. Communication and dissemination

The personal data of the individual, provided through registration, may be communicated, with this term meaning making the data known to one or more specific subjects, by the Companies to third parties in order to fulfill all necessary legal and/or contractual obligations. In particular, the personal data of the individual may be communicated to Public Entities, Offices, or supervisory authorities in compliance with legal and/or contractual obligations.

The personal data of the individual may be communicated under the following terms:

- to subjects who can access the data by virtue of laws, regulations, or community regulations, within the limits provided by such rules;

- to subjects who need to access the data for purposes auxiliary to the relationship between the individual and the Companies, within the limits strictly necessary to carry out the auxiliary tasks;

- to consultants and/or professionals, to the extent necessary to carry out their assignment at the Companies and their organization, following an engagement letter from the Companies that imposes confidentiality and security duties.

Dissemination - The Companies will not indiscriminately disseminate the personal data of the individual nor make it known to unspecified subjects, even through making it available or allowing consultation.

Trust and confidentiality - The Companies consider the trust demonstrated by the individuals who have consented to the processing of their personal data to be valuable, and therefore, they commit to not selling, renting, or leasing personal information to others.

11. Transfer of data to non-EU countries

The data provided by the individual will be processed only in countries within the European Union. If the personal data of the individual are processed in a non-EU country, the rights granted to the individual by community legislation will be ensured, and the individual will be promptly informed.

12. How to disable Cookies

Most browsers (Internet Explorer, Firefox, Chrome, etc.) are configured to accept cookies. The cookies stored on your device's hard drive can, however, be deleted, and it is also possible to disable cookies by following the instructions provided by the main browsers at the following links:

Chrome httPS://support.google.com/chrome/answer/95647?hl=it

Firefox http://support.mozilla.org/it/kb/Eliminare%20i%20cookie

Internet Explorer

Opera

Safari httPS://support.apple.com/it-it/HT201265

13. The rights of the data subject

Pursuant to Articles 15 et seq. of the GDPR, the data subject may exercise the following rights:

1. Access: confirmation or denial of whether personal data of the data subject is being processed and the right to access such data; requests that are manifestly unfounded, excessive, or repetitive cannot be answered.
2. Rectification: to correct or obtain the correction of personal data if they are incorrect or outdated, and to complete them if they are incomplete.
3. Erasure/Oblivion: to obtain, in certain cases, the deletion of personal data provided; this is not an absolute right, as companies may have legitimate or legal reasons to retain the data.
4. Restriction: the data will be stored but cannot be processed or further elaborated, in the cases provided by the regulation.
5. Portability: to move, copy, or transfer data from the companies' databases to third parties. This applies only to data provided by the data subject for the performance of a contract or for which explicit consent has been given, and the processing is carried out by automated means.
6. Opposition to direct marketing: the right to object to the processing of personal data for direct marketing purposes.
7. Withdrawal of consent at any time, when the processing is based on consent.

Pursuant to Article 2-undicies of Legislative Decree 196/2003, the exercise of the rights of the data subject may be delayed, limited, or excluded, with a motivated communication provided without delay, unless the communication could compromise the purpose of the limitation, for the time and to the extent necessary and proportionate, taking into account the fundamental rights and legitimate interests of the data subject, in order to safeguard the interests referred to in paragraph 1, letters a) (interests protected in anti-money laundering matters), e) (for the conduct of defensive investigations or the exercise of a right in judicial proceedings), and f) (the confidentiality of the identity of the employee reporting illicit activities they have come to know of due to their position). In such cases, the rights of the data subject may also be exercised through the Data Protection Authority, in the manner set out in Article 160 of the same Decree. In this case, the Authority will inform the data subject that it has carried out all necessary checks or conducted a review, as well as the data subject’s right to file a judicial appeal.

It is also specified that, before fulfilling the requests, the companies may verify the identity of the data subject in order to assess the legitimacy of the request received.

To exercise these rights, the data subject may contact the Data Controllers at the address ufficio.privacy@zucchetti.it or by calling the number 0039 0371/594.3191 or sending a letter to Privacy Office Zucchetti, Piazza Mino Zucchetti n. 1 - 26900 Lodi.

The companies will respond within 30 days from the receipt of the formal request sent by the data subject.

Please note that in the event of a personal data breach, the data subject may file a complaint with the competent authority: "Data Protection Authority".

The companies of the Zucchetti group