Personal data protection policy statement

Dear Sir, Dear Madam,

GRUPPO PIAZZETTA S.p.a., with its registered office in Asolo (TV), Via Montello, 22, as data controller of the processing of your personal data (hereinafter the “Company”), provides you with this policy statement in accordance with European and Italian personal data protection legislation.

The Company has appointed a data protection officer (DPO), whom you may contact by writing to the address dpo@gruppopiazzetta.com.

Purposes and legal basis for processing

The Data Controller shall process your personal data for the following purposes:

1. to respond to your specific requests;
2. only with your specific, distinct consent, to send you, including by automated means, advertising and communications materials of an informational and/or promotional nature regarding products or services provided and/or promoted by the Data Controller (hereinafter “Promotional Purposes”).

The legal basis for the processing of the data relating to the purposes indicated in point A) is the performance of a contract or the implementation of precontractual measures. The legal basis of the processing of the data relating to the purposes set out in point B) is consent.

Data storage period

Your personal data will be processed:

• For the purposes indicated in point A), for the time strictly necessary to the pursuit of the purpose concerned, and for a period not to exceed 24 months;
• for the Promotional Purposes set out in point B), for 24 months from the last disclosure. After this period comes to an end, your data will be deleted, unless you withdraw your consent beforehand.

Nature of providing the data and consequences in the case of refusal

Providing the data is:

• necessary for the purposes indicated in point A), for all matters relating to the technical assistance request. Accordingly, your refusal to provide your data to us, in whole or in part, might render it impossible for our Company to fulfil your assistance request for information;
• optional for the purposes indicated in point E). Accordingly, the Data Subject may decide not to provide any data or subsequently to deny consent to processing of data already provided; in this case, the Data Subject will not be able to receive the communications described above.

Categories of recipients

With regard to the purposes specified in points A), B), C), D) and E) above, all the data collected and processed will be disclosed to internal figures authorised to process it according to their respective duties, and also to the following external categories:

• agencies/companies involved in marketing activities;
• sales agents/sales force;
• credit institutes;
• lawyers and legal advisors;
• public and private entities, also following inspections and audits;
• website providers, cloud providers, suppliers, hardware and software assistance technicians, etc.;
• companies or other third parties that perform activities on an outsourced basis.

If said recipients process the data on our behalf, they will be appointed as data processors, through a specific contract or legal document.

Transfer of personal data to third countries and/or international organisations

Your personal data will not be transferred to non-European third countries.

Rights of data subjects

The Data Subject is entitled to request that the Data Controller grant access to the personal data and rectify it if it is incorrect, delete it or limit its processing where the requirements have been met, to object to its processing for legitimate interests pursued by the Data Controller and to obtain the portability of the data personally supplied, but only if it has been subject to automated processing based on consent or a contract.

The Data Subject is also entitled to withdraw consent given for the processing purposes that require it, without affecting the lawfulness of processing based on consent before its withdrawal.

Finally, the Data Subject is also entitled to file a complaint with the Italian Personal Data Protection Authority (www.garanteprivacy.it).