Privacy Notice on the Processing of Personal Data

This Privacy Notice applies to: individual customers; natural persons acting as business, administrative or purchasing contacts or representatives of corporate customers or business counterparties; individual business introducers; individual customers and natural persons acting as contacts of corporate customers who receive promotional communications from the Data Controller where permitted by applicable law.

We may process: identification and contact data (first name, surname, address, e-mail address, telephone number); data relating to the commercial or contractual relationship (orders, purchases, deliveries, shipments, invoices, payments); administrative, accounting and tax data; and, for business partners, data relating to the contract, commissions, invoicing and payments. Where permitted by applicable law, we may also process the e-mail address provided in connection with the sale of a product or service, as well as the data strictly necessary to manage the sending of communications concerning the Data Controller's own products or services similar to those already purchased, including data relating to objections, unsubscribing and the management of related requests. For the purposes described in this Privacy Notice, we do not process special categories of personal data.

A. Individual customers

We process personal data for:

• handling requests, orders, sales and the contractual relationship; legal basis: performance of a contract or steps taken at the request of the data subject prior to entering into a contract.
• administrative, accounting and tax obligations; legal basis: compliance with legal obligations.

B. Contacts of corporate customers or business partners

We process personal data for:

• managing the commercial relationship with the organisation to which the contact belongs; legal basis: the Data Controller's legitimate interest in managing the B2B relationship.
• administrative and organisational activities connected with the commercial relationship; legal basis: the Data Controller's legitimate interest and, where applicable, compliance with legal obligations.

C. Individual business partners

We process personal data for:

• entering into, performing and managing the partnership agreement; legal basis: performance of the contract.
• administrative, accounting, tax and payment management; legal basis: compliance with legal and contractual obligations.

D. Sending promotional e-mails concerning similar products or services (soft spam)

Where permitted by applicable law, we process the e-mail address provided by the data subject in connection with the sale of a product or service in order to send communications concerning the direct sale of the Data Controller's own products or services similar to those already purchased.

In such cases, consent is not required, provided that the data subject is properly informed and does not refuse such use either initially or when receiving subsequent communications, and may object at any time easily and free of charge. This processing concerns only communications sent by e-mail and does not extend to other automated communication channels. The operational activities involved in preparing and sending such communications may be carried out, on behalf of the Data Controller, by Roger & Goffigon Inc., appointed as a data processor pursuant to Article 28 GDPR, solely on the basis of the Data Controller's instructions.

Providing the personal data necessary for contractual, administrative and tax purposes is required. If such data are not provided, we may be unable to establish or manage the contractual relationship or comply with legal obligations.

Providing an e-mail address in connection with a sale is normally necessary for managing the commercial relationship; however, its use for sending promotional communications under Section D remains subject to the data subject's right to object from the outset and at any later time, easily and free of charge.

As a rule, directly from the data subject.

For contacts of corporate customers, also from the organisation to which they belong, colleagues within the same organisation, or professional sources used in the context of the commercial relationship, within the limits of Article 14 GDPR.

For the communications referred to in Section D, the e-mail address is used only if it was obtained in connection with the sale of a product or service of the Data Controller.

Personal data may be disclosed to: personnel authorised by the Data Controller; administrative, accounting, tax, legal and IT advisers; banks, couriers, freight forwarders and providers of administrative or IT services; Roger & Goffigon Inc., the parent company in the United States, appointed as a data processor pursuant to Article 28 GDPR, including for carrying out, on behalf of the Data Controller and on the basis of its documented instructions, operational activities supporting the management and sending of promotional e-mails within the limits described in Section D.

For administrative, management, document, IT support and, where applicable, operational management of the sending of promotional e-mails within the limits described in Section D, certain personal data may be transferred to Roger & Goffigon Inc. in the United States, appointed as a data processor.

The transfer takes place in compliance with Chapter V GDPR and on the basis of the Standard Contractual Clauses adopted by the European Commission pursuant to Article 46 GDPR. A copy of the safeguards adopted may be requested using the contact details indicated above.

Personal data are retained: for the entire duration of the contractual or commercial relationship; thereafter, for the period necessary to comply with administrative, accounting and tax obligations or to protect the Data Controller's rights; the personal data of B2B contacts are retained for as long as the contact remains relevant to the commercial relationship and, in any event, only for the period strictly necessary to manage that relationship. Personal data processed for the purposes referred to in Section D are retained for the period strictly necessary to manage that purpose and, in any event, until the data subject objects, without prejudice to the data strictly necessary to document and respect that choice.

Where provided for by the GDPR, the data subject may request from the Data Controller: access to personal data; rectification; erasure; restriction of processing; objection, where applicable; data portability, where applicable; and may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali). Where personal data are processed for direct marketing purposes, the data subject has the right to object to such processing at any time and free of charge; if the data subject objects, the personal data will no longer be processed for those purposes.

Consent is not required for the processing activities described in Sections A, B and C of this Privacy Notice, because the processing is based, as applicable, on the performance of a contract, compliance with legal obligations or the Data Controller's legitimate interest.

For the processing described in Section D, concerning the sending by e-mail of promotional communications about the Data Controller's own products or services similar to those already purchased, consent is not required only within the limits and under the conditions set out in Article 130(4) of Italian Legislative Decree No. 196/2003. The data subject retains the right to object either initially or when receiving any subsequent communication, easily and free of charge.

For any further or different promotional activities beyond those described in Section D, the Data Controller will, where necessary, request specific consent through a separate privacy notice.

Consent is not the legal basis for transfers of personal data to the United States, which take place on the basis of the appropriate safeguards referred to in Article 46 GDPR.

Personal data are not subject to automated decision-making or profiling for the purposes set out in this Privacy Notice.