concerning the Processing of Personal Data In accordance with Article 13 of the General Data Protection Regulation – EU Regulation 2016/679 (“Regolamento”) (“Privacy Policy”)

1. Personal Data Processed
1.1    For the negotiation, establishment, management and performance of the contractual relationship with the supplier and/or customer, the Company/data controller processes personal data relating to the supplier and/or customer, and in particular those of individuals connected to them. This includes: full name, position held, contact details (telephone, e-mail, physical address), and potentially other data necessary for managing the relationship with the supplier and/or customer, also for tax purposes. Each party with whom the Company/data controller has dealings declares that they are authorised or empowered to lawfully provide personal data necessary for the establishment, management and performance of the contract in place between the Company/data controller and supplier and/or customer. This includes both their own personal data and that of other individuals connected to the supplier and/or customer.

2. Special Categories of Personal Data
2.1    For the negotiation, establishment and management of the contractual relationship with the supplier and/or customer, the Company/data controller does not process special categories of data (i.e. those concerning religious beliefs, trade-union membership, sexual orientation and the others indicated in Article 9 of the Regulation – or data relating to criminal convictions and offences referred to in Article 10 of the Regulation). Should the processing of such categories of personal data become necessary, we will request prior consent from the data subject.

3. Purpose of the Processing and Lawfulness
3.1    The Company/data controller, in compliance with the principles of fairness, lawfulness and transparency, may collect personal data for the management of the relationship with the supplier and/or customer, during the pre-contractual and contractual phases, for the purposes and on the lawful basis set out below.

PURPOSE	LAWFUL BASIS
Management and performance of pre-contractual and contractual obligations arising from the contract with the supplier and/or customer, including but not limited to the management of records of individuals and contacts for the establishment of orders and other commercial agreements.	Processing permitted as necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract – Article 6(1)(b) of the Regulation.
Compliance with legal obligations (such as the processing and storage of accounting documents, e.g. invoices, relating to the relationship with the supplier and/or customer, as well as communications and other obligations the Company/data controller is required to fulfil under national and international legislation, including, for example, tax, accounting and anti-money laundering regulations).	Processing permitted as necessary for compliance with a legal obligation to which the data controller is subject – Article 6(1)(c) of the Regulation.
Direct marketing through the sending of communications or materials (e.g. by e-mail or newsletter) relating to products/services similar to those already provided by the Company/data controller to the customer, or other updates of relevance concerning the Company/data controller’s activities.	Processing permitted as necessary for the purposes of the legitimate interests pursued by the data controller – Article 6(1)(f) of the Regulation. The legitimate interest of the data controller lies in the promotion of its business through direct marketing, as well as in the proper and complete performance of its services for its customers – see Recital 47 of the Regulation.

4. Mandatory or Optional Nature of the Processing
4.1    The provision of personal data by the supplier and/or customer, and of the individuals connected to them, is necessary for the establishment, management and performance of the contractual relationship with the Company/data controller. Any refusal to provide such data, in whole or in part, may result in the Company/data controller being unable to enter into or perform the contract, or to properly meet all related obligations.
4.2    The provision of personal data by the supplier and/or by the individuals connected to them for the purposes set out in point 3.1.c. is optional. The customer/supplier may request the cessation of processing as described in point 3.1.c., without this affecting the Company/data controller’s ability to establish or perform the contract, or correctly fulfil all the related obligations.

5. Categories of Recipients
5.1    Personal data may be disclosed, strictly in relation to the purposes set out above, to the following parties or categories of parties:

• Individuals authorised in writing by the Company/data controller pursuant to Article 29 of the Regulation, for the performance of their work duties (e.g. employees with administrative, commercial or technical support roles, etc.).
• Professionals and service companies for the administration and management of the Company/data controller, acting on behalf of the Company/data controller for its internal purposes (e.g. accounting firms, consultants).
• Parties, entities or authorities to whom the communication of personal data is mandatory under legal provisions and orders of the Authorities.
• Other external collaborators or consultants (e.g. legal advisors).
• Customers and/or suppliers of the Company/data controller, where necessary for the performance of contracts in place.

5.2    With regard to point 5.1(b) and (d), the Company/data controller undertakes to use parties that provide adequate guarantees regarding data protection, appointing them, where possible, as processors as provided for in Article 28 of the Regulation.

6. Data Transfer
6.1     Personal data may be transferred, or otherwise made accessible, outside the European Union as a result of the data controller’s use of IT systems involving infrastructures located in countries outside the European Economic Area, or accessible from such countries.
6.2     In all cases of transfers of personal data outside the European Union, the Company/data controller undertakes to select providers that guarantee a high standard of professionalism and compliance with the Regulation.

7. Processing Methods
7.1     Personal data are held in the Company/data controller’s records and processed using both paper and electronic means, with appropriate security measures in place to prevent unauthorised or unlawful processing.
7.2     Processing is based on the principles of minimisation, fairness and transparency. Only personal data necessary for the described purposes will be processed. Within the organisation of the Company/data controller, access to such data will be limited to individuals involved in activities necessary to achieve those purposes.

8. Retention Period for Personal Data
8.1    Personal data are stored for the duration of the contractual relationship with the supplier and/or customer, and thereafter for a period of 10 years following the termination of that relationship. This retention period reflects statutory requirements for accounting record-keeping and the limitation period for any claims arising from the business relationship, as established by law.
8.2    In the event of disputes between the Company/data controller and the supplier and/or customer, the retention period shall be extended for the duration of such disputes and for 10 years following their definitive resolution (e.g. settlement agreement or final judgment).

9. Rights of the Data Subject
9.1    Each data subject may at any time exercise their rights under Articles 15 to 22 of the Regulation against the Company/data controller, and in particular the right to request:

• Access to personal data, meaning the right to obtain information about the personal data concerning them retained by the Company/data controller, the purposes for which such data are processed, their source, and the other information set out in Article 15 of the Regulation.
• Rectification of personal data in the event of inaccuracy.
• Erasure of personal data (“right to be forgotten”).
• Restriction of processing of personal data, meaning the right to obtain the suspension of personal data processing for the time necessary to verify the request for the rectification of personal data, or in the other cases provided for in Article 18 of the Regulation.

In addition, each data subject has:

• The right to data portability, meaning the right to receive personal data concerning them in a structured, commonly used and machine-readable format, and to request the direct transmission of such data to another data controller (for data processed by automated means).
• The right to lodge a complaint with the Data Protection Authority, or with the Supervisory Authority in the place of residence, workplace, or where the alleged infringement occurred, if they believe that the processing of personal data has occurred in breach of the Regulation.
• The right to object to the processing of data pursuant to Article 6(1)(e) or (f) of the Regulation, that is, when the processing is necessary for the performance of a task carried out in the public interest or for the purposes of the legitimate interests pursued by the data controller.

9.2 Requests must be addressed in writing to the Company/data controller using the contact details provided below.
10. Data Controller
10.1 The data controller is Cielo e Terra S.p.A., with registered office at Via IV Novembre 39, 36050 Montorso Vicentino (VI), Italy. Requests for clarification regarding this policy and requests to exercise the rights established by law and/or described herein may be submitted to the following contacts: Tel. +39 0444 485211 – E-mail privacy@cieloeterravini.com.