Information disclosed pursuant to Articles 13 and 14 of the GDPR (General Data Protection Regulation) 2016/679

We wish to inform you that, in order to establish and execute the existing contractual relationship with yourselves, our organisation is in possession of your data, including that acquired verbally, directly or through third-parties, classified as personal data by European Regulation 2016/679 by the (GDPR).

According to the regulations indicated, this data processing will be guided by the principles of fairness, lawfulness and transparency protecting your privacy and your rights.

Pursuant to Article 13 of the GDPR 2016/679, therefore, we are providing you with the following information:

Nature of the data processed: we handle your biographical, tax and financial data necessary for conducting contractual relations, at present or in the future, with your company, as well as in order to effectively manage business relations. The data is handled without your express consent Article 6, letter b, of the GDPR, only and exclusively for the following service purposes: complying with the pre-contractual, contractual and tax obligations resulting from existing relations with yourselves; complying with legally-required obligations, regulations, EU legislation or government orders; exercising the rights of the owner, for example the right of defence in legal proceedings. We are in possession of your data which can be classified as particular or of a legal nature (Articles 9 and 10 of the GDPR).

Purpose of the processing and duration: your data is processed for the entire duration of the contractual relationship and even later on, for contractual requirements associated with compliance with legal and tax obligations, and for the effective management of financial and commercial relations and transactions as indicated in Article 4, no. 2 of the GDPR. The data owner will process the personal data for the amount of time necessary to comply with the purposes outlined above and, in any event, for no longer than 10 years after relations have ceased for the service purposes.

Processing methods: the data will be processed using both manual and/or IT and computerised instruments using organisational and processing logics closely related to the actual purposes and, in any event, in order to guarantee the security, integrity and confidentiality of the data in compliance with the organisational, physical and logical measures laid down by the regulations in force.

Obligation or power to confer the data: as far as the data that we are required to be informed of is concerned, in order to comply with the legally-required obligations, failure by yourselves to provide this data will lead to the impossibility of establishing or continuing the relationship, insofar as this data is necessary for its execution.

Scope of awareness of your data: the following categories of persons may become aware of your data, in the capacity of data managers or processors, appointed by the undersigned company, data owners: executives, directors and auditors; internal registrar's offices; employees involved in book-keeping and invoicing; employees involved in marketing services; agents and representatives.

Communication and disclosure: your data will not be disclosed by ourselves to unknown parties by making it available or through consultation. Your data can be disclosed by ourselves, because it is respectively and specifically our responsibility, to entities and, in general, to any public or private body in relation to which there is an obligation on us (or right recognised by rule of law or secondary or EU legislation) or need to disclose it, as well as to consultants or ours, to the extent necessary to carry out their tasks at our organisation, following our letter of engagement which imposes the obligation of confidentiality and security.

Your rights: in your capacity as an interested party, you have the rights pursuant to Article 15 of the GDPR, namely the right to:

• i. obtain confirmation of the existence, or not, of the personal data involving yourself, even if they have not yet registered, and their communication in an intelligible format;
• ii. obtain details of:
  • a) the origin of the personal data;
  • b) the purpose and processing methods;
  • c) the logic applied in the case of processing carried out with the help of electronic instruments;
  • d) the identification details of the owner, the managers and the representative designated pursuant to Article 3, paragraph 1 of the GDPR;
  • e) the parties or categories of parties to which the personal data can be disclosed or which may become aware of it in the capacity of designated representative in the territory of the state, managers or representatives;
• iii. obtain:
  • a) the updating, the rectification in other words the integration of the data;
  • b) the deletion, conversion into an anonymous format or freezing of the data handled in violation of the law, including data which does not need to be stored in relation to the purposes for which it was collected or later handled;
  • c) confirmation that the operations in letters  a) and b) were brought to the attention of, also as far as their contents are concerned, those to whom the data was communicated or circulated, except in cases where this fulfilment is impossible or involves the use of means which are clearly out of proportion in relation to the right protected.
• iv. object, in whole or in part:
  • a) for legitimate reasons for processing personal data which concerns you, provided it is pertinent to the purpose of the collection;
  • b) for the processing of personal data which involves you for the purpose of sending advertising or direct marketing material or for conducting market research or business communication, through the use of automated calling systems, without the intervention of an operator by email and/or through traditional marketing methods via the telephone and/or paper-based mail.

Where applicable, you also have the rights pursuant to Articles 16-21 of the GDPR (right of reply, right to be forgotten, right to restriction of processing, right to data portability, right to object), as well as the right to complain to the Antitrust Authority. You can, at any time, get confirmation of whether or not personal data involving you exists and the disclosure of this data and the purpose on which the processing is based. In addition, you can obtain the deletion, conversion into an anonymous format or the suppression of data processed in violation of the law, as well as the updating, correction or, if it is in your interest, the integration of the data. You can object to the processing of the data for legitimate reasons. Please could you be so kind as to notify the reference office of the company promptly of any change to your personal data in order to comply with Article 11, letter (c) of the above-mentioned regulations, which requires data collected to be accurate and, therefore, up to date.

Data owner: the data owner is T.P.S. S.p.A. with its registered office in Gallarate (VA) at via Lazzaretto 12/C.

The data owner to refer to for exercising rights and/or for any clarifications on the subject of personal data protection can be contacted at the following email address: privacy@tps-group.it.

Data Protection Officer - DPO: The Data Controller has appointed as Data Protection Officer - DPO the lawyer Roberto Spreafico, who can be contacted via the following contacts:

• Telephone: +39 3358016520
• E-mail: r.spreafico@studiospreafico.eu
• PEC: roberto.spreafico@milano.pecavvocati.it

Gallarate, 25 May 2018