PRIVACY POLICY

pursuant to Art. 13 of European Regulation 679/2016

Pursuant to and for the purposes of the aforementioned legislation, Markbass S.p.a. hereby wishes to inform you in advance of both the use of your personal data and your rights, communicating the following.

1. Definitions

In order to make the contents of this privacy notice more understandable, Markbass S.p.a. provides the following definitions:

a) «personal data»: any information relating to an identified or identifiable natural person («data subject»); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

b) «processing»: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

c) «data controller»: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the data controller or the specific criteria for its nomination may be provided for by Union or Member State law;

d) «data processor»: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller;

e) «recipient»: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

f) «third party»: a natural or legal person, public authority, agency or body other than the data subject, data controller, data processor and persons who, under the direct authority of the data controller or data processor, are authorised to process personal data;

g) «consent of the data subject»: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

h) «marketing»: any activity aimed at promoting services or products offered by the Data Controller, addressed to data subjects for the purpose of increasing the customer base. Such processing requires the data subject’s explicit consent, which may be withdrawn at any time.

i) «profiling»: any automated processing (through algorithms or electronic tools) to assess personal aspects such as preferences, financial situation, behaviour or location (Art. 4 GDPR), aimed at dividing users into homogeneous groups in order to offer content, targeted advertising or personalised services. Such activity requires the user’s consent, which may be withdrawn at any time by expressly objecting to the processing of data.

2. Data controller of personal data and DPO

The Data Controller pursuant to Articles 4 and 24 of the Regulation is Markbass S.p.a., Via Po, n. 52, postal code 66020, San Giovanni Teatino (CH), VAT no. IT01927720696

You may contact the Data Controller by writing to the aforementioned address or by sending an email to the following email address: privacy@markbass.it

Markbass has appointed lawyer Flavia Ciccotelli as Data Protection Officer (“DPO”), email address: flavia.ciccotelli@we-advise.it.

3. Type of data processed and collected

Through this website, the Data Controller may process, independently or through third parties, the following user data: name, surname, date of birth, email address, usage data, address, bank details, place of domicile/residence, IP address.

Personal data may be freely provided by the customer or, in the case of usage data, collected automatically during the use of this website.

Any use of cookies or other tracking tools is intended to provide the service requested by the user, in addition to the further purposes described in this document and in the Cookie Policy.

4. Purposes of the processing

The data indicated by the user will be processed in order to:

a) Provide correct information on the services and products offered;

b) Correctly fulfil contractual obligations;

c) Extend the warranty of the product sold to the end customer;

d) Send newsletters in the form of soft spam;

e) Send promotional communications (direct marketing);

f) Profile user data in relation to the category of the purchases made, aimed at dividing users into homogeneous groups in order to offer content, targeted advertising or personalised services;

g) Comply with legal obligations;

h) Protect the rights and interests of the controller, including in court.

5. Legal basis of the processing

The legal basis for the processing carried out by the Controller consists of:

• Consent given by the user pursuant to Art. 6, letter a), GDPR (for the purposes referred to in letters e), f), of point no. 3). Consent given for marketing and profiling activities may be withdrawn at any time;

• Necessity to perform a contract with the user and/or to take pre-contractual measures pursuant to Art. 6, letter b), GDPR (for the purposes referred to in letters a, b, c, of point no. 3);

• Necessity to fulfil legal obligations pursuant to Art. 6, letter c), GDPR (for the purposes referred to in letter g) of point no. 3);

• Necessity to pursue the legitimate interest of the controller or third parties pursuant to Art. 6, letter f), GDPR (for the purposes referred to in letters d) and h) of point no. 3).

It is always possible to request the controller to clarify the specific legal basis of each processing activity and, in particular, to specify whether the processing is based on the law, provided for by a contract or necessary to conclude a contract.

The consent provided for the processing of data may be withdrawn at any time and free of charge by contacting the Data Controller at the email address privacy@markbass.it.

6. Persons authorised to process data

The processing of the personal data provided by you may be carried out by persons expressly and specifically designated by the controller as processors (Art. 28 GDPR) or as authorised persons (Art. 29 GDPR).

The data provided may also be processed by the Controller directly and communicated to third parties if such processing serves to fulfil legal obligations. For this purpose, the data may be communicated to external companies or professionals (accountant, auditor, managers of platforms and applications useful for the correct functioning of the website) whose collaboration the Controller may use for the purposes indicated in this notice.

In order to allow the fulfilment of contractual and legal obligations, the data may be communicated to post offices, shippers and couriers for sending documentation, as well as to banking institutions for the accounting management arising from the performance of the contract, to Public Administrations as required by law, and to third parties for the provision of IT services or archiving services.

The personal data of the data subject are not subject to dissemination, meaning that the Controller will not make them known or available in any way to unspecified persons.

7. Security measures adopted Processing methods

The controller adopts appropriate security measures aimed at preventing unauthorised access, disclosure, modification or destruction of personal data, consisting of

1) Technical measures: antivirus, antimalware, hardware control, encryption, logical access control, traceability, archiving, digital, protection against malware, security of the websites used through TLS encryption of data flows, periodic backups, hardware security;

2) Organisational measures: Data Breach Policy, Data Retention Policy, appointment as data processor, periodic review of privacy documentation, workstation management

The processing is carried out using IT and/or telematic tools, with organisational methods and logic strictly related to the purposes indicated.

8. Place

The data are processed at the operating offices of the controller and in any other place where the parties involved in the processing are located, in compliance with privacy legislation regarding security and data processing in non-EU countries pursuant to Art. 44, 45 and 46b GDPR.

To obtain further information on the place of processing, the user may request information directly from the data controller.

9. Retention period

The data are processed and stored for the time required by the purposes for which they were collected.

Therefore:

• Personal data collected for purposes related to the performance of a contract between the controller and the user, and those necessary for the extension of the warranty on the purchased product, will be retained until the performance of that contract is completed and, in any case, for no longer than ten years from the termination of the contractual relationship pursuant to Art. 2220 of the Italian Civil Code.

• Personal data collected for purposes attributable to the legitimate interest of the controller will be retained until that interest is satisfied.

• In the specific case of direct marketing and profiling purposes, the retention periods are 36 months from the collection of the data and the granting of consent; in the case of an ongoing contract, the retention periods are 36 months from the termination of the contract itself.

The controller may be obliged to retain personal data for a longer period in compliance with a legal obligation or by order of an authority.

At the end of the retention period, the personal data will be deleted or anonymised. Therefore, upon expiry of that period, the rights of access, erasure, rectification and data portability can no longer be exercised.

10. Transfer of data abroad

Personal data may be transferred to member countries of the European Union.

Where strictly necessary, data could be transferred to countries outside the European Union. In such cases, the Data Controller guarantees the adoption of adequate security measures for the purposes indicated in this notice, in compliance with the rules and international agreements in force pursuant to Art. 44, 45 and 46 GDPR.

11. Rights of the data subject

The rights recognised to you by the GDPR include:

• Access, consisting of the right to obtain confirmation from the data controller as to whether or not data processing is taking place and what its characteristics are;

• Rectification, consisting of the right to request the correction of your data without undue delay and to obtain the completion of incomplete personal data, including by providing a supplementary statement;

• Erasure of your personal data without undue delay;

• Restriction, consisting, under certain conditions, of preventing any type of operation on the marked data, except for storage, in relation to processing concerning you where their accuracy is contested, the processing is unlawful, the data are useful for the exercise or defence of a right in court, or the data subject has objected to the processing pending verification;

• Objection, whereby if your data are processed for the performance of a task in the public interest or for the pursuit of a legitimate interest, you have the right to object to that processing at any time, unless the data controller demonstrates the existence of overriding compelling legitimate grounds;

• Portability, consisting of the right to receive your data in a structured, commonly used and machine-readable format and the right to transmit them to another controller if the processing was based on consent or was carried out by automated means;

• Where the processing is based on Article 6, paragraph 1, letter a), or on Article 9, paragraph 2, letter a), cited above, withdrawal of consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

• Without prejudice to any other administrative or judicial remedy, a data subject who considers that the processing concerning them violates the GDPR has the right to lodge a complaint with a supervisory authority, particularly in the Member State in which they habitually reside or work or where the alleged violation occurred, pursuant to Art. 77 cited above (the Italian supervisory authority is the Garante per la protezione dei dati personali).

You may request the exercise of these rights at any time at the address of the data controller or at the email address indicated above. Requests will be handled free of charge by the controller as quickly as possible and, in any event, within one month of the request.

12. Processing of personal data for a purpose other than that for which they were collected

Should the Data Controller intend to further process personal data for a purpose other than that for which they were collected, before such further processing it will provide the data subject with information regarding that different purpose and any further relevant information referred to in Art. 13, paragraph 2 of the Regulation.

13. Changes

The Controller reserves the right to update the Notice at any time and inform users through the most appropriate means; for any further information or question, the Controller may be contacted using the contact details indicated in point no. 1.