Information notice provided pursuant to article 13 EU Regulation 2016/679 (GDPR) data subject/user - and Art. 130 - Unwanted communications Legislative Decree 196/2003 - contracting party

1.CONTROLLER UniFor S.p.A., with registered office in Via Rossini 50 - Giussano (MB), in the person of the legal representative. The contact data for the Controller are as follows: T +39 0362 3591 - F +39 0362 354448 - email address: privacy@molteni.it

2.DATA PROCESSED

Personal Data: any information concerning an identified or identifiable natural person («data subject»); we consider identifiable the natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an on-line identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person Data of contracting parties /users.

For data on navigation and cookies, please see the privacy policy in the website footer.

3.PROCESSING PURPOSE LEGAL BASIS DATA RETENTION PERIOD

PROCESSING PURPOSE	LEGAL BASIS	DATA RETENTION PERIOD
A) activities related to taking part in a Unifor S.p.A. Webinair To check webinar participation, the Controller receives a report; this provides information on how many total participants took part in the event and their attention during the webinar. The webinar will be recorded.	Processing is needed to execute a service/ contract that the data subject is part of or to execute the pre-contractual measures adopted at the latter’s request; (C44) art. 6 par. 1 letter b) of the GDPR	Maximum 12 months
B) Direct marketing, to send advertising or direct sales material, to conduct market research or send commercial communications and newsletters through automated (e-mail, SMS type messages or through social networks and sponsorships) and traditional methods (operator phone calls and paper post, even through data Processors). Communications could contain the promotional activities of third parties and/or third party logos (partners: no profit bodies; agriculture, forestry and fishing; manufacturing activities; supply of electricity, gas, steam and air conditioning; constructions; wholesale and retail commerce; vehicle and motorcycle repairs transport and storage; accommodation and catering services; information and communication services; financial and insurance activities; real estate activities; professional, scientific, technical activities; rental, travel agencies, company support services; public administration; education; artistic, sports, entertainment and fun activities; other service activities). Please ask privacy@molteni.it for the full list. There will be no transfer of personal data to third party partners for this purpose. To compare and possibly improve communication results, the Controller uses systems to send newsletters and promotional communications with reports. Thanks to those reports, the Controller can know, for example: the number of readers, of openings, single “clickers” and clicks; devices and operating systems used to read the communication; details on the activities of single users; details of emails sent, emails delivered and not, those forwarded. All these data are used to compare, and possibly improve, communication results.	Processing is based on consent to personal data being processed; (C42, C43) art. 6 par. 1 letter a) of the GDPR	Until consent is revoked (opt-out)
C) Profiling: the personal data will be entered in company CRMs/platforms, for internal analysis and to divide data subjects into uniform groups by specific company activity characteristics to manage services better and send targeted promotional communications.	Processing is based on consent to personal data being processed; (C42, C43) art. 6 par. 1 letter a) of the GDPR	Until consent is revoked (opt-out) , in any case maximum 12 months
D) Transfer of data to third parties: other Molteni Group companies (parent companies, subsidiaries, associated and affiliated companies), even in non-EU countries, for direct marketing purposes (e.g. Unifor, Citterio brand companies and branches of group companies) and any distributors /resellers as data Controllers, for their e-mail marketing communications. Ask privacy@molteni.it for the full list.	Processing is based on consent to personal data being processed; (C42, C43) art. 6 par. 1 letter a) of the GDPR	Until consent is revoked. Please also refer to the personal data processing information provided by third party data Controllers

4. RECIPIENTS OF PERSONAL DATA

Personal data provided will be communicated to the Controller’s employees and collaborators. They will process data as persons authorised to do so acting under the authority of the Controller for the above-listed purposes. The personal data provided could be communicated to third parties linked to the Controller contractually in order to fulfil contractual obligations and the above-indicated purposes; more specifically, the data will be communicated to: -Molteni Group companies; - subjects belonging to the distribution network (such as importers, distributors, resellers, shipping agents, etc.); -subjects supplying services to manage the information system used by the controller and the telecommunication networks (including email, web platforms, clouds, software); - firms or companies providing assistance and consultancy services; - social network platforms; -authorities responsible for fulfilling legal obligations and/or the orders of public bodies, on request. The subjects belonging to the above categories act as data Processors, or operate autonomously as separate Controllers. The list of Processors is updated continuously and is available c/o the Controller’s head office and from the above contact details.

5. TRANSFERRING DATA TO A THIRD COUNTRY

The website is hosted in an EU country. If communicated to subjects in Non-EU Countries (for example for direct contacts with our sales /contact network, social network platforms, webinar platforms, etc.), the personal data will be transferred to Non-EU Countries to comply with the above-mentioned purposes. Data will be transferred within the limits and under the conditions set forth in art. 44 et seq. GDPR, to Non-EU Countries, to subjects providing suitable guarantees for the transfer in compliance with arts. 45, 46, 47 GDPR. For information on guarantees related to transferring data to Non-EU Countries, data subjects may write to the e-mail address of the Controller: privacy@molteni.it

6. PROVIDING DATA

Users /contracting parties are free to provide their personal data. Not doing so might only mean not being able to obtain the information or services requested and supplied through this website. Providing data for purposes in B) and/or C) and/or D) is optional and will not prejudice the purposes in point A).

7. RIGHTS OF DATA SUBJECTS (only for natural persons)

The natural person data subject may enforce his/her rights as set forth in arts. 15 et seq. of EU Regulation 2016/679, by contacting the Controller at the aforementioned contact details. More specifically, the data subject has the right, at any time, to have access to its personal data from the Controller and request information regarding processing, and may rectify, erase its personal data or restrict processing. Furthermore, when foreseen, the data subject has the right to revoke the consent granted without prejudicing the lawfulness of processing based on that consent before it was revoked. The data subject also has the right to object to processing based on its legitimate interest by writing to privacy@molteni.it. When foreseen, the data subject has the right to the portability of its personal data. In that case, the Controller will provide the data subject’s personal data in a structured, common use format, readable from an automatic device. If he/she believes that the processing of his/her personal data by the controller is in breach of Regulation (EU) 2016/679, the data subject may present a complaint to the Privacy Authority (https://www.garanteprivacy.it/), or may take action in court (this for both legal and natural persons). To revoke consent to non automated profiling, it is enough to send an e-mail at any time to privacy@molteni.it under the subject “no profiling”

In order not to receive automated direct marketing communications (e.g. e-mail, SMS, social) legal persons just need to write an e-mail at any time to the address privacy@molteni.it with subject “cancellation from automated service” or use our automatic cancellation systems set up solely for e-mail. In order not to receive traditional direct marketing communications (phone calls with operator and paper post), it is sufficient to write an e-mail at any time to the address privacy@molteni.it with subject “cancellation from traditional service”.

8. AMENDMENTS TO THE PRIVACY INFORMATION NOTICE

The Controller reserves the right to amend, update, add or remove parts of this privacy information notice. To facilitate controls, the information notice will contain the date it was updated.

Date updated: 20 July 2020

Molteni & C. S.p.A.