Privacy Policy

DISCLOSURE PURSUANT TO AND IN ACCORDANCE WITH ART. 13 OF ITALIAN LEGISLATIVE DECREE 196/2003 REGARDING THE PROTECTION OFOF PERSONAL DATA. Pursuant to art. 13 of the Privacy Code (Italian Legislative Decree no. 196/2003), EMANUEL SRL S.p.A. (hereafter EMANUEL SRL) provides you with information regarding the processing (1) of your personal data (2), which may be performed consequently to the contractual relationship currently in place with you. The undersigned company informs you that it is and will become aware of your data, which the law qualifies as personal, acquired, also verbally, directly or via third parties.

1. PURPOSE OF THE PROCESSING The personal data provided by you will be processed by EMANUEL SRL for managerial, accounting, fiscal, statistical, commercial, marketing purposes and for the protection/management/assignment of credit, as well as to fulfil the obligations set out by applicable legislation and for the purpose of the financial valuation in relation to the exact fulfilment of the obligations under the contract.

2. PROCESSING METHODS The data is collected at the Data Controller as defined under point 6, according to the indications of the Privacy Code, with special consideration to the minimum security measures required (articles 33-34) as regards data processing through manual and automated IT tools (art. 35), with logics that are closely related to the purposes mentioned above and, in any case, in a way to guarantee the security and confidentiality of the data in question. Data provision is necessary to fulfil legal and contractual obligations; therefore, any refusal to provide data or to subsequently process it, makes it impossible for the undersigned to execute the contractual relationships in question. On the other hand, the failure to provide all the data that does not relate to legal or contractual obligations may lead to the consequent decisions, in consideration of the importance of the data requested with respect to the management of the commercial relationship, in addition to making it impossible for you to benefit from increasingly suitable service levels.

3. CATEGORIES OF SUBJECTS THAT DATA MAY BE COMMUNICATED TO Without prejudice to the communications and disclosures made in compliance with legal obligations, personal data that may be collected in executing the contractual relationships in place with you may be communicated not only to the company internally, in Italy and in EU and non-EU countries, but also to Banks and/or Companies specialised in managing payments and collections deriving from the execution of contracts, databases for commercialinformation, professionals, consultants and service companies only for the purpose of credit protection and better management of our rights regarding the individual commercial relationship, to Companies that are contractually linked to the undersigned, in order to execute the contractual obligations assumed with you, as well as to subjects that may be appointed as data mangers.

4. DURATION OF THE PROCESSING Your personal data will be stored and processed for the time needed to fulfil the stated purposes. It will be subsequently stored only for the time required by applicable statutory and fiscal regulations.

5. RIGHTS OF THE SUBJECT CONCERNED We would like to remind you that at any time you have the right to know your data and the way it is used as well as to have it updated, integrated, rectified or to request its deletion, block or to object to its processing, if it violates the law, pursuant to art. 7 of Italian Legislative Decree 196/20033, in addition to the right to know the names of 1 Processing means “any operation or set of operations carried out also without the aid of electronic tools, regarding the collection, registration, organisation, storage, consultation, handling, editing, selection, extraction, comparison, use, interconnection, block, communication, deletion and destruction of data, also when not registered in a database”. 2 Personal detail means “any piece of information regarding an individual, a legal entity, a body or an association, identified or identifiable, also indirectly, through reference to any other information, including the personal identification number”. 3 Art. 7 of Italian Legislative Decree no. 196/2003 (Right of withdrawal for personal data and other rights) 1. The entity concerned has the right to obtain confirmation of the existence of personal data that may concern it, even if not recorded yet, and its communication in an intelligible form. 1 of 2 FORM 01/2016 the external Supervisors for data processing which may be appointed in accordance with art. 7 below, by writing to EMANUEL SRL S.p.A., via E. Mattei no. 42, 40138 – Bologna, or to the email address set up for this purpose: setras@pec.setras.eu

6. DATA CONTROLLER AND DATA SUPERVISOR The data controller and the data supervisor is EMANUEL SRL S.p.A., with registered office in Milan (MI), Piazza Diaz no. 7. The internal supervisors for personal data processing are the various corporate functions that, also in relation to their corporate mission, can process personal data and are domiciled at the Company offices.

7. APPOINTMENT OF EXTERNAL SUPERVISORS FOR DATA PROCESSING The Company reserves the right to appoint as External Supervisors for Data Processing other Companies of the “EMANUEL SRL” or other Companies entrusted with executing the services required that, with their expertise, ability and reliability, provide suitable assurance of the full compliance with the provisions in force regarding the processing of personal data. 2. The entity concerned has the right to obtain the indication: a) of the origin of the personal data; b) of the purposes and methods of processing; c) of the logic applied to the processing with the aid of electronic tools; d) of the identification details of the data controller, data supervisors and representative designated pursuant to paragraph 2 of art. 5; e) of the subjects or of the categories of subjects that the personal data may be communicated to or which may become aware of it in the capacity as designated representative in the territory of the State, supervisors or entities in charge. 3. The entity concerned has the right to obtain: a) the update, rectification or, if interested, the integration of the data; b) the deletion, transformation in anonymous form or the block of the data handled in violation of the law, including the data that needs to be stored in connection with the purposes of collection and subsequent processing of the data; c) the certification that the operations under letters a) and b) were made known, also with regard to their content, to those the data was communicated or disclosed to, except in case this fulfilment proves impossible or implies the adoption of means that are clearly disproportionate compared to the right being safeguarded. 4. The entity concerned has the right to partly or fully object: a) for legitimate reasons, to the processing of data that concerns it, even when pertaining to the purpose of the collection; b) to the processing of personal data that concerns it for the purpose of sending advertising or sale material or to carry out market research or commercial communication activities.