AALTO S.r.l., as Data Controller pursuant to (i) Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and (ii) Legislative Decree No. 101 of 10 August 2018 concerning “Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679” (together, the “Applicable Legislation”), recognises the importance of protecting personal data and considers their protection one of the main objectives of its activities.

Pursuant to Article 13 of Regulation (EU) 2016/679, the following information is provided:

1. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER

AALTO S.r.l.

Registered office: Via Carlo Pisacane, 24 – 20129 Milan (MI), Italy

Operational office: Via Zanardi Bonfiglio, 22 – 27058 Voghera (PV), Italy

VAT No.: 01945700183

Data Controller’s email address: info@aalto.it

Data Controller’s certified email (PEC) address: aalto@pec.aalto.it

2. DATA PROTECTION OFFICER (DPO)

The Data Controller has not appointed a Data Protection Officer, as the conditions requiring such an appointment under Articles 37–39 of Regulation (EU) 2016/679 do not apply.

3. LAWFUL BASIS AND PURPOSES OF PROCESSING

The personal data we hold about you or request from you may be lawfully processed without your express consent in the following cases:

a) under Article 6(1)(b) and (c) of Regulation (EU) 2016/679, for the following purposes related to the provision of services:

· to fulfil pre-contractual and contractual obligations arising from existing relationships;

· to fulfil mandatory administrative, accounting, civil-law and tax obligations;

· to manage the existing relationship from an administrative and, where applicable, commercial perspective;

· to establish, manage and perform contracts entered into between us, including the services necessary to ensure the provision of supplies, after-sales assistance and related warranties;

· to comply with legal obligations to which the Data Controller is subject.

b) under Article 6(1)(f) of Regulation (EU) 2016/679, for purposes connected with protecting the Data Controller’s rights, managing any disputes, recovering debts and managing the existing relationship from an organisational and commercial perspective. The data subject may object at any time to processing based on legitimate interests pursuant to Article 21 of Regulation (EU) 2016/679.

4. ACCESS TO, DISCLOSURE AND TRANSFER OF DATA

Your ordinary personal data may be disclosed, solely to the extent strictly relevant to the obligations, activities and purposes set out in points (a) and (b) of section 3 above, to the following categories of third parties, exclusively for purposes connected with the provision of the Data Controller’s services:

· employees of the Data Controller who, by virtue of their roles and duties, are authorised to process personal data within the scope of their responsibilities and in accordance with the instructions given to them by the Data Controller;

· data processing centres and/or service providers outside our organisation but closely connected to it for operational purposes;

· banks and/or financial institutions, providers of transport and/or delivery services, and correspondence management providers;

· tax advisers, the company’s legal advisers and/or external lawyers, and debt recovery providers;

· public and private bodies, including following inspections or checks or to fulfil obligations arising from laws, binding regulations, EU law or national law;

· other parties outside our organisation that provide technical support and warranty services on our behalf;

· companies supplying goods and services;

· parties to whom such disclosure must be made in order to fulfil, or require fulfilment of, specific obligations laid down by laws, regulations and/or EU law;

· external natural persons and/or legal entities that provide services supporting the Data Controller’s activities for the above purposes and act as processors under Article 28 of Regulation (EU) 2016/679;

Personal data will not be disclosed to third parties for their own purposes, except where disclosure is necessary to comply with legal or contractual obligations or to engage parties acting, where necessary, as processors under Article 28 of Regulation (EU) 2016/679. An up-to-date list of any processors is available by contacting the Data Controller using the details given in this notice. The Data Controller does not intend to transfer the personal data it holds to a third country or to international organisations. Should it become necessary to use cloud services involving transfers to third countries, such transfers will take place in accordance with Articles 44 et seq. of Regulation (EU) 2016/679 and, where applicable, subject to appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission pursuant to Article 46 of Regulation (EU) 2016/679.

Data processed in paper form are kept in dedicated lockable cabinets at the Data Controller’s registered and operational offices and made inaccessible to staff who are not authorised to process personal data. Data stored digitally are protected by technical and organisational measures appropriate to the risk, in accordance with Regulation (EU) 2016/679, and, where necessary, by encryption or other protective measures.

5. CATEGORIES OF DATA PROCESSED

The categories of data processed, in relation to the purposes set out in section 3 and subject to the principles of relevance and data minimisation, are:

· First name and surname

· Place and date of birth, where necessary for administrative, contractual or legal purposes

· Italian tax identification number (codice fiscale), where necessary for administrative, contractual or legal purposes

· VAT number

· Address (residence, domicile or registered office)

· Telephone contact details

· Email address (ordinary email and certified email/PEC)

· Any other data that the Data Controller may lawfully process for the purposes set out in section 3 of this notice.

6. METHODS AND DURATION OF PROCESSING

Your personal data may be processed in paper or electronic form, in all cases using appropriate security measures pursuant to Article 5(1)(f) of Regulation (EU) 2016/679, “using appropriate technical or organisational measures to protect them against unauthorised or unlawful processing and against accidental loss, destruction or damage”, thereby preserving their integrity and confidentiality. Processing is carried out in accordance with the principles of fairness, lawfulness and transparency and with respect for the rights of the data subject. It is performed directly by the Data Controller’s organisation and by processors appointed by the Data Controller under Article 28 of Regulation (EU) 2016/679.

The Data Controller will process personal data for no longer than is strictly necessary to fulfil the purposes set out in section 3 of this notice. In order to comply with Article 13(2)(a) of Regulation (EU) 2016/679 regarding the period for which personal data will be stored or the criteria used to determine that period, the Data Controller specifies the following retention periods: accounting and tax documents, 10 years (Article 2220 of the Italian Civil Code and Article 43 of Presidential Decree No. 600/1973); contracts and commercial documentation, 10 years (Article 2946 of the Italian Civil Code); any other documentation connected with management of the relationship, for the period necessary to comply with legal obligations and protect the Data Controller’s rights. The data subject has the right to request that the Data Controller erase personal data concerning them, except where processing is required by law , without prejudice to the exercise of the rights set out in section 9 below.

7. AUTOMATED DECISION-MAKING

The Data Controller informs the data subject that it does not, under any circumstances, subject personal data to automated decision-making, including profiling as referred to in Article 22(1) and (4) of Regulation (EU) 2016/679.

8. SECURITY MEASURES

The Data Controller adopts technical and organisational measures designed to ensure a level of security appropriate to the risk, pursuant to Articles 5(1)(f) and 32 of Regulation (EU) 2016/679, protecting personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.

If the Data Controller uses Artificial Intelligence systems in the processing of personal data, such systems may be used exclusively to support the storage, classification, verification and proper management of documentation. Personal data processed using these systems are not used to train the relevant Artificial Intelligence models.

9. DATA SUBJECT’S RIGHTS AND HOW TO EXERCISE THEM

Under Articles 15 (right of access), 16 (right to rectification), 17 (right to erasure), 18 (right to restriction of processing), 20 (right to data portability, applicable only to automated processing based on a contract or consent), 21 (right to object) and 22 (right not to be subject to solely automated decision-making) of Regulation (EU) 2016/679, the data subject may exercise their rights at any time by sending:

· a registered letter with acknowledgement of receipt to the Data Controller at: AALTO S.r.l., Via Zanardi Bonfiglio, 22 – 27058 Voghera (PV), Italy

· or a communication to the Data Controller’s email / certified email (PEC) address: info@aalto.it / aalto@pec.aalto.it

as indicated in section 1 of this notice, specifying the subject of the request and the right they wish to exercise. The Data Controller will respond within 30 days of receipt; this period may be extended by a further 60 days for complex requests.

10. PROVISION OF DATA

The provision of personal data for the purposes listed in section 3, points (a) and (b), is mandatory to the extent that processing is necessary to take pre-contractual steps or perform a contract, comply with legal obligations or pursue the Data Controller’s legitimate interests.

11. LODGING A COMPLAINT

Without prejudice to any other administrative or judicial remedy, a data subject who considers that the processing of their personal data infringes Regulation (EU) 2016/679 has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the competent supervisory authority pursuant to Article 77, or to bring proceedings before the competent courts pursuant to Article 79 of Regulation (EU) 2016/679.