pursuant to Regulation (EU) 2016/679 on the protection of personal data

Information pursuant to Art. 13 of the Consolidated Law

Information pursuant to Arts. 13-14 of the EU Regulation (Chapter III Rights of the Data Subject)

TACCHIFICIO VAL DI CHIENTI PLAST S.R.L. with registered office at Via Canaletto, 2 – 62010 Morrovalle (MC), Tax Code and VAT No. 01524470430, represented by BALDONCINI CRISTINA (hereinafter referred to as “Data Controller” as the legal representative of the Company), in its capacity as Data Controller, informs you pursuant to Art. 13 of Legislative Decree 30.6.2003 No. 196 (hereinafter referred to as the “Privacy Code”) and Art. 13 of Regulation (EU) No. 2016/679 (hereinafter referred to as “GDPR”) that your data will be processed in the following ways and for the following purposes:

1. Purpose of Data Processing

The Data Controller processes personal data such as: name, surname, company name, address, telephone, email, bank details, and payment information (hereinafter referred to as “personal data” or simply “data”) communicated by you when concluding contracts for the services of the Data Controller.

2. Purpose of Processing

Your personal data is processed:

1. A) Without your express consent (Art. 24 letters a), b), c) of the Privacy Code and Art. 6 letters b), e) of the GDPR), for the following Service Purposes:
   • Conclude contracts for the services of the Data Controller;
   • Fulfill pre-contractual, contractual, and fiscal obligations arising from relations with you;
   • Comply with obligations under the law, regulations, community legislation, or an order from an authority (e.g., in anti-money laundering matters);
   • Exercise the Data Controller’s rights, such as the right to defense in legal proceedings;
2. B) Only with your specific and distinct consent (Arts. 23 and 130 of the Privacy Code and Art. 7 of the GDPR), for the following Marketing Purposes:
   • Send you via email, mail, and/or SMS and/or phone contacts, newsletters, commercial communications, and/or advertising material on products or services offered by the Data Controller and assess your satisfaction with the quality of services;
   • Send you via email, mail, and/or SMS and/or phone contacts, commercial and/or promotional communications from third parties (e.g., business partners, insurance companies, other companies of the Card Protection Plan Group).

Please note that if you are already our customer, we may send you commercial communications regarding the Data Controller’s services and products similar to those you have already used, unless you object (Art. 130, paragraph 4 of the Privacy Code).

3. Methods of Processing

Your personal data is processed by means of the operations indicated in Art. 4 of the Privacy Code and Art. 4(2) of the GDPR, precisely: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion, and destruction of data. Your personal data is processed both in paper and electronic/automated formats.

The Data Controller will process personal data for the time necessary to fulfill the purposes mentioned above and in any case for no longer than 10 years from the termination of the relationship for Service Purposes.

4. Access to Data

Your data may be made accessible for the purposes referred to in Art. 2.A) and 2.B):

• To service providers and auxiliaries appointed by us who may access the data for the purposes indicated, provided they maintain the professional confidentiality granted to them. These include companies in the categories of banking services, IT services, logistics, printing services, telecommunications, collection, consulting, sales, and marketing;
• To employees and collaborators of the Data Controller, in their capacity as data processors and/or internal managers of data processing and/or system administrators;
• To third-party companies or other entities (e.g., credit institutions, professional firms, consultants, insurance companies for the provision of insurance services, etc.) that carry out activities outsourced by the Data Controller, in their capacity as external data processors.

Here is the translation of the provided text into English, formatted in code: “`html 5. Data Disclosure

Without the need for express consent (pursuant to Art. 24 letters a), b), d) of the Privacy Code and Art. 6 letters b) and c) of the GDPR), the Data Controller may disclose your data for the purposes referred to in Art. 2.A) to supervisory bodies (such as IVASS), judicial authorities, insurance companies for the provision of insurance services, as well as to those entities to whom the communication is mandatory by law for the fulfillment of the aforementioned purposes. These entities will process the data as independent data controllers.

Your data will not be disseminated.

6. Data Transfer

Personal data is stored on servers located in Morrovalle Via Canaleto, 2, within the European Union. However, it is understood that the Data Controller, if necessary in the future, will have the right to move the servers also outside the EU. In such a case, the Data Controller ensures that the transfer of data outside the EU will take place in compliance with applicable legal provisions, subject to the stipulation of the standard contractual clauses provided by the European Commission.

7. Nature of Data Provision and Consequences of Refusal

The provision of data for the purposes referred to in Art. 2.A) is mandatory. In their absence, we cannot guarantee the Services referred to in Art. 2.A).

The provision of data for the purposes referred to in Art. 2.B) is optional. You can therefore decide not to provide any data or to subsequently deny the possibility of processing data already provided: in such a case, you will not be able to receive the services referred to in Art. 2.B). You will still retain the right to the Services referred to in Art. 2.A).

8. Rights of the Data Subject

Every data subject has:

• The right of access pursuant to Article 15 GDPR;
• The right to rectification pursuant to Article 16 GDPR;
• The right to erasure pursuant to Article 17 GDPR;
• The right to restrict processing pursuant to Article 18 GDPR;
• The right to object pursuant to Article 21 GDPR;
• Where applicable, the right related to automated decision-making and profiling;
• Where applicable, the right to data portability pursuant to Article 20 GDPR;
• Where applicable, the right to lodge a complaint with a supervisory authority responsible for data privacy (Article 77 GDPR).

You can revoke the consent granted to us for the processing of personal data at any time. This also applies to the revocation of consent statements made before the GDPR came into force, i.e., before May 25, 2018. Please note that the revocation is valid only for the future and does not affect the processing carried out before the revocation.

9. How to Exercise Your Rights

You may exercise your rights at any time by sending a registered letter with acknowledgment of receipt to Tacchificio Val di Chienti Plast S.R.L., Via Canaletto, 2 62010 Morrovalle (MC), or by sending a PEC (Certified Electronic Mail) to TACCHIFICIOVALDICHIENTIPLAST@PECITALIA.BIZ.

10. Data Controller, Data Processors, and Authorized Persons

The Data Controller is Baldoncini Cristina, with registered office at Via Canaletto, 2 62010 Macerata (MC). The updated list of data processors and authorized persons is kept at the registered office of the Data Controller.

Google

The Google advertising requirements can be summarized by Google’s advertising policies. These are implemented to provide a positive browsing experience for users. https://support.google.com/adwordspolicy/answer/1316548?hl=en