INFORMATION ON THE PROCESSING OF PERSONAL DATA

CO.PRESS S.r.l., with registered office in Faenza, at via Morgagni no. 51-53 (hereinafter, the “Controller”), as controller, informs you pursuant to art. 13 of Legislative Decree no. 196 of 30.6.2003 (hereinafter, the “Privacy Code”) - Legislative Decree 101/2018 and art. 13 EU Regulation no. 2016/679 (hereinafter, the “GDPR”) that your data will be processed as follows and for the following purposes.

1. Subject of the data processing

The personal identification data (e.g. first name, surname, company name, address, phone number, e-mail address, bank and payment details – hereinafter "personal data" or just "data") provided by you upon entering into a service agreement with the Controller shall be processed by the latter.

2. Purpose of processing

Your personal data are processed:

1. without your express consent (article 24, letters (a), (b), and (c) of the Privacy Code and article 6, letters (b) and (e) of the GDPR) for the following service purposes:

   • to answer to your requests for information;

   • to enter into agreements for the services provided by the Controller;

   • to comply with the pre-contractual, contractual, and tax obligations arising from the relationships existing with you;

   • to comply with the obligations established by law, regulation, European legislation, or an order of the Authority (e.g. in relation to anti-money laundering);

   • to exercise the rights of the Controller, e.g. the right to defence in courts;

2. without your express consent (article 24, letters (a), (b), and (c) of the Privacy Code and article 6, letters (b) and (e) of the GDPR) for the following service purposes:

preparation and delivery of a quotation.

3. marketing and newsletters purposes.

Subject to your prior consent, which is optional, the company may process your personal data (e-mail addresses, postal addresses and telephone number) to send you commercial proposals and newsletters.

We inform you that if you are already a customer of ours, we may send you commercial communications relating to the Controller's services and products similar to those you have already used, save in the event that you withhold your consent (Article 130, paragraph 4, of the Privacy Code).

3. Data processing methods

Your personal data are processed as indicated in article 4 of the Privacy Code and Article 4, number 2, of the GDPR, and more precisely: collection, recording, organisation, storage, consultation, processing, alteration, selection, retrieval, comparison, use, interconnection, blocking, communication, erasure and destruction of data. Your personal data are subject to both paper, electronic and/or automated processing. The Controller will process personal data for the time required to fulfil the above purposes and for a period however not exceeding 10 years as of the termination of the relationship for service purposes, and in the event of processing for quotation purposes, the data are stored for 3 years. For the purposes of point C, the duration is 2 years.

4. Access to data

Your data may be made available for the purposes referred to in article 2A) and 2B) - 2.C).

• to employees and collaborators of the Controller, in their capacity as internal appointees and/or processor and/or system administrators;

• to third-party companies or other subjects (including, but not limited to, web agencies) that carry out outsourced activities on behalf of the Controller, in their capacity as external processors.

1. Data disclosure

Without the need for an express consent (pursuant to article 24, letters (a), (b), and (d) of the Privacy Code and article 6, letters (b) and (c) of the GDPR), the Controller may communicate your data for the purposes referred to in Article 2(A) to Supervisory Bodies (such as IVASS [Italian Institute for the Supervision of Insurance], Judicial Authorities, insurance companies for the provision of insurance services, and subjects to whom communication is mandatory under the law for the accomplishment of said purposes. These subjects will process the data in their capacity as autonomous Controllers. Your data shall not be disclosed.

3. Data transfer

Personal data are stored on servers located in the EU and on local storage units within the company, also within the European Union. It is in any event understood that, if necessary, the Controller may also move the servers outside the EU. In said event, the Controller hereby ensures that the transfer of data outside the EU will take place in accordance with the applicable legal provisions, subject to signing the standard contractual clauses provided for by the European Commission.

4. Nature of the provision of data and consequences of refusing to provide them

The provision of data for the purposes referred to in article 2.A) is mandatory. In its absence, we cannot guarantee the services mentioned in article 2.A). The provision of data for the purposes referred to in article 2(B) is, instead, optional. You may, therefore, decide not to provide any data or to subsequently deny the processing of data already provided. In said event, you will not be able to receive newsletters, commercial communications or advertising material concerning the services offered by the Controller. However, you shall continue to be entitled to the Services referred to in article 2.A).

5. Rights of the data subject

As a data subject, you have the rights referred to in Art. 15 and et seq. of the GDPR, specifically:

1. To obtain confirmation of whether any personal data about you exist or not, even if the data have not yet been recorded, and their disclosure in an intelligible form;

2. to be informed: a) of the origin of the personal data; b) of the purposes and methods of processing; c) of the logic applied in the event of processing carried out by electronic instruments; d) of the identification details of the controller, the processors and the representative designated pursuant to art. 5, paragraph 2, of the Privacy Code and art. 3, paragraph 1, of the GDPR; e) of the subjects or categories of subjects to whom personal data may be disclosed or which may become aware of, as a designated representative in the territory of the State, as processors or appointees;

3. to have: a) personal data updated, rectified or, where necessary, completed; b) personal data deleted, rendered anonymous or blocked where data have been processed in breach of law, including those for which storage is not necessary in relation to the purposes for which they have been collected or subsequently processed; c) the evidence that those to whom data have been disclosed or disseminated have become aware of the operations referred to in letters (a) and (b), also with regard to their content, except in the events where it is impossible to comply with this obligation or it implies an effort in terms of resources which is manifestly disproportionate as compared with the right protected;

4. to object, in whole or in part: a) for legitimate reasons, to the processing of personal data concerning you, even if relevant to the purpose for which they were collected; b) to the processing of personal data concerning you for the purpose of providing advertising material or direct sales or for carrying out market research or commercial communication, through the use of automated calling systems without human intervention, by email and/or through traditional marketing methods by telephone and/or mail. Please note that, with regard to direct marketing through automated methods, the data subject's right to object, as set out in point (b) above, is extended to traditional methods, without prejudice for the data subject to the partial exercise of their right to object. Hence, the data subject may decide to receive only communications using traditional methods, or only automated communications, or none of the above. Where applicable, the rights referred to in articles 16-21 of the GDPR (right of rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object) are granted, as well as the right to lodge a complaint with the Supervisory Authority.

1. Methods of exercising rights

You may exercise your rights at any time by sending:

• a registered letter with return receipt to the registered office of CO.PRESS S.r.l. with address at via Morgagni n. 51-53, Faenza.

1. Controller, processor and appointees

The Controller is CO.PRESS S.r.l. with registered office at Faenza, via Morgagni n. 51-53.