PRIVACY NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION No. 2016/679

(General Data Protection Regulation – GDPR)

1. Data Controller

The Data Controller is ECLAIRE SRL (VAT No. 03701070272), represented by its legal representative pro tempore, with registered office at Via Roma No. 100, Cinto Caomaggiore (VE), Italy, www.eclaire.it, hereinafter referred to as the “Data Controller”.

The Data Controller intends to provide the data subject with full information regarding the purposes and methods of processing personal data.

2. Methods of Processing Personal Data

Personal data (e.g. personal details, telephone number, email address, etc.) are processed using IT systems or, in any event, with the aid of computerized or automated tools, in compliance with the applicable security measures and in such a manner as to ensure the integrity, security and confidentiality of the data.

3. Purposes of Processing

The Data Controller will process your personal data for the following purposes:

1. carrying out contractual and pre-contractual activities;

2. fulfilling tax and legal obligations;

3. sending communications for informational and promotional purposes.

Personal data will also be processed exclusively for purposes strictly connected with and instrumental to the fulfilment of the obligations relating to the above-mentioned purposes.

Following the sending of communications, the platform used enables the detection of whether a message has been opened and of any clicks made within the communication, together with details relating to the IP address and the browser/device used. The collection of such data is essential for the operation of the systems for the implicit renewal of the processing and is an integral part of the operation of the communication-sending platform.

The consent given by you constitutes the legal basis for the processing pursuant to Article 13(1)(c) of the GDPR.

4. Nature of the Provision of Data

The provision of your data for the purposes referred to in points 1) and 2) of Article 3 does not require any formal consent, as it is necessary and essential for any contractual or pre-contractual relationship.

The provision of your data for the purposes referred to in point 3) of Article 3, namely for sending communications for promotional, commercial, informational or research purposes, is optional. Refusal to provide the relevant consent to processing will result in the inability to receive updates concerning commercial initiatives and/or promotional campaigns, offers or other promotional materials.

In any event, if you have given your express consent authorizing the Data Controller to pursue the purposes referred to in point 3) of Article 3, you remain free to withdraw such consent at any time by sending a clear communication to this effect, without any formalities, to the email address info@eclaire.it.

Upon receipt of such opt-out request, the Data Controller will promptly remove and delete the data from the databases used for processing for the purpose of sending communications and will inform, for the same deletion purposes, any third parties to whom the data may have been disclosed.

Receipt of the deletion request shall automatically constitute confirmation that the deletion has been carried out.

5. Recipients or Categories of Recipients of Personal Data

The personal data provided by you, for the purposes described above, may be made available to employees and/or collaborators of the Data Controller and communicated to the following parties:

a) third-party companies that may be appointed by the Data Controller to carry out the obligations undertaken by the latter for the implementation of the processing activities envisaged for the purposes referred to in points 1) and 2) of Article 3;

b) all parties, including Public Authorities, that are entitled to access the data pursuant to legal or administrative provisions;

c) third-party companies providing essential support services for the processing activities and having direct or indirect access to your data;

d) third-party companies appointed by the Data Controller to carry out the processing activities envisaged for the purposes referred to in point 3) of Article 3.

All collaborators or suppliers used by the Data Controller for the processing of your personal data have been duly and lawfully authorized and instructed regarding the methods and purposes of the processing activities assigned to them and shall act in compliance with and in accordance with this Privacy Notice.

The personal data provided by you, for the purposes described above, may be transferred to business partners for processing activities envisaged for the purposes referred to in point 3) of Article 3.

The personal data provided by you and subsequently processed in connection with the management of the service are not subject to dissemination or public disclosure.

For the parties referred to in points a), b) and d), only the category of recipients is indicated, as these are subject to frequent updates and revisions. Therefore, data subjects may request an up-to-date list of recipients by contacting the Data Controller through the contact details indicated in Article 1 of this Privacy Notice.

6. Data Retention Period

Your personal data will be retained for the periods established by the applicable legislation, as specified below pursuant to Article 13(2)(a) of the GDPR:

1. for the purposes indicated in points 1) and 2) of Article 3, for the periods prescribed by applicable law and, in any event, for a period of not less than 10 (ten) years;

2. for the purposes indicated in point 3) of Article 3, for 2 (two) years from the date on which consent to processing is given.

7. Exercise of the Rights of the Data Subject

Pursuant to Articles 13(2)(b) and (d), 15, 18, 19 and 21 of the GDPR, the data subject is hereby informed that they have the right to:

a. Access to personal data: obtain confirmation as to whether or not personal data concerning them are being processed and, where this is the case, access to the following information: the purposes of the processing, the categories of data, the recipients, the retention period, the right to lodge a complaint with a supervisory authority, the right to request rectification or erasure or restriction of processing, or to object to processing, as well as the existence of automated decision-making;

b. Request rectification or erasure of such data or restriction of the processing concerning them; “restriction” means the marking of stored personal data with the aim of limiting their processing in the future;

c. Object to processing: object, on grounds relating to their particular situation, to the processing of data carried out for the performance of a task carried out in the public interest or in the exercise of official authority, or for the purposes of the legitimate interests pursued by the Data Controller;

d. Data portability: where processing is carried out by automated means on the basis of consent or in the performance of a contract, receive the personal data concerning them in a structured, commonly used and machine-readable format; in particular, the Data Controller will provide the data in .xml format;

e. Withdraw consent to processing for marketing purposes, whether direct or indirect, market research and profiling; exercising this right shall not affect the lawfulness of processing carried out prior to the withdrawal;

f. Lodge a complaint pursuant to Article 77 of the GDPR with the competent supervisory authority based on their habitual residence, place of work or the place where the alleged infringement of their rights occurred. In Italy, the competent authority is the Italian Data Protection Authority (Garante per la protezione dei dati personali), which can be contacted using the contact details available on its website: www.garanteprivacy.it.

The above-mentioned rights may be exercised by sending a specific request to the Data Controller through the contact channels indicated in Article 1 of this Privacy Notice.

Requests relating to the exercise of your rights will be handled without undue delay and, in any event, within one month of receipt of the request. Only in cases involving particular complexity or a large number of requests may this period be extended by a further 2 (two) months.

The exercise of these rights is not subject to any formal requirements and is free of charge.

The email address for exercising your rights is info@eclaire.it.