INFORMATION ON THE PROCESSING OF PERSONAL DATA Article 13 of EU Regulation 2016/679

Dear Customer/Supplier, We wish to inform you that, pursuant to Article 13 of the EU Regulation 2016/679 (GDPR), laying down provisions for the protection of the processing of personal data of natural persons, as well as the free movement of such data, the personal data you provide will be processed in compliance with the above-mentioned legislation in accordance with the principles of lawfulness, fairness, transparency and protection of your privacy and your rights.

Purposes of the processing for which the data are intended

The personal data you provide will be used for the following purposes: • perform the services requested, enable effective management of customer and supplier relationships in order to respond to requests for information, assistance, suggestions and/or specific needs reported by you; • Performance of the contract to which you are a party and fulfillment of obligations arising therefrom, as well as fulfillment of related legal obligations, to which the data controller is subject.

Mode of treatment

The data will be processed manually and/or using automated and computerized methods and tools, always in compliance with the security measures set forth in Article 32 of EU Regulation 2016/679, by specially appointed individuals, in compliance with the provisions of Article 29 EU Regulation 2016/679. Security measures will then be employed to ensure the confidentiality of the data subject, to whom such data refer, and to prevent undue access by third parties or unauthorized personnel.

Conservation

We would like to inform you that, in accordance with the principles of lawfulness, purpose limitation and data minimization, pursuant to Article 5 EU Regulation 2016/679, the storage period of your personal data is established in a timeframe not exceeding the achievement of the purposes for which they are collected and processed and in compliance with the timeframe prescribed by law.

Nature of Contribution

The provision of data is compulsory for the execution of the contract and the fulfillment of legal obligations; any refusal to provide them will determine the impossibility for Trebax S.r.l. to proceed with the full provision of the services offered.

Scope of communication and dissemination

Personal data, in relation to the above purposes, will be accessible, due to the specific functions, to the employees of the Data Controller duly designated as authorized persons for processing. Data may also be disclosed: • To vendors qualified as Data Processors and appointed pursuant to Article 28 of the GDPR; • Public Bodies and/or Judicial Authorities in cases expressly provided for by Law; Outside of these cases, your personal data will not be disclosed to third parties or disseminated, except in cases specifically provided for by law.

Transfer of data to third countries

The Data Controller does not transfer personal data to third countries; however, it reserves the possibility of using cloud services and in that case the service providers will be selected from among those who provide adequate guarantees, as provided by Article 46 EU Regulation 2016/679.

Data Controller, Data Processor and DPO

he Data Controller is Trebax S.r.l. in the person of the legal representative. An up-to-date list of responsible persons is kept at the place of business. The DPO has not been appointed.

To assert the rights of the interested party and/or to request further information, he/she may contact the Data Controller "Trebax S.r.l.", with registered office in Via Cimabue, 66 Castellarano (RE) tel. 0536 850288; e-mail privacy@trebax.it

Rights of the data subject

At any time, you may exercise, pursuant to Articles 15-22 of EU Regulation 2016/679, the right to: a) to request confirmation of the existence or non-existence of their personal data and, if so, to obtain access to the personal data and information indicated in b) below; b) Obtain information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed (particularly if recipients in third countries or international organizations), and, when possible, the retention period; c) Obtain rectification and deletion of data; d) revoke their consent at any time (however, revocation of consent does not affect the lawfulness of processing based on consent before revocation); e) Obtain restriction of processing; f) Obtain portability of data, i.e., receive them from a data controller, in a structured, commonly used, machine-readable format, and transmit them to another data controller without hindrance; g) To object to the processing at any time and also in the case of processing for direct marketing purposes; h) Object to automated decision-making related to natural persons, including profiling; i) to obtain confirmation of the fulfilment of the provisions of Article 19 EU Regulation 2016/679 on the part of the Data Controller, i.e. the communication - to each of the recipients to whom the personal data have been transmitted - of any rectification or deletion or restriction of the processing carried out in accordance with Article 16 EU Regulation 2016/679, except where such fulfilment proves impossible or involves a disproportionate effort; j) Propose complaints to the competent supervisory authority.