PROMECO PRIVACY NOTICE 1. DATA CONTROLLER AND CONTACT DETAILS Your personal data is collected and processed as per the new EU General Data Protection Regulation (GDPR) EU 2016/679 by Promeco S.p.A. with registered offices at Via Mugiasca 4 – 22100 Como Italy and Facility & Administrative Office at via Tevere 51 - 22073 Fino Mornasco (Co) Italy - Fiscal Code and VAT no. 02912190135 (hereafter, "Promeco") in its quality as data controller. At any time you can contact Promeco at promeco@promeco.it in order to obtain further information on the processing of your personal data and/or to exercise your rights of data subject.

2. PERSONAL DATA COLLECTED BY PROMECO S.p.A.

We will collect and process personal data that is

• provided by you, such as the data you provide to us when you sign an agreement, fill out a form, call us, participate to our events, visit our website, provide a comment or however communicate with us. This information may include your name, surname, email address, bank details, postal address, phone number, the name of your business and any other information you choose to provide;
• acquired by PROMECO directly, such as the data we obtain from public sources like the Register of Enterprises, through any other third party to which you have previously provided your consent. This information may include your name, surname, e-mail address, postal address, phone number, the name of your business and the name of any other information we gather about you when it is needed to process it for any of the purposes indicated below. Purposes of the processing and legal basis Your personal data will be processed for the following purposes:

a) To fulfil our contractual or pre-contractual obligations and, specifically, to allow you or your business to receive our services, to calculate a quote that you have requested from us, to execute agreements with have in place with you or a party that is related to you, to provide you with the necessary assistance with regard to the products and services purchased.

b) To comply with our legal obligations, such as the obligation to provide you with our legal warranty in respect of products and/or services you purchased by us or in order to fulfil our fiscal obligations.

c) To pursue our legitimate interests or those of a third party, including:

• The analysis and improvement of the quality of our products and services; the management of insurance risks; the assessment of the quality of the assistance provided to customers; the anonymous analysis of our clients segments;
• send you promotional contents about products and/or services of PROMECO that are similar to those you have already purchased in the past and/or based on other information you have provided to us (such as, for example, a previous quotation you have requested). You can exercise your right of objection at any time to any processing that is aimed at sending promotional contents;
• The processing of your personal data for establishing, exercising or defending a legal claim. d)

d) On the basis of your consent, to provide you with our communications for marketing and market research purposes relating to products and/or services offered directly by PROMECO. Such promotional activities may take place through e-mail, mail, social networks, telephone and other means of communication.

3. CATEGORIES OF RECIPIENTS OF PERSONAL DATA PROMECO may communicate your personal data to the following categories of recipients:

• Partners or other parties involved in the management and execution of an agreement between you and us;
• Third party service providers, such as external counsels, duly appointed and instructed by PROMECO as data processors;
• Regulatory authorities and other competent judicial and administrative authorities, if required by law;
• Any other third party to which you authorize the disclosure of personal data.

4. PROCESSING METHOD AND RETENTION PERIOD The processing of your personal data will be carried out with manual and/or computerized and telematics in order to guarantee the security, integrity, availability and confidentiality of the personal data of yours Your personal data are stored for the duration necessary for the operations for which they were collected and in any case no longer than 10 (ten) years from termination of the agreement, from the last contact between you and us or any litigation in which we may be involved in.

5. DATA PROVIDING We wish to inform that, taking into consideration the aim of data processing as specified at point 2.1, data providing is mandatory and their missed, partial or wrong communication might led to the impossibility to carry out the professional service.

6. DATA TRANSFERS No transfers of personal data are made by Promeco to countries outside the European Union

7 DATA SUBJECTS RIGHTS Data subjects may at any time have the right to access, rectification, erasure, portability, restriction or objection, including the right to object against decisions based solely on automated processing of personal data or the right to oppose their processing when data is processed for marketing purposes, or either on the basis of our legitimate interest, by sending an e-mail to promeco@promeco.it or a letter accompanied by a proof of identity to Promeco S.p.A, via Tevere 51 22073 Fino Mornasco, Como. Below is provided a brief explanation of your rights:

• (a) the right to access derives from your right to obtain confirmation as to whether or not your personal data are processed by PROMECO;
• (b) the right to rectification allows you to obtain without undue delay the rectification of your personal data which are inaccurate, as well as the right to have eventual incomplete personal data completed;
• (c) the right to erasure allows you to ask for the cancellation of your personal data, when a ground for such a request applies, such as, by merely way of example when the data are no longer necessary for the purposes for which they were collected;
• (d) the right to data portability allows you to receive your personal data provided to PROMECO in a structured, commonly used and machine-readable format. When applicable, you may have the right to transmit such a data to another data controller;
• (e) the right to restriction of processing allows you to request, where it is applicable in accordance with the applicable legislation, a restriction of processing. In this case, where the processing of personal data has been granted, PROMECO may retain certain processing in place for the sole purpose of defence of legal claims, for the protection of rights of other subjects.
• (f) the right of objection allows you to, where it is applicable in accordance with the applicable legislation, to object to processing of your personal data unless there are overriding interests, rights and freedoms or right to defence of PROMECO. In addition to the above, at any time you have the right to lodge a complaint before the relevant data protection authority, which for Italy is the Garante per la protezione dei dati personali (http://www.garanteprivacy.it), in case you believe you have not received adequate level of satisfaction from the exercising of your rights.