PRIVACY POLICY: EU Regulation No. 2016/679 (“GDPR”)

INFORMATION REGARDING THE PROCESSING OF PERSONAL DATA

Subject of Processing Irritec S.p.a. processes personal data, identifiable information (e.g., name, surname, company name, address, telephone number, email, banking and payment details) – hereinafter referred to as “personal data” or simply “data”), provided by you.

Purposes of Processing Your personal data are processed:

A) Without your express consent (Art. 6 letters b), e) GDPR), for the following Service Purposes:

• to conclude contracts for goods and services provided by Irritec S.p.a.;
• to fulfill pre-contractual, contractual, and tax obligations deriving from relationships with you;
• to comply with obligations required by law, regulations, EU legislation, or orders from Authorities (e.g., anti-money laundering measures);
• to exercise the rights of Irritec S.p.a., such as the right to defense in legal proceedings;

B) Only with your specific and separate consent (Art. 7 GDPR), for the following Marketing Purposes:

• to send you via email, postal mail, and/or SMS and/or phone contacts, newsletters, commercial communications, and/or advertising material on products or services offered by the Data Controller and to assess the degree of satisfaction regarding the quality of services;
• to send you via email, postal mail, and/or SMS and/or phone contacts, commercial and/or promotional communications from third parties (e.g., service providers, business partners, other companies in the Group). Please note that if you are already our customer, we may send you commercial communications related to services and products similar to those you have already used, unless you object.

Methods of Processing The processing of your personal data is carried out using the operations specified in Art. 4 No. 2) GDPR, including: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion, and destruction of data.

Your personal data are processed both electronically and/or automatically.

For each of the processing purposes listed above, the following table specifies the maximum retention period for your personal data, after which we will no longer process your personal data for the aforementioned purposes.

At the end of the processing period, your data will be deleted or destroyed.

Data Access Your data may be made accessible for purposes under Art. 2.A) (contractual obligations) and 2.B) (advertising communications):

• to employees and collaborators of the Controller or Group companies in Italy and abroad, as authorized internal processors and/or system administrators;
• to third-party companies or other entities (e.g., banks, professional firms, consultants, etc.) performing outsourced activities on behalf of the Controller, as external data processors.

Data Disclosure Without the need for express consent (Art. 6 letters b) and c) GDPR), Irritec S.p.a. may disclose your data for purposes under Art. 2.A) to Supervisory Bodies, Judicial Authorities, as well as to those subjects to whom communication is mandatory by law for the fulfillment of said purposes. These entities will process the data as independent data controllers. Your data will not be disclosed.

Data Transfer Personal data is stored on servers located in Italy, within the European Union. However, the Controller may, if necessary, transfer servers outside the EU. In this case, Irritec S.p.a. ensures that the transfer of data outside the EU will comply with applicable legal provisions, including the standard contractual clauses provided by the European Commission.

Nature of Data Provision and Consequences of Refusal to Respond The provision of data for purposes under Art. 2.A) is mandatory. Without them, we cannot guarantee the Services under Art. 2.A).

The provision of data for purposes under Art. 2.B) is optional. Consent can be given through the signing of a specific notice. You may choose not to provide any data or subsequently deny the possibility of processing data already provided: in such cases, you will not receive newsletters, commercial communications, or advertising material related to products and services offered by Irritec S.p.a. You will still have the right to the Services under Art. 2.A).

Rights of the Data Subject As the data subject, you have the rights specified in Art. 15 GDPR, including:

• obtaining confirmation of the existence of personal data concerning you, even if not yet recorded, and their communication in an intelligible form;
• obtaining information about: the origin of personal data; the purposes and methods of processing; the logic applied in case of processing carried out with the aid of electronic tools; the identity of the data controller, data processors, and designated representatives under Art. 3, paragraph 1, GDPR; the entities or categories of entities to whom personal data may be disclosed as designated representatives in the territory of the State, data processors, or persons in charge;
• obtaining: updating, rectification, or integration of data; erasure, anonymization, or blocking of data processed unlawfully, including data that do not need to be retained for the purposes for which they were collected or subsequently processed; certification that the operations mentioned have been made known, also regarding their content, to those to whom the data has been communicated or disclosed, except in cases where this proves impossible or involves a disproportionate effort compared to the right being protected;
• objecting, in whole or in part: for legitimate reasons to the processing of personal data concerning you, even if pertinent to the purpose of collection; to the processing of personal data concerning you for the purpose of sending advertising or direct sales material or for conducting market research or commercial communication, through the use of automated calling systems without operator intervention, by email and/or through traditional marketing methods by telephone and/or postal mail. Please note that the data subject’s right to object to direct marketing, as mentioned above, also extends to traditional methods and that the data subject may choose to receive communications only through traditional methods or automated communications, or neither.

If applicable, you also have the rights under Articles 16-21 GDPR (Right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Supervisory Authority.

Exercising Rights You may exercise your rights at any time by sending:

• an email to privacy@irritec.com.

For any requests or complaints regarding the processing of your personal data, you may also send an email to privacy@irritec.com