1 PRIVACY INFORMATION NOTICE REGARDING THE PROCESSING OF PERSONAL DATA
OF LEADS AND CLIENTS PURSUANT TO REGULATION (EU) 2016/679 (“GDPR”)

With reference to the processing of personal data provided by you under the contract signed with Gewiss S.p.A., the latter wishes to provide you, as the data subject, (the “Data Subject”), with the following information pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”).

1. DATA CONTROLLER
The Data Controller is Gewiss S.p.A. (the “Data Controller”), tax code and VAT number IT 00385040167, with registered offices in Via A. Volta, 1 - 24069 Cenate Sotto BG - Italy, email address privacy@gewiss.com.
The Data Controller, as part of its organisational structure, appoints the Authorised Persons for the processing of personal data, assigning them specific tasks and roles by means of a specific deed of appointment.

2. DATA PROTECTION OFFICER
The Data Controller has appointed a Data Protection Officer (DPO) pursuant to Articles 37 - 39 GDPR. If necessary, the DPO may be contacted at the following email address: dpo@pec.gewiss.com.

3. CATEGORIES OF PERSONAL DATA PROCESSED
The personal data (“Data”) being processed are “Common Data”, as specified in detail below:
- Forename and surname, general information, job title and contact details.

4. PURPOSE OF PROCESSING AND LEGAL BASIS
The Data processing is carried out on the basis of the following purposes:
a) Processing of database in Company CRM.
b) Registration to “MyGewiss” section reserved to all Gewiss clients;
c) Request for assistance by contacting the toll free number provided on the website/ “MyGewiss”;
d) Sending, by e-mail, informative communications ("Newsletter") to those who make an explicit request, by entering their e-mail address in the appropriate data collection form;
e) Marketing purpose: by way of example, sending - by automated means of contact (such as sms, e-mail, social account) and traditional (such as phone calls with operator and traditional mail) - promotional and commercial communications relating to services/products offered by the Company or invitation to/report corporate events or to participation/sponsorship/co-marketing company, as well as carrying out market studies and statistical analysis; sending advertising services online;
f) Profiling purpose: analysis of your preferences, habits, behaviors or interests in order to send you personalized commercial communications;
g) Marketing purposes of third parties: communication/transfer of your data to third parties for commercial and marketing purposes of the latter;
h) To fulfil obligations under applicable national and supranational regulations and legislation;
i) Purposes related to the establishment and execution of the contractual relationship between the Clients and Gewiss S.p.a.;
j) Execution administrative and accounting obligations - such as accounting and treasury management, as well as invoicing (for example, the verification and registration of invoices), in accordance with what is required by current legislation.
The processing of Data by the Data Controller for the aforementioned purpose is based on the following legal bases:
- For the purposes relating to point a) above, the legal base of the processing is the execution of a contract to which the data subject is party pursuant to art. 6, par. 1 letter b) GDPR;
- For the purposes relating to point b) above, the legal base of the processing is the execution of a contract to which the data subject is party pursuant to art. 6, par. 1 letter b) GDPR;
- For the purposes relating to point c) above, the legal base of the processing is the execution of a contract to which the data subject is party pursuant to art. 6, par. 1 letter b) GDPR;
2
- For the purposes relating to point d) above, the legal base of the processing is the execution of a contract to which the data subject is party pursuant to art. 6, par. 1 letter b) GDPR;
- For the purposes relating to point e) above, the legal base of the processing is the consent given by the Data Subject (optional and revocable at any time pursuant to art. 6, par. 1 letter a) GDPR;
- For the purposes relating to point f) above, the legal base of the processing is the consent given by the Data Subject (optional and revocable at any time pursuant to art. 6, par. 1 letter a) GDPR;
- For the purposes relating to point g) above, the legal base of the processing is the consent given by the Data Subject (optional and revocable at any time pursuant to art. 6, par. 1 letter a) GDPR;
- For the purposes relating to point h) above, the legal base of the processing is the need to comply with a legal obligation to which the Data Controller is subject pursuant to art. 6, par. 1 letter c) GDPR;
- For the purposes relating to point i) above, the legal base of the processing is the execution of a contract to which the data subject is party pursuant to art. 6, par. 1 letter b) GDPR;
- For the purposes relating to point j) above, the legal base of the processing is the need to comply with a legal obligation to which the Data Controller is subject pursuant to art. 6, par. 1 letter c) GDPR.
5. METHODS OF PROCESSING DATA
The Data will be processed by the Data Controller both in paper and digital form. The Data Controller may carry out operations of collection, registration, organisation, storage, consultation, processing, modification, extraction, comparison, use, interconnection, communication, erasure and destruction and any other appropriate operation in compliance with the provisions of the law necessary to guarantee the confidentiality and security of the Data as well as their accuracy, up-to-dateness and relevance to the stated purposes.

6. DATA STORAGE PERIOD
The Data will be stored according to the specific purposes for which they are processed, in particular:
a) Processing of database in Company CRM, the data will be stored for the duration of the contractual relationship and in any case for 10 years after the date of termination of the contract;
b) Registration to “MyGewiss” section reserved to all Gewiss Clients, the data will be stored for the duration of the contractual relationship or until the account cancellation request;
c) Request for assistance by contacting the toll free number provided on the website/ “MyGewiss”, the data will be stored for Data Subject registered to MyGewiss” section, until the account cancellation request; For the Data Subject not registered to the said section the data will be stored for 12 months.
d) Sending, by e-mail, informative communications ("Newsletter"), the data will be stored until
Data Subject asks to unsubscribe from the newsletter service.
e) Marketing purpose, the data will be stored until the withdrawal of the consent given and in any case for a period not exceeding 24 months;
f) Profiling purpose, the data will be stored until the withdrawal of the consent given and in any case for a period not exceeding 12 months;
g) Marketing purposes of third parties, the data will be stored until the withdrawal of the consent given;
h) Fulfilment of obligations under regulations and national and supranational applicable data will be kept for the duration of the contractual relationship and in any case for 10 years from the date of termination of the contract.
i) Purposes related to the establishment and execution of the contractual relationship between the Customer and the Company, the data will be kept for the duration of the contractual relationship and in any case for 10 years from the date of termination of the contract.
j) Fulfilment of obligations under regulations and national and supranational applicable data will be kept for the duration of the contractual relationship and in any case for 10 years from the date of termination of the contract.
In case of litigation, the Data will be conserved for the entire duration of the litigation process, until the time limits for available legal remedies are exhausted.
3
After the above-mentioned retention terms have expired, the Data will be destroyed, deleted or made anonymous.

7. CATEGORIES OF RECIPIENTS OF THE DATA
The Data collected by the Data Controller, within the scope of the above-mentioned purposes, may be communicated to one or more of the categories of subjects appointed as Data Processors as indicated in detail below, such as, for example:
• External companies offering email services;
• External companies offering website maintenance services;
• External companies that offer support in carrying out market studies;
• External companies offering marketing and telemarketing services;
• External business partners in sales, co-marketing or event organization;
• Commercial agencies;
• Professionals;
• Companies belonging to the Gewiss Group.
The Data may be communicated to external subjects acting as autonomous Data Controllers, for example authorities and supervisory and control bodies, other companies in the Gewiss Group and, in general, subjects, either public or private, entitled to request the Data.
A complete and up-to-date list of Autonomous Data Controllers, Data Processors and Data Recipients in any capacity (pursuant to art. 4, no. 9, of the GDPR), can be obtained from the Data Controller’s offices or by writing to the email address dpo@pec.gewiss.com.
8. TRANSFER OF DATA OUTSIDE THE EEA
The Data will be processed within the European Economic Area (EEA). If, for technical and/or operational reasons, it is necessary to use parties located outside the EEA, the processing of the data will be regulated in accordance with the GDPR, therefore, all necessary precautions will be taken in order to ensure the protection of the Data, pursuant to Article 46 of the GDPR.
9. RIGHTS OF DATA SUBJECTS
The Data Subject, in relation to the Personal Data provided, has the right to exercise at any time and in accordance with the provisions of the GDPR the rights established by the latter and shown below:
- Right to withdraw consent (art. 7, paragraph 3, GDPR): the right to revoke consent without prejudice to the lawfulness of processing based on consent granted before revocation.
- Data subject’s right of access (art. 15 GDPR): the right to obtain confirmation of the existence or otherwise of one’s personal data, and a copy thereof in intelligible form.
- Right to correction (art. 16 GDPR): the right to correct inaccurate personal data.
- Right to erasure, the “right to be forgotten” (art. 17 GDPR): the right to the erasure of one’s personal data.
- Right to the limitation of processing (art. 18 GDPR): the right to obtain the limitation of the processing of one’s own data, e.g., if the accuracy of the data is disputed or in the case of unlawful processing.
- Right to data portability (art. 20 GDPR): the right to receive in a structured, commonly used and machine-readable format one’s own personal data provided to the Controller and the right to transmit said data to another Controller if the processing is carried out on the basis of consent or a contract and by automated means.
- Right to object (art. 21 GDPR): the right to object to the processing of one’s personal data.
- Right not to be subject to automated decision-making (art. 22 GDPR): the right not to be subject to a decision based solely on automated processing.
You may assert your rights as set out in the GDPR by contacting the Controller directly at the following email address privacy@gewiss.com.

10. RIGHT TO LODGE A COMPLAINT (ART. 77 OF THE EU REGULATION)
If the data subject considers that their rights have been compromised or infringed, or that the processing of their Data is contrary to applicable law, they have the right to lodge a complaint with the competent Data Protection Authority.
11. NATURE OF THE PROVISION OF PERSONAL DATA
The provision of data marked with an asterisk (*) is necessary for processing the database in CRM or, in the event that you are registering in the “MyGewiss” section, to create a special account to use the services offered by the Company; the refusal to provide the aforementioned data does not, therefore, allow you to use the services.
For the purposes referred to in point i) above, the provision of data is necessary for the establishment of the contractual relationship.
For the purposes set out in point h) and j) above, the transfer is necessary for the fulfilment of legal obligations. The provision of data for marketing purposes (point e) above), as well as for profiling purposes (point f) above) and data transfer to third parties (point g above)), is instead entirely optional: the processing will be carried out by the Data Controller only with its express and unequivocal consent, without prejudice to your right to revoke the consent given at any time.