Data Protection Policy pursuant to article 13 of Italian Legislative Decree 196/2003 and article 13 of EU Regulation 2016/679

Pursuant to art. 13 of Italian Legislative Decree 196/2003 (hereinafter: “Data Protection Code”) and art. 13 of EU Regulation 2016/679 (hereinafter: “GDPR 2016/679”), laying down provisions for the protection of persons and other subjects relevant to the processing of personal data, we wish to inform you that the personal data provided by you will be processed in compliance with the aforementioned law.

Data Controller
The Data Controller is the company Freddy s.p.a. (hereinafter: “Company”)
Registered office
Via Santo Spirito, 14 - 20121 Milan (Mi)
Operating Office:
Via S. Rufino, 31, 16043 Chiavari GE
Contact
Phone +39 018559101
Fax +39 01855910300
E-mail info@freddy.com
PEC freddy@pec.freddy.it

Data Protection Officer (DPO)
The Company has appointed Mr. Dimitri De Ambroggi as Data Protection Officer (DPO), (Italian Tax Code DMBDTR79E16L682N) Via Prato Chiuso 1, Laveno Mombello (VA) – mobile: +39 338 6329855 – mail dpo@freddy.it.

Purpose for processing the data
- Necessary and mandatory processing of personal data
The Company will use the general personal data provided by you (i.e., name, surname, date and place of birth, tax code, vat number, address, phone number) for purposes relevant to commercial relations between us. The processing of the aforementioned personal data is necessary to provide the services requested and follow up on the relevant activities.
- Processing of optional personal data
The Company will use the optional personal data provided by you (i.e., favourite colours, preferred method of purchase, product lines) in order to improve and customise the offer of products and services and, in particular, for the following optional purposes for which your express consent is required:
• Profiling for a customised Client management: collection and analysis of the Client’s optional personal data (including quantities/spending amounts) in order to process, communicate and allow the Client to take advantage of company services designed according to their habits and propensity to consume.
• Sending of company promotions: sending via-email, mobile phone, fax, text message, picture message and other distance communication channels, promotional materials relevant to company products, services and offers.
• Survey of Client satisfaction and market research: use of data to survey the degree of client satisfaction compared to the use of company services, as well as market research at Points of Sale or by e-mail, phone, mobile, fax, text message, picture message and other distance communication channels relevant to offers of company products and services.
• Sending of information and advertising relating third-parties: sending of educational and promotional material relevant to third-party products/services and offers, at the Points of Sale or via e-mail, telephone, mobile phone, fax and other distance communication channels.
Personal data, mandatory or optional, may be processed by means of both paper and electronic files (including portable devices) and processed in ways strictly necessary to satisfy the aforementioned purposes.

Legal basis for the processing
The Company processes your personal data lawfully, where the processing:
• is necessary for the execution of a contract to which you are a participant, or for the execution of pre-contractual measures adopted upon request;
• is necessary to fulfil a legal obligation impending on the Company;
• is based on written consent for specific activities such as the sending of a newsletter by the company

Consequences of failure to communicate personal data
As regards the personal data relevant to the execution of the contract to which you are a participant or relevant to the fulfilment of a regulatory obligation, relevant to the keeping of accounting and tax records, as well as those relevant to the performance of the contract, failure to communicate your personal data prevents the execution of the contractual relationship.

Processing and storage methods
The processing shall be automated and/or manual, in compliance with the provisions of art. 32 of GDPR 2016/679 and Annex B of Italian Legislative Decree 196/2003 (arts. 33-36 of the Data Protection Code) on the subject of security measures, carried out by parties specifically appointed and in compliance with the provisions of art. 29 GDPR 2016/679.
We hereby inform you that, in compliance with the principles of lawfulness, limitation of the purposes and minimisation of the data, pursuant to art. 5 GDPR 2016/679, subject to your free and explicit consent expressed at the bottom of this document, your personal data will be stored for the period of time necessary to achieve the purposes for which they were collected and, subsequently, for the time that the Company is subject to storage obligations for tax or other purposes, envisaged, by the law or regulation.

Communication of data
Your personal data can be communicated to:
1. Internal and external personnel entitled, based on their positions and in compliance with the instructions given by the Controller, to process the data;
2. Parties that process data in execution of specific legal obligations

Dissemination of data - Profiling
Your personal data will not be subject to disclosure or any fully automated decision making process. The Company specifies that all of the data provided can be used for profiling clients, in order to improve relations between the Company and the same (article 22, paragraphs 1 and 4, of Regulation EU 679/2018).

Transfer of personal data
Your personal data can be transferred to European Union countries or third countries outside of the European Union, within the scope of the purposes identified herein.

Special categories of personal data
Pursuant to articles 26 and 27 of Italian Legislative Decree 196/2003 and articles 9 and 10 of the Regulation EU 2016/679, you may provide, to the company, data qualified as “special categories of personal data” and which, therefore, identify “racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data related to health or sex life”.
Such categories of data can be processed by the Company only subject to your prior free and explicit consent, in writing at the bottom of this document.

Existence of automated decision-making, including profiling
The Company in relation to what is specified in relation to the processing of optional data, specifies that it does not adopt any automated decision-making process. It specifies that all of the data provided can be used for profiling clients, in order to improve relations between the Company and the same (article 22, paragraphs 1 and 4, of Regulation EU 679/2018)

Rights of the data subject
It is possible to exercise the rights, at any time, recognised by current legislation (art. 7 of Italian Legislative Decree 196/2003, and articles 15 to 22 of EU Regulation 2016/679) among which are the following:
a) request confirmation regarding the existence or not of your personal data;
b) obtain information relevant to the purposes of the processing, categories of personal data, recipients or categories of recipients to whom the personal data have been or may be communicated and, where possible, the period of storage;
c) obtain the rectification and erasure of the data;
d) obtain the restriction of the processing;
e) obtain data portability, i.e. receive them from the data controller, in a structured and commonly used format that is machine readable, and forward them to another data controller without impediments;
f) object, at any time, and also in the event of processing for direct marketing purposes;
g) object to an automated decision-making process relevant to individuals, including profiling.
h) request, from the Data Controller, access, the rectification or erasure of your personal data, or the restriction of processing which concerns you or object to their processing, as well as the right to data portability;
i) withdraw consent at any time without prejudicing the lawfulness of the processing based on the consent given prior to the withdrawal;
j) lodge a complaint to a supervisory authority.

You can exercise your rights in the following ways:
• written request to Freddy S.p.A. via S. Rufino, 31 M, 16043 Chiavari (GE) ITALY
• e-mail: freddyinfo@freddy.it
• PEC: freddy@pec.freddy.it