EU Regulation No. 2016/679 (hereinafter, “GDPR”)

PRIVACY POLICY FOR PERSONAL DATA PROCESSING

Subject of Processing

1. CAPOREM S.R.L. processes personal, identifying data (for example, name, surname, company name, address, phone, e-mail, bank and payment details) – hereinafter “personal data” or “data”) that you provide in any case.

2. Purpose of processing

Your personal data are processed:

1. without your explicit consent (art. 6 lett. b), e) GDPR), for the following Service Purposes:
   1. to conclude contracts for goods and services provided by CAPOREM S.R.L.;
   2. to fulfill pre-contractual, contractual and tax obligations arising from existing relations with you;
   3. to comply with obligations provided by law, regulations, EU legislation, or orders from authorities (e.g., anti-money laundering);
   4. to exercise CAPOREM S.R.L.’s rights, such as the right to legal defense;
2. Only upon your specific and separate consent (art. 7 GDPR), for the following Marketing Purposes:
   1. to send you, via e-mail, mail, SMS and/or phone contacts, newsletters, commercial communications and/or advertising material on products or services offered by the Data Controller and to assess satisfaction regarding service quality;
   2. to send you, via e-mail, mail, SMS and/or phone contacts, commercial and/or promotional communications from third parties (e.g., service providers, business partners, other companies of the Group). Please note that if you are already our customer, we may send you commercial communications related to products and services similar to those you have already used, unless you object.

3. Processing methods

The processing of your personal data is carried out by means of the operations indicated in art. 4 no. 2) GDPR, namely: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion, and destruction of data.

Your personal data are processed both on paper and electronically and/or automatically.

For each of the processing purposes above, the following table specifies the maximum retention period of your personal data, after which we will no longer process your personal data for these purposes.

At the end of the processing period, your data will be deleted or destroyed.

4. Data access

Your data may be made accessible for the purposes referred to in art. 2.A) (contractual obligations) and 2.B) (advertising communications):

• to employees and collaborators of the Data Controller or Group companies in Italy and abroad, in their capacity as internal data processors and/or system administrators;
• to third-party companies or other entities (e.g., banks, professional offices, consultants, etc.) that perform outsourcing activities on behalf of the Data Controller, as external data processors;
• to third-party companies that have signed specific Co-Controller Agreements with CAPOREM S.R.L.;
• Co-Controller Agreements

Pursuant to Art. 26 of the GDPR, CAPOREM S.R.L. has signed co-controller agreements for the processing of personal data collected. The purposes and means of processing were jointly determined in individual contracts between the parties, and a summary of the content of the agreements is provided below:

5. Data disclosure

Without the need for explicit consent (art. 6 lett. b) and c) GDPR), CAPOREM S.R.L. may disclose your data for the purposes referred to in art. 2.A) to supervisory bodies, judicial authorities, as well as those entities to whom disclosure is mandatory by law. Such entities will process the data as independent data controllers. Your data will not be disseminated.

6. Data transfer

Personal data are stored on servers located in Italy, within the European Union. In any case, the Data Controller may, if necessary, move the servers outside the EU. In such case, CAPOREM S.R.L. ensures that the transfer of data outside the EU will comply with applicable legal provisions, through the use of standard contractual clauses provided by the European Commission.

7. Nature of data provision and consequences of refusal to provide data

Providing data for the purposes of art. 2.A) is mandatory. Without it, we cannot guarantee you the Services referred to in art. 2.A).

Providing data for the purposes of art. 2.B) is optional. Consent can be given by signing a specific privacy notice. You may therefore choose not to provide any data or to subsequently withdraw consent for data already provided: in this case, you will not receive newsletters, commercial communications, or advertising material regarding products and services offered by CAPOREM S.R.L. You will still have the right to receive Services referred to in art. 2.A).

8. Data subject rights

As a data subject, you have the rights under art. 15 GDPR, specifically the rights to:

• obtain confirmation of the existence or non-existence of personal data concerning you, even if not yet registered, and their communication in an intelligible form;
• obtain information regarding:
  1. the origin of personal data;
  2. the purposes and methods of processing;
  3. the logic applied in case of processing carried out using electronic tools;
  4. the identification details of the data controller, processors, and the designated representative under art. 3, paragraph 1, GDPR;
  5. the subjects or categories of subjects to whom personal data may be disclosed or who may become aware of it as the designated representative in the territory of the State, processors, or persons in charge;
• obtain:
  1. the update, correction, or, when interested, the integration of data;
  2. the deletion, anonymization, or blocking of data processed unlawfully, including those not required to be kept concerning the purposes for which the data were collected or subsequently processed;
  3. confirmation that the operations referred to in points a) and b) have been communicated to those to whom the data were disclosed or disseminated, except when such compliance is impossible or requires a manifestly disproportionate effort compared to the right protected;
• object, in whole or in part:
  1. for legitimate reasons, to the processing of personal data concerning you, even if relevant to the purpose of collection;
  2. to the processing of personal data concerning you for the purpose of sending advertising or direct sales material or conducting market research or commercial communication, using automated calling systems without operator intervention via e-mail and/or traditional marketing methods via phone and/or postal mail. Please note that the right of objection for direct marketing purposes extends to both automated and traditional methods, and you may choose to receive only traditional communications, only automated communications, or none.

Where applicable, you also have the rights under arts. 16-21 GDPR (right of rectification, right to erasure, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Supervisory Authority.

9. How to exercise rights

You may exercise your rights at any time by sending:

– an e-mail to info@costadorlando.com

In case of such requests or complaints regarding the processing of your personal data, you may still send an e-mail to info@costadorlando.com