INFORMATION EX ART 13 OF EU REGULATION N. 679/2016

With specific reference to personal data as defined by art. 4 paragraph 1 n. 1) of the EU Regulation no. 679/2016 (hereafter “Regulation”) which concern you as the subject “Interested”, the undersigned company Gi.mel S.r.l. (“Gimel”) (VAT number: 04016530729) with registered office in Putignano (BA), S.P. 237 per Noci, 24, in the person of its legal representative pro tempore, as” owner ” pursuant to art. 4 paragraph 1 n. 7) of the Regulation, provides you with the following information (valid and effective starting from 25.5.2018).

1.Nature and type of your data collected and processed.

1.1. Your data being processed fall exclusively within the category called “personal data” pursuant to art. 4 paragraph 1 n. 1) of the Regulation (“any information concerning an identified or identifiable natural person (” concerned “), the identifiable natural person can be identified, directly or indirectly, with particular reference to an identifier such as the name, an identification number , location data, an online identifier or one or more characteristic elements of its physical, physiological, genetic, psychological, economic, cultural or social identity “).

2. Information on “Owner”.

2.1. The subject “Data Controller” of the processing of your personal data pursuant to art. 4 paragraph 1 n. 7) of the Regulation is the company Gi.mel S.r.l. (“Gimel”) (VAT number: 04016530729) with registered office in Putignano (BA), S.P. 237 per Noci, 24, in the person of its legal representative pro tempore, which can be contacted by you at the following addresses: privacy@gimel.it

2.2. We inform you that any changes or updates regarding the data relating to the aforementioned subject will be properly published in the “Privacy” section on the website of the Owner.

3. Purpose of the processing.

3.1. In accordance with the art. 5 paragraph 1 letter b) of the Regulation, we inform you that your personal data will be collected and subsequently processed for the following purposes to:

• Execution of a contract of which you, as an “Interested” subject, are a party, as well as for the execution of the consequent legal or contractual obligations.

3.2. The purpose described above makes the processing in question lawful pursuant to and for the purposes of art. 6 paragraph 1 lett. b) and c) of the Regulation.

4. Subjects recipients of personal data collected and processed.

4.1. In accordance with the art. 13 paragraph 1 letter e) and f) of the Regulation, we inform you that your personal data may be disclosed to third parties, exclusively to fulfill the purposes better described in art. 3 above, established in the Italian territory or within the European Union or in a so called country. Third, with the exception of those considered “inadequate” by the European Commission pursuant to art. 45 of the Regulation.

5. Period of retention of personal data collected and processed.

5.1. In accordance with the art. 13 paragraph 2 letter a) of the Regulation, we inform you that the retention period of your personal data will coincide with the duration of the contractual relationship between the owner and you, possibly extendable in order to fulfill hypothetical processing operations subsequent to the termination of the contractual relationship or deriving by obligations of a civil / fiscal / fiscal nature or by the need to manage any out-of-court or judicial litigation promoted with regard to or by the Owner.

5.2. Your personal data will be processed with the support of paper, electronic or telematic means.

6. Principles applied to the processing of your data.

6.1. In accordance with the art. 5 of the Regulation, we inform you that your personal data will be:

• Treated in a lawful, correct and transparent way towards the interested party (so-called

principle of lawfulness, fairness and transparency);

• Collected for specific, explicit and legitimate purposes, and subsequently processed in ways that are not incompatible with these purposes (so-called purpose limitation principle);
• Appropriate, relevant and limited to what is necessary with respect to the purposes for which they are processed (so-called data minimization principle);
• Exact and, if necessary, updated (so-called accuracy principle);
• Stored in a form that allows identification of data subjects for a period of time not exceeding the achievement of the purposes for which they are processed (so-called conservation limitation principle);
• Treated in such a way as to ensure adequate security of personal data, including protection, through appropriate technical and organizational measures, unauthorized or unlawful processing and loss, destruction or accidental damage (so-called integrity and confidentiality principle).

7. Rights of the interested party.

7.1. In relation to your personal data processed by the Data Controller, we inform you that you have

the right to exercise the following rights:

Right of access of the interested party (Article 15 of the Regulation)

Right of rectification (Article 16 of the Regulation)

Right to cancel (Article 17 of the Regulation)

Right of limitation of treatment (Article 18 of the Regulation)

Right to data portability (Article 20 of the Regulation)

Right of opposition (Article 21 of the Regulation)

Right to propose a complaint to the supervisory authority (Article 77 of the Regulation)

Right to an effective judicial remedy against the supervisory authority (Article 78 of the

Regulation)

7.2. In accordance with the art. 12 paragraph 1 of the Regulation, Gimel undertakes to provide you with the communications referred to in Articles 15 to 22 of the Regulation in a concise, transparent, intelligible, easily accessible and with a simple and clear language: such information will be provided in writing or by any other electronic means or, at the request of the interested party, will be provided orally, provided that the identity of the interested party is proved by other means.

7.3. In accordance with the art. 12 paragraph 3 of the Regulation, the Holder informs you that he /she undertakes to provide you with information regarding the action taken regarding a request pursuant to Articles 15 to 22 without undue delay and, in any case, no later than one month after receipt of the request itself; this deadline may be extended by two months if necessary, taking into account the complexity and the number of requests.

7.4. In order to be able to exercise the rights described above in this article, the interested party can make use of the contact details specified in art. 2 of these “Information”.