Personal data processing policy pursuant to articles 13-14 of EU reg. 2016/679

Data Subjects: customers and third-party contacts at client companies.

ALIVA S.r.l. in its capacity as Data Controller, pursuant to and for the purposes of EU Regulation 2016/679 (hereinafter referred to as 'GDPR'), hereby informs you that the aforementioned legislation envisages the protection of data subjects with regard to the processing of personal data and that such processing shall be based on principles of correctness, lawfulness, transparency and protection of your privacy and rights.

Your personal data will be processed in accordance with the legislative provisions of the above-mentioned legislation and the confidentiality obligations provided for therein.

Purpose and legal basis of the process: Specifically, your data will be processed for the following purposes related to the fulfillment of legal obligations:

• mandatory legal obligations in fiscal, accounting, and social security matters;
• management of disputes;
• obligations under current laws.

Your data will also be used for the following purposes related to the performance of contractual or pre-contractual obligations:

• consulting activity;
• logistics management.

Your data will also be used for the following purposes necessary for pursuing the legitimate interest of the Data Controller:

• after-sales assistance;
• quality management;
• activity planning.

Furthermore, your personal data may be used, with your consent, for the following purposes:

• commercial and promotional purposes carried out by ALIVA S.r.l., its parent, subsidiary, and affiliated companies, and by I.V.A.S. Industria Vernici S.p.A. (Tax code/VAT No. 00124120403).

The provision of data for the aforementioned purposes is optional for you, and any refusal to process it does not compromise the continuation of the relationship or the adequacy of the processing itself.

Methods of processing: Your personal data may be processed in the following ways:

• outsourcing of processing operations to third parties;
• association or comparison of data from different public or private databases;
• data collection by electronic or telematic means;
• data collection from public records, lists, deeds, or documents;
• processing by means of electronic archives and/or software systems managed or programmed directly;
• manual processing by means of paper archives.

Each processing operation is carried out in compliance with the provisions of Articles 6 and 32 of the GDPR and through the adoption of the appropriate security measures provided therein.

Your data will only be processed by personnel expressly authorized by the Data Controller, specifically from the following categories of authorized personnel:

• production staff;
• area sales managers and agents;
• company management;
• distributors;
• shippers;
• administration office;
• customer orders office;
• shipping office;
• sales office.

Disclosure: Your data may be disclosed to external parties for the proper management of the relationship, specifically to the following categories of recipients, including all duly appointed Data Processors:

• banks and credit institutions;
• parent company COLFAMILY Srl (Tax code/VAT No. 03238610400);
• consultants and freelancers, also in associated form;
• within public and/or private entities where data disclosure is mandatory or necessary for compliance with legal obligations or is otherwise functional to the management of the relationship;
• armed forces;
• police forces;
• I.V.A.S. Industria Vernici S.p.A. (Tax code/VAT No. 00124120403);
• insurance companies;
• shippers, carriers, couriers, post offices, logistics companies.

Distribution: Your personal data will not be distributed in any way.

Your personal data may also be transferred, limited to the purposes mentioned above, to the following countries:

• EU countries;
• secure non-EU countries;
• the United States, based on a declaration of compliance with the security standards prescribed by Chapter V of EU Regulation 679/2016 GDPR.

Retention Period: We inform you that, in compliance with the principles of lawfulness, purpose limitation, and data minimization, pursuant to Article 5 of the GDPR, the retention period of your personal data is:

• established for a period no longer than necessary to achieve the purposes for which they are collected and processed for the execution and fulfillment of contractual purposes;
• established for a period no longer than four years after the mandatory legal periods have elapsed.

Data Controller: The Data Controller of the data, pursuant to the Law, is ALIVA S.r.l. (Via Bellaria, 40 , 47030 San Mauro Pascoli (FC); VAT no.: 04578750400, contactable at the following details email:privacy@aliva.it)

You have the right to obtain from the Data Controller the deletion (right to be forgotten), limitation, updating, rectification, portability, and opposition to the processing of personal data concerning you, as well as the right to exercise all the rights provided by Articles 15, 16, 17, 18, 19, 20, 21, 22 of the GDPR.

EU Reg. 2016/679: Articles 15, 16, 17, 18, 19, 20, 21, 22 - Rights of the Data Subject

1. The data subject has the right to obtain confirmation of the existence or otherwise of personal data concerning them, even if not yet recorded, its communication in an intelligible form, and the ability to file a complaint with the supervisory authority.
2. The data subject has the right to obtain the following information:
   • the origin of the personal data;
   • the purposes and methods of processing;
   • the logic applied in case of processing carried out with the aid of electronic instruments;
   • the identifying details of the Data Controller, the processors, and the designated representative pursuant to Article 5, paragraph 2;
   • the subjects or categories of subjects to whom personal data may be communicated or who may learn about them as designated representatives in the territory of the State, processors, or persons in charge.
3. The data subject has the right to obtain the following:
   • the updating, rectification, or, when there is an interest, the integration of data;
   • the deletion, transformation into anonymous form, or blocking of data processed in violation of the law, including data for which retention is unnecessary for the purposes for which the data were collected or subsequently processed;
   • the certification that the operations referred to in letters a) and b) have been notified, also as regards their content, to those to whom the data have been communicated or distributed, except in cases where this proves impossible or involves the use of means manifestly disproportionate to the protected right;
   • the portability of data.
4. The data subject has the right to object, in whole or in part:
   • for legitimate reasons to the processing of personal data concerning them, even if relevant to the purpose of collection;
   • to the processing of personal data concerning them for the purpose of sending advertising material or direct sales or for carrying out market research or commercial communication.