COMPLETE INFORMATION POLICY FOR THE PROCESSING OF PERSONAL DATA THE FOLLOWING COMPANY

COMPANY NAME VIP GIOIELLI SRL ADDRESS VIA A.VOLTA,38 06135 PERUGIA (PG) e-mail, vipgioiellisrl@gmail.com tel. 075.5990622

IN THE PERSON OF: PONZIANI ANGELO

as Data Controller pursuant to Legislative Decree no. 196/2003 and subsequent amendments and EU Regulation 2016/679 informs you, pursuant to art. 13 of the Code and the Regulation, that it will process1 your personal data manually and/or with the support of IT tools for the purposes indicated below. Purpose of processing, legal basis and any third party recipients of the data Your personal data will be processed for purposes related to the management of ordinary commercial relationships and, specifically, for the compilation of personal data lists, the maintenance of customer/supplier accounts, invoicing, the performance of communications both by paper and IT means, the management of the creditor for the satisfaction of all obligations under current legislation. Your data may be processed for internal purposes of statistics and market research; gold buying operations. Furthermore, your data may be communicated to third parties, for technical and operational needs strictly connected to the purposes stated above and in particular to the following categories of subjects: a) entities, professionals, companies or other structures entrusted by us with the processing connected to the fulfillment of administrative, accounting and management obligations related to the ordinary performance of our economic activity, also for debt collection purposes; b) public authorities and administrations for purposes connected to the fulfillment of legal obligations; c) banks, financial institutions or other subjects to whom the transfer of the aforementioned data is necessary for the performance of our activity in relation to the fulfillment, on our part, of the contractual obligations undertaken towards you. d) suppliers of installation, assistance and maintenance services for computer and telematic systems and plants and of all services functionally connected and necessary for the fulfillment of the services covered by the Contract. Failure to provide personal data will make it impossible for us to execute contracts and other related obligations, as well as to correctly manage mutual commercial relations. We inform you that we may send you commercial and/or promotional communications relating to products and services similar to those covered by the contractual relationship, unless you disagree. Further purposes of processing 1 By processing of personal data we mean any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction. VIP GIOIELLI SRL REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Subject to your specific and separate consent, your personal data may also be processed for each of the following purposes: - sending by e-mail, post, text message, telephone contact, commercial and/or promotional communications or advertising material on products or services provided by our company or for measuring the degree of satisfaction with their quality. - transmission of your data to third parties (for example: business partners) in order to carry out information, commercial, advertising, promotional activities, including by sending communications using electronic or paper means. - profiling2, in particular for the creation of your commercial profile and/or for the analysis of your preferences, habits or consumer choices, including by cross-referencing such personal data with other information collected through profiling cookies accepted by you. Your consent for each of these purposes is optional and will not have any interference and/or consequence on the aforementioned purposes connected to the basic contractual relationship. Processing of special categories of personal data The following special categories of data (art. 9 of EU Regulation 2016/679) can be processed only with the consent of the interested party: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as processing genetic data, biometric data intended to uniquely identify a natural person, data relating to health or sexual life or sexual orientation of the person. Both your provision of data and your consent can be freely expressed, but your refusal will make it impossible for us to proceed with contracts and other related obligations, as well as to correctly manage mutual commercial relations. Data retention periods Your personal data will be retained for the time strictly necessary to carry out the purposes illustrated above and to comply with the obligations established by law. Rights of the interested party Pursuant to art. 7 of the Privacy Code and pursuant to articles 13, paragraph 2, and art. 15 to 22 of the Regulation, we inform you that in relation to the processing of your personal data you may exercise the following rights: 1. Article 15 Right of access by the interested party: The interested party has the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed; 2. Article 16 Right to rectification: The interested party has the right to obtain from the data controller without undue delay the rectification of inaccurate personal data concerning him or her; 3. Article 17 Right to erasure ('right to be forgotten'): The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay; 4. Article 18 Right to restriction of processing: where: The data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data; The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; The data subject has objected to the processing, pending verification whether the legitimate grounds of the controller override those of the data subject VIP GIOIELLI SRL REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data 5. Article 19 Obligation to notify in the event of rectification or erasure of personal data or restriction of processing: The controller shall communicate to each recipient to whom the personal data have been disclosed any rectification or erasure of personal data or restriction of processing. 6. Article 20 Right to data portability: The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and shall have the right to transmit those data to another controller without hindrance from the controller; 7. Article 21 Right to object: The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data concerning him or her pursuant to Article 6, paragraph 1, letters e) or f) of EU Regulation 679-2016, including profiling, in particular where: The processing is based on the legitimate interest of the controller, subject to the explicit explanation of the reasons for the objection; The personal data are processed for direct marketing purposes. 8. Article 22 Automated individual decision-making, including profiling: The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. (Profiling means “any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements” (art. 4 of EU Regulation 2016/679). The data controller, if he has made personal data public and is obliged to delete them, must inform the other data controllers who process the personal data of the request to delete any link, copy or reproduction of his data. It should be noted, however, that if the data processing was generated by the need to comply with legislative provisions for the exercise of economic/commercial activities, the deletion may only take place at the end of the period provided for by the aforementioned legislative provisions for the conservation of administrative/accounting documents. Right to lodge a complaint with the Guarantor for the protection of personal data, following the procedures and indications published on the official website of the Authority www.garanteprivacy.it. Right to withdraw consent at any time; obviously with all the consequences deriving from the impossibility of being able to comply with legislative or contractual provisions if the processing is established by such provisions. The exercise of rights is not subject to any formal constraint and is free of charge. Methods of exercising rights The interested party may at any time exercise the rights by sending: - A registered letter with return receipt: see table below - An e-mail to the address: see table below:

COMPANY NAME VIP GIOIELLI SRL ADDRESS VIA A.VOLTA,38 06135 PERUGIA (PG) e-mail, vipgioiellisrl@gmail.com tel. 075.5990622