UPHOLSTERY DRUETTA SAS by GABRIELE DRUETTA & C.

Registered office: Via Pollano 13, 12033 Moretta (CN)
Tel. 017293191 Mob. +39 348 5403467 e-mail: info@tappezzeriedruetta.it VAT number: 03911560047

Last modified: December 2020

Information on the processing of personal data

Information pursuant to art. 13 of the European Regulation 679/2016 on the protection of personal data [GDPR] INTERESTED PARTIES: Customers, users and consumers and potential customers, users or consumers.

UPHOLSTERY EDRUETTA

1953

In accordance with the requirements set by the GDPR, the Data Controller provides the interested party with the following information in relation to the processing of personal data carried out. Antonello Druette, in the capacity of Data Controller of your personal data, hereby informs you that the aforementioned legislation provides for the protection of data subjects with respect to the processing of personal data and that this treatment will be based on principles of correctness, fairness, transparency and protection of your privacy and your rights. Your personal data will be processed in accordance with the legislative provisions of the aforementioned legislation and the confidentiality obligations set forth therein.

HOLDER OF THE TREATMENT
Company name: UPHOLSTERY DRUETTA SAS DI GABRIELE DRUETTA & C. - Via Pollano 13 - 12033 Moretta (CN), telephone 0172 93191, e-mail info @ Tapperiedruetta.it, VAT 03911560047, Legal representative and Privacy contact: Gabriele Antonello

ORIGIN, PURPOSE, LEGAL BASES and NATURE OF THE DATA PROCESSED
The data collected from the interested party are essential for the execution of the contract with the customer and for the performance of all the activities functional to the fulfillment of contractual and pre-contractual obligations, management and execution of the activities essential to provide the customer with the service / product established and related accounting.

1. Customer management - 2. Dispute management - 3. Monitoring of contractual obligations - 4. Planning of activities - 5. Detection of the degree of customer satisfaction - 6. Information to customers of new services / products - 7. Protection services of consumers and users - 8. Accounting or treasury management - 9. Sending information and / or advertising material also by telephone or internet.

For the purposes from 1 to 6, the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same. For purposes 7 and 8, the processing is necessary to fulfill a legal obligation to which the data controller is subject. For purposes 9, the consent of the interested party is required. The consent can be acquired in writing at the bottom of the information or through a conclusive behavior such as the choice not to unsubscribe from our newsletter, an opportunity that is proposed at the bottom of the emails received via MailChimp. Consents received in writing are filed in a special dossier in alphabetical order. In the event that consent is denied, the documentation and / or advertising material will no longer be sent.

Personal data processed: name, e-mail address, telephone and mobile number, residential address, tax code and other personal identification numbers, bank details, nature of the assets, economic, commercial, financial and insurance activities.
Particular data processed: NONE
The "special" data (sensitive data) are those defined by art. 4 of Legislative Decree 196/03 ("Code") and by articles 9 and 10 of Regulation 2016/679 / EU ("GDPR"). These data are processed in compliance with the provisions of the Code and the GDPR as well as in the light of the General Authorization n. 4/2016, of the General Authorization n. 7/2016 and the Authorizations for the processing of judicial and sensitive data, by the Data Controller on the legal bases as provided for by art. 9.

RECIPIENTS OF PERSONAL DATA
The communication of your personal data is envisaged, carried out on the legal bases provided for by article 6 previously defined, to the following third parties:

Judicial Offices - Consultants and freelancers also in associated form - Companies and enterprises - Banks and credit institutions - Social security and welfare bodies - Other public administrations - Professional associations and boards - Employers - Associations of entrepreneurs and companies, - Trade unions and patronages - Joint labor organizations - Parent companies - Subsidiaries and associated companies - INPS - Ministries (economy and finance) - INAIL - ASL - Hospitals and Regions - Judicial authorities - Chambers of commerce - industry - crafts and agriculture.

These bodies, organizations, companies and professionals act as Data Processors appointed by Druette Antonello or are themselves Data Controllers.

of the personal data transmitted to them.
Your personal data, or the personal data of third parties in its ownership, may also be communicated to external companies, identified from time to time, to which Druette Antonello entrusts the execution of obligations deriving from the assignment received to which only the data will be transmitted necessary for the activities required of them. All employees, consultants, temporary workers and / or any other "natural person" who carry out their business on the basis of the instructions received from Druette Antonello, pursuant to art. 30 of the Code and art. 29 of the GDPR, are appointed "Data processors" (hereinafter also "Persons in charge"). To the persons in charge or to the Managers, eventually designated, Druette Antonello gives adequate operating instructions, with particular reference to the adoption and compliance with the security measures, in order to guarantee the confidentiality and security of the data. Precisely with reference to the protection aspects of personal data, you are invited, pursuant to art. 33 of the GDPR to report any circumstances or events from which a potential "breach of personal data (data breach)" may arise in order to allow immediate evaluation and the adoption of any actions aimed at countering this event by sending a communication to Druette Antonello at the addresses indicated below. Without prejudice to the obligation of Druette Antonello to communicate the data to Public Authorities upon specific request.

TRANSFER TO FOREIGN COUNTRIES (extra-EU) OR TO INTERNATIONAL ORGANIZATIONS
Transfer on the basis of an adequacy decision (Article 45) Commission Implementing Decision (EU) 2016/1250 of 12 July 2016, pursuant to Directive 95/46 / EC of the European Parliament and of the Council, on the adequacy of protection offered by the EU-US privacy shield regime [notified under number C (2016) 4176] (Text with EEA relevance) The online marketing platform called MailChimp managed by The Rocket Science Group LLC, a company headquartered in the State of Georgia in the United States. The Rocket Science Group LLC's servers and offices are located in the United States, so information may be transferred, stored, or processed in the U.S. MailChimp participates in and has certified its compliance with the EU-U.S. Privacy Shield Framwork. 'data sharing and saving activities the cloud solution called Dropbox managed by Dropbox International Unliited Company, a company based in Ireland Park Place, Hatch Street, Dublin 2 is used. The files stored by Dropbox are encrypted and stored on servers secure storage located in data centers in the U.S. Dropbox participates in and has certified its compliance with the EU-U.S. Privacy Shield Framwork.
The transfer abroad of your personal data can take place if it is necessary for the management of the assignment received. For the processing of information and data that will eventually be communicated to these subjects, the equivalent levels of protection adopted for the processing of personal data of its employees will be required. In any case, only the data necessary for the pursuit of the intended purposes will be communicated and the regulatory instruments provided for by articles will be applied. 43 and 44 of the Code and by Chapter V of the GDPR.

page 1 of 2

UPHOLSTERY DRUETTA SAS by GABRIELE DRUETTA & C.

Registered office: Via Pollano 13, 12033 Moretta (CN)
Tel. 017293191 Mob. +39 348 5403467 e-mail: info@tappezzeriedruetta.it VAT number: 03911560047

Last modified: December 2020

UPHOLSTERY EDRUETTA

1953

METHODS, LOGICS OF TREATMENT AND STORAGE TIMES
The treatment will last no longer than necessary for the purposes for which the data were collected.
Your data are collected and recorded in a lawful and correct manner for the purposes indicated above in compliance with the principles and provisions of art. 11 of the Code and 5 c 1 of the GDPR. The processing of personal data takes place using manual, IT and telematic tools with logic strictly related to the purposes themselves and, in any case, in order to guarantee their security and confidentiality.

NATURE OF THE PROVISION
The processing of personal data will be carried out for the following purposes: Purposes that do not require consent:

- Customer management - Dispute management - Monitoring of contractual obligations - Planning of activities - Consumer protection services

and users - Detection of the degree of customer satisfaction - Information to customers of new services / products - Accounting or treasury management. Purposes that require consent:

- Sending information and / or advertising material also by telephone or internet - Consent can be acquired in writing at the bottom of the information or through a conclusive behavior such as the choice not to unsubscribe from our newsletter, an opportunity that is proposed at the bottom of the mail received via MailChimp. Consents received in writing are filed in a special dossier in alphabetical order. In the event that consent is denied, the documentation and / or advertising material will no longer be sent.

Only with your explicit consent to be expressed at the bottom of this information, the data, the purposes of which require consent, will be processed. The conferment

of the data is in any case optional and will not cause prejudice in relation to the contractual relationship in place with the Data Controller
Your consent is not required for the data collected and used for needs related to the execution of activities related to the contractual relationship and the observance of the indicated legal obligations. Failure to communicate the aforementioned personal data will make it impossible to follow up on the relationship in question. Your consent is not required for the data collected and used for the legitimate interest of the Data Controller (letter f, art.6, of the GDPR). The communication of the aforementioned personal data is optional but necessary for the execution of the services offered by the Data Controller. Any refusal to communicate such data will make it impossible to provide all or part of the requested services

RIGHTS OF THE INTERESTED PARTIES (Articles 15 to 22 and Article 13 of the GDPR)
Right of access: The interested party has the right, according to the provisions of articles from 15 to 22 and from art. 13 of the GDPR to request the owner access to their personal data. Right of rectification: The interested party has the right, according to the provisions of articles from 15 to 22 and from art. 13 of the GDPR to request the owner to rectify their personal data. Right of cancellation: The interested party has the right, according to the provisions of articles from 15 to 22 and from art. 13 of the GDPR to request the owner to delete their personal data.
Right of limitation: The interested party has the right, according to the provisions of articles from 15 to 22 and from art. 13 of the GDPR to request the owner to limit the data concerning him.
Right of opposition: The interested party has the right, according to the provisions of articles from 15 to 22 and from art. 13 of the GDPR to oppose their treatment.
Portability right: The interested party has the right, according to the provisions of articles from 15 to 22 and from art. 13 of the GDPR to exercise their right to data portability. Right of revocation: The interested party has the right, according to the provisions of articles from 15 to 22 and from art. 13 of the GDPR to exercise their right to withdraw consent. Right of complaint: The interested party has the right, according to the provisions of articles from 15 to 22 and from art. 13 of the GDPR to exercise their right to lodge a complaint with the supervisory authority.

If you intend to request further information on the processing of your personal data or for the possible exercise of your rights, you can contact the aforementioned Privacy Contact in writing directly.
The Data Controller reserves the right to make any changes deemed appropriate or made mandatory by current regulations to this information on the processing of personal data, at its sole discretion and at any time. On such occasions, users will be duly informed of the changes that have occurred. 25/05/2018