Cedral Tassoni spa, with registered office in Viale M.E. Bossi 3/5, Salò (BS), VAT no. 00295980171, in its role as the Data Controller, hereby notifies the data subjects (hereinafter the "Data Subjects") of the company's privacy policy pursuant to art. 13 of the (EU) regulation 2016/679 (hereinafter the “GDPR”).

Cedral Tassoni spa, in its role as Data Controller, undertakes to protect the data subjects’ privacy and rights and, in compliance with the principles set out in the aforementioned regulation, the data processing activities provided will be governed by the principles of fairness, lawfulness and transparency.

Cedral Tassoni Spa has appointed 5.0 Datasolutions srl, in the person of Annika Rodegher, as Data Processor and the latter may be contacted at the following e-mail address: dpo@cedraltassoni.it

1. PURPOSES OF PROCESSING

This notice applies to the website of Cedral Tassoni spa. Data Subjects may spontaneously provide their personal data which will be processed and utilized by Cedral Tassoni spa for purposes associated with the service requested, as described in specific notices which are published or appear on the website pages with regard to certain services or requests.

The Data Subjects' personal data will be processed by Cedral Tassoni spa for the purposes relating to and/or associated with the provision of services by the Company in the ambit of browsing activities on the company website, such as the provision of services requested by the Data Subject when browsing the website, comprising the collection, storage and processing of data for the purposes of implementation and subsequent operational and technical management.

Such data – whose provision is necessary for the operative performance of the service - will be processed using electronic means, recorded in special databases, and strictly and exclusively used in the ambit of website browsing activities.

Since the provision of the data subject's personal data for the aforementioned purposes is essential for the maintenance and provision of all services associated with website browsing activities, failure to communicate such data will make it impossible to provide the specific services.

Cedral Tassoni spa may also process personal data, without the data subject's consent, in the following circumstances:

1. when carrying out an anonymous and collective analysis of service utilization, in order to identify the data subjects' habits and tastes, to improve the services provided and to satisfy certain user requirements, in other words to adopt measures associated with improving the services provided;
2. in compliance with Italian and international legal provisions and regulatory norms, or to carry out an order issued by the Court of Law or by any other authorities to which Cedral Tassoni spa is subject;
3. to exercise the rights of Cedral Tassoni spa with particular regard to its legal defence.

Legal processing activities are lawful in as much as they are carried out in compliance with legal provisions and regulations and with the rights exercised by Cedral Tassoni spa.

2. PROCESSING METHODS

Data processing may be carried out electronically and/or manually, by recording, processing, storing and transferring data, also with the support of computerized systems.

The equipment and supports used to carry out data processing activities are adequate to guarantee data security and privacy.

In the performance of its data processing activities, Cedral Tassoni spa undertakes to:

• ensure the accuracy and updating of the processed data and to promptly respond to any request for rectification and/or supplementations submitted by the data subject;
• adopt appropriate security measures to guarantee adequate data protection, in view of the potential impact data processing has on the data subject's fundamental rights and freedoms;
• inform the data subject of any infringement regarding his/her personal data, in due time and in the cases contemplated by the Law;
• ensure that processing activities comply with applicable legal provisions.

3. DATA COMMUNICATION AND DISCLOSURE

While it is understood that data communications are carried out in compliance with legal obligations, the data subject's personal data may be made known not only to Cedral Tassoni spa, but also to employees and external associates of Cedral Tassoni spa in their role as authorized data processors;

Personal data will not be disclosed.

4. DATA TRANSFER ABROAD

Personal data are stored and processed within the European Union.

In the event of any personal data processing activities being effected outside of the European Union, such activities will only take place on condition that appropriate security measures have been adopted, as stipulated by the relative legal provisions.

5. DATA STORAGE POLICY

Cedral Tassoni spa stores personal data in its own systems in a form which allows for the identification of data subjects according to the following criteria:

• for a period of time not exceeding the fulfilment of the purposes for which they are processed, unless otherwise required by legal or contractual obligations;
• to fulfil specific legal or contractual obligations;
• whenever applicable and lawful, or until the data subject requests their deletion.

6. THE DATA SUBJECT'S RIGHTS

Data subjects may exercise their rights, as provided for by articles 15 - 22 of the GDPR, such as:

Right of access: the right to obtain confirmation from Cedral Tassoni spa of the existence of personal data concerning them and, in this case, to obtain access to their personal data and further information regarding their origin, purposes, categories of processed data, recipients of data communication and/or transfer, etc.

Right of rectification: the right to obtain the rectification by Cedral Tassoni spa of inaccurate personal data, without undue delay, as well as the supplementation of incomplete personal data, together with the provision of a supplementary declaration.

Right of deletion: the right to obtain from Cedral Tassoni spa the deletion of personal data, without undue delay, in the event in which:

• their personal data are no longer required for processing purposes;
• the consent on which processing is based has been withdrawn and there are no other lawful grounds for processing;
• their personal data have been processed unlawfully;
• should their personal data have to be deleted to fulfil a legal obligation.

The right to oppose processing: the right at any time to oppose the processing of their personal data whose lawful grounds is a legitimate interest of Cedral Tassoni spa.

Right to restriction of processing: the right to obtain from Cedral Tassoni spa the restriction of data processing, whenever the accuracy of the personal data is contested by the data subject (for a period enabling the controller to verify the accuracy of the personal data), if the processing is unlawful and the data subject opposes its processing; if their personal data are required by the data subject for the establishment, exercise or defence of legal claims; if, following the data subject's opposition to processing verification is pending as to whether or not the legitimate grounds of Cedral Tassoni spa override those of the data subject.

Right to data portability: the right to receive the personal data concerning them, in a structured, commonly used and machine-readable format and to transfer such data to another controller, only in those cases in which processing is based on consent or on a contract and with sole regard to data processing carried out by electronic means.

The right not to be subject to automated decisions: the right to obtain from Cedral Tassoni spa not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects concerning the data subject or which may significantly affect him or her, unless such decisions are necessary for entering into or performing a contract or are based on the data subject's explicit consent.

The right to lodge a complaint with a supervisory authority: without prejudice to any other administrative or judicial remedy, any data subject who considers that the processing of the personal data concerning them infringes the GDPR is entitled to lodge a claim with the supervisory authority.

In order to exercise their rights provided for by the GDPR, Data subjects may:

1. forward their requests to Cedral Tassoni spa, through the website www.cedraltassoni.it/en/contacts
2. or, alternatively, contact the Data Controller at the following address:
   Cedral Tassoni spa
   
   Viale M.E. Bossi3/5, Salò (BS), Italy
   With subject “Privacy”..