DATA PRIVACY INFORMATION DISCLOSURE PURSUANT TO ARTICLE 13 OF EUROPEAN REGULATION NO. 679/2016 (GDPR)

DATA CONTROLLER

Istituto Ganassini Spa di Ricerche Biochimiche, with headquarters in Via P. Gaggia 16, 20139 Milan - VAT No. 00885180158, hereinafter the "Data Controller", pursuant to Article 13 of European Regulation No. 679/2016 (hereinafter "GDPR") hereby informs you that personal data will be processed in the manner and for the purposes specified below.

PURPOSE OF DATA PROCESSING

Personal data will be processed only with specific and distinct consent (Article 7 of the GDPR), for one or more of the following purposes:

Management of the relationship with the data subject (Customer and/or potential Customer) with reference to the purchase of products marketed by the Data Controller and related processing operations (delivery, billing, etc.)

Direct and indirect marketing activities, through the forwarding of promotional notices to the interested party using various communication methods indicated below

Management of information for possible personnel recruitment.

Responding to requests for information sent from contact pages and customer care procedures.

Any refusal to submit such personal data does not entail any consequence, except for the impossibility to send promotional and marketing notices and use the services described (or part thereof) offered by the Data Controller.

DATA RETENTION TIMES

For these purposes, the data will be stored for the time strictly necessary for the execution/management of the relationship with the Customer, including product recall requirements, in accordance with the provisions in force as well as, limited to direct and indirect marketing purposes, for a period consistent with the purposes and commercial dynamics connected to the nature of the product itself. Personal data will be processed until the decision of the data subject, at any time, to oppose the related processing and/or to obtain the termination of the same and the deletion of data. With reference to the information for personnel recruitment, the same will be automatically deleted one year after receipt.

NATURE OF DATA PROVISION

The provision of data is voluntary, but any refusal to provide such data may render it impossible to perform the services pertaining to the relationship with the Customer.

In any case, consent for marketing purposes may be denied without entailing any burden or damage to the data subject in relation to his/her position towards the Data Controller.

TYPE OF DATA PROCESSED

Personal data, billing data as well as data relating to the business choices made limited to marketing purposes.

Professional data and Curriculum Vitae of the candidate for personnel recruitment.

PROCESSING METHODS

The processing of data may be carried out through manual, paper, computerised and electronic means with approaches strictly related to the indicated purposes and, in any case, adopting methods suitable for ensuring their security and confidentiality in accordance with the provisions of Article 32 of the GDPR (processing security).

SCOPE OF DATA DISCLOSURE

The data may circulate within the Data Controller company observing the necessary restrictions for the pursuit of the purposes indicated above and, in any case, in compliance with the security measures necessary to prevent data loss or disclosure.

The data or part thereof may be disclosed to other associated companies and service providers that process the data on behalf of the Data Controller. The data will not be disclosed in any other manner.

The data will be processed within the European Union.

RIGHTS OF THE DATA SUBJECT

The data subject may exercise the rights referenced in Articles 15 et seq. of the GDPR at any time, including:

RIGHT OF ACCESS:

the right to obtain confirmation as to whether or not personal data concerning you are being processed and, in this case, to obtain access to your personal data – including a copy of the same – and notification, among others, of the following information:

purposes of processing;

types of personal data processed;

recipients to whom these have been or will be disclosed;

data retention period or the criteria used;

existence of an automated decision-making process, including profiling.

RIGHT TO RECTIFICATION:

right to obtain, without undue delay, the correction of inaccurate personal data concerning yourself and/or the integration of incomplete personal data.

RIGHT TO DELETION:

right to obtain, without undue delay, the deletion of personal data concerning yourself, when:

a) personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;

b) consent has been revoked c) the data must be deleted to fulfil a legal obligation.

The right to deletion does not apply to the extent that the processing is necessary for the fulfilment of a legal obligation or for the performance of a task carried out in the public interest or for the assessment, exercise or defence of a right in court.

RIGHT TO RESTRICTION OF PROCESSING:

right to obtain the restriction of processing, when:

a) the data subject disputes the accuracy of the personal data;

b) processing is unlawful and the data subject opposes the deletion of personal data and requests instead that its use be restricted; c) the Data Controller no longer needs said data for processing purposes, but the personal data are necessary to the data subject for the assessment, exercise or defence of a right in court; d) the data subject has opposed the processing.

RIGHT TO OBJECT:

the right to object, at any time, to the processing of personal data concerning yourself based on the condition of legitimacy of legitimate interest, including profiling, unless there are legitimate reasons for the Data Controller to continue the processing that prevail over the interests, rights and freedom of the data subject or for the assessment, exercise or defence of a right in court.

RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY:

right to lodge a complaint with the Data Privacy Guarantor Authority.

RIGHT TO RECEIVE INFORMATION ON THE ORIGIN OF PERSONAL DATA:

if said data have not been collected from the data subject

Consent given for processing may be revoked at any time causing the processing to be interrupted and making it impossible for the Data Controller to continue to use the data for the purpose in relation to which consent was denied.

These rights may be exercised against the Data Controller as identified above by sending an email to "privacy@ganassini.it" or by registered letter with return receipt sent to "Privacy - Istituto Ganassini SpA di Ricerche Biochimiche, Via Gaggia 16, 20139 Milan".

COOKIE POLICY

The website uses cookie technology.

Cookies are used for various purposes, including the management of the authentication procedure, monitoring of browsing sessions, the storage of configuration information and preferences and more. Processing of the data stored in cookies occurs with the aid of automated IT and electronic tools, with an approach strictly related to the purposes expressed above and, in any case, in order to guarantee the security and confidentiality of the data.

Cookies can be of a technical or profiling nature.

Technical cookies (which do NOT require consent)

According to current legislation in Italy, technical cookies do not require explicit consent, i.e. those used for the sole purpose of managing browsing or to provide an explicitly requested service.

Technical cookies include:

- cookie analytics, when used directly in aggregate form by the website manager to collect information on the number of users and how they visit the website,

- browsing or session cookies (for authentication, purchasing, etc.), - functionality cookies, which enable the user to browse according to a series of selected criteria (for example, language, products selected for purchase) in order to improve the service.

Profiling cookies (which require explicit CONSENT):

Profiling cookies are designed to create profiles relative to the user and are used to send advertising messages in line with the preferences expressed by the user during website navigation.

Given that such devices can be particularly invasive in terms of user privacy, legislation requires users to be properly informed about the use of the same and thus express their valid consent.

Profiling cookies require the prior acquisition of the user's free informed consent, which the Site acquires in the forms prescribed by the Provision through the banner that appears on the first visit as well as through the extended information disclosure that enables the user to grant or deny the relative consent.

Blocking cookies

Users can select which cookies to authorise through the appropriate procedure and may also authorise, block or delete cookies (in whole or in part) also through the specific functions of their browser.

If all cookies are disabled, certain services or features of the website will not be available or may not work properly. In this case, Users may have to modify or manually insert certain information or preferences whenever they visit the website.

As already displayed in the banner that appears immediately when you visit the Website, consent to the use of cookies will be available to the User by selecting the virtual acceptance button or by continuing to browse the Website (ignoring the banner/pop-up and performing other operations).

Users will also have free access to the link to the extended information disclosure, with all the information relating to cookies (description, purpose and storage), where website Users may express consent only for certain categories of cookies.