WHO WILL MANAGE THE DATA (DATA CONTROLLER)?

Gi Group Holding S.p.A.

based in Piazza IV Novembre 5, 20124 Milan

e-mail: it.privacy@gigroupholding.com (“Gi Group Holding”)

HOW CAN I CONTACT THE DATA PROTECTION OFFICER (“DPO”)?

Piazza IV Novembre 5, 20124 Milan, to the attention of the “Data Protection Officer”

e-mail: dpo@gigroup.com

WHY ARE MY PERSONAL DATA PROCESSED AND WHAT ARE THE CONDITIONS THAT MAKES THE PROCESSING LAWFUL? HOW LONG WILL YOU KEEP MY PERSONAL DATA?

1. For the management of pre-contractual activities

Activities functional to the management of pre-contractual relations (planning and organizational management of activities, communication, at your request, of pre-contractual information, etc.). This may entail the transfer of your data to our local sales teams in the country from which you contact us. Local sales teams are part of one or more of our affiliates in the territory. See the “WHO ARE THE RECIPIENTS OF THE PERSONAL DATA?” paragraph for more information.

The legal basis applicable to the processing of personal data is the execution of pre-contractual measures taken at the request of the data subject, pursuant to Art. 6 (b) of the GDPR.

Data will be processed for 2 years from the date of collection.

2. Marketing of Gi Group Holding

Sending information and promotional communications from Gi Group Holding relating to the services offered by the same, or for carrying out of studies and statistical and/or market research.

Furthermore, this includes any content made available by Gi Group Holding upon completion of the “Contacts” form (e.g. white papers, reports, insights, etc.). Should you choose not to consent to the aforementioned purposes, you will not be able to download the content in question.

The legal basis that legitimizes the processing is consent, pursuant to Art. 6 (a) of the GDPR.

The data will be processed for 2 years from the date of collection or until the consent is withdrawn.

You may withdraw your consent to the processing of personal data for direct marketing purposes at any time. To do so, please click on the links provided in our communications or follow the steps indicated in the “WHAT ARE MY PRIVACY RIGHTS” paragraph.

Please note that the withdrawal of consent does not affect the lawfulness of the processing based on consent prior to the withdrawal.

Once the retention terms indicated above have elapsed, the personal data will be erased or rendered anonymous, compatibly with the technical cancellation and backup procedures.

WHO ARE THE RECIPIENTS OF THE PERSONAL DATA?

Personal data will be processed exclusively by employees of the company authorized to process data for the aforementioned purposes and who have received adequate operating instructions.

Personal data may be disclosed to the following categories of subjects that act as controllers:

• Gi Group Holding subsidiaries, even outside the European Economic Area. See https://www.gigroupholding.com/our-presence/ for more information.

Personal data may also be processed, on behalf of Gi Group Holding, by third parties designated as Data Processors. These subjects are included in the following categories:

• Site management and maintenance services;
• Customer database management and maintenance services;
• Storage services;
• Communications mailing services;
• Market research services.
  
  

DO WE TRANSFER DATA OUTSIDE THE EUROPEAN ECONOMIC AREA (EEA)?

Your data may be transferred abroad to the recipients referred to in the paragraph above outside the European Economic Area (“EEA”), to countries whose level of data protection has been deemed adequate by the European Commission under Article 45 of the GDPR (i.e. a transfer based on an adequacy decision); or, provided that the Gi Group Holding signs with the data importer the standard contractual clauses adopted/approved by the European Commission pursuant to Article 46(2)(c) and (d) of the GDPR.

In the absence of the aforementioned adequate safeguards, any transfer to countries outside the EEA will only be made on the basis of the exceptions provided for in Article 49(1)(b) and (c) of the GDPR (i.e., if the transfer is necessary for the performance of a contract between the data subject and the controller or for the implementation of pre-contractual measures taken at the request of the data subject or if the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person). Data subjects will be specifically informed of such transfers.

WHAT ARE MY PRIVACY RIGHTS?

Data subjects can ask the Data Controller for access to their personal data, their correction or cancellation, the integration of incomplete data, the limitation of processing in the cases provided for by art. 18 GDPR, as well as the opposition to processing or withdrawal of consent in case of data processed for direct marketing purposes.

Furthermore, for cases in which the processing is based on consent or the contract and is carried out with automated tools, data subjects have the right to exercise the right to data portability by receiving their personal data in a structured, commonly used and device-readable format, as well as, if technically feasible, to transmit them to another controller without impediments.

These rights can be exercised by sending an e-mail to it.privacy@gigroupholding.com

Data subjects have the right to lodge a complaint with the competent Supervisory Authority (in particular, in the Member State in which they usually reside or work or in the State in which the alleged violation has occurred).