PRIVACY INFORMATION MODEL

pursuant to and for the purposes of art. 13, of the EU Regulation 2016/679
relating to the protection of individuals with regard to the processing of personal data,
as well as the free movement of such data and which repeals Directive 95/46/EC

This information is provided pursuant to law No. 190 of 18 July 2018, of art. 13 of EU Regulation no. 2016/679 (“European general regulation on the protection of personal data”), as well as of law no. 506/2004 relating to the processing of personal data and the protection of privacy in the electronic communications sector. To this end, it is specified that the legal basis for data processing is that relating to Romanian legislation. Owner: NANOMID EMEA SRL, in the person of the administrator, Mr. Marco Nanì, (VAT/CF: RO39415291) with registered office at Street Ion Vidu n°15, Ap.1 - Judet Timis - 300225 - Municipiul Timisoara - ROMANIA informs pursuant to art. 13, EU Regulation no. 2016/679 (hereinafter “GDPR”) that your data will be processed in the manner and for the following purposes:

1. Object of the treatment

The Data Controller takes care of the protection of your personal data and complies with the applicable personal data protection legislation (Law n.190/18 and GDPR 2016/679). Your personal data are treated confidentially and are transferred to third parties only on the basis of the provisions of this Policy, or with your consent. We process the personal data that you provide us during the use of the website and/or after registration on the website and/or through the purchase process of nanomid products and during the execution of the relative contractual relations.

In particular, we deal with:

• personal, identifying and non-sensitive data (in particular, name, surname, tax code, VAT number, email, telephone number - afterwards, “personal data” or also “data”) provided directly by you, by registering on the site and/or requesting use of the individual services and products purchased through the nanomid site;
• data not directly provided by you - and in any case acquired within the limits of the provisions of'art. 14, paragraph 5, GDPR- whose transmission is connected to use of Internet communication protocols (by way of example, access to the page, quantity to of data transferred, status message after successful access, session ID numbers, IP addresses, URL addresses, etc.). These data allow you to reconstruct the path of your visits to the site.

2. Purpose of the treatment

Your personal data are processed:

A) without your express consent (art.24, lett. A), b), c), Privacy Code and art. 6, lett. b), e), GDPR), for the following Service Purposes:

• process a contract request or a pre-contractual request;
• execute pre-contractual measures taken at your request;
• to elaborate internal statistics;
• fulfill tax obligations deriving from existing relationships;
• fulfill the obligations established by law, by a regulation, by community legislation or by an order of authority to;
• prevent or discover activities to fraudulent or malicious abuse of the website;
• pursue a legitimate interest of the Data Controller or third parties, within the limits and conditions set out in annex art. 6, letter f), GDPR;
• exercise the rights of the Data Controller, (by way of example, the right to defense in court);

B) Only with your specific and unequivocal consent (Articles 23 and 130, Privacy Code and Article 7, GDPR), for the following Marketing Purposes:

• send via email newsletters, commercial communications and/or advertising material on products and/or services, different and/or dissimilar from those already purchased, offered by the Owner.

3. Nature of the provision of personal data

The provision of your data for the purposes described in point 2 is of a necessary nature.
In the absence of the provision, we cannot guarantee your registration on the Site, nor can we proceed with the sale of any product on our site.
The provision of data for the purposes described in point 2, lett. b), has an optional nature. You can therefore decide not to provide any data or withdraw the possibility of processing by us of data previously provided. In this case, you will no longer receive our newsletters, while it will continue to receive our services and you will retain the right to register on the site.

4. Processing methods

The processing of your personal data is carried out by means of the operations indicated in art. 4, Privacy Code and art. 4, no. 2), GDPR and more precisely: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data. The processing of your data will be based on the principles of correctness, lawfulness and transparency and may also be carried out through automated methods designed to store, manage and transmit them and will take place using suitable tools, as far as reason and state of the art are concerned, to guarantee safety and confidentiality through the use of appropriate procedures that avoid the risk of loss, unauthorized access, illegal use and disclosure.

5. Data retention period

The Data Controller will process personal data for the duration of the contract and for no more than 2 years from the collection of data for Marketing Purposes. After this retention period, the data will be destroyed or made anonymous.

6. Access to data

The personal data processed by the Data Controller will not be disclosed, or will not be disclosed to indeterminate subjects, in any possible form, including that of making them available or simple consultation. Instead, they may be communicated to workers who work for the Data Controller and to some external subjects who collaborate with them. In particular, your data may be made accessible to:

• employees and collaborators of the Data Controller;
• consultants authorized to manage the site and provide the related services (for example: customer services, complaints service, legal office, etc.), in their quality to Internal managers and/or persons in charge of the processing of personal data and/or system administrators;

Your data may also be communicated, within the strictly necessary limits, to persons entitled to access it by virtue of the provisions of the law, regulations, community regulations.

7. Disclosure of data

Without your express consent (pursuant to art. 24 letter a), b), d), Privacy Code and art. 6 lett. b), c), GDPR), the Data Controller may communicate your data for the purposes indicated to Supervisory Bodies, Judicial Authorities as well as to all the other subjects to whom communication is mandatory by law for the accomplishment of said purposes.

8. Data transfer

The management and storage of personal data will take place on the server of the owner and/or third party companies appointed and duly appointed as data processors, located within the European Union, or in accordance with the provisions of articles 45 and following, GDPR. The servers are currently located in the European Union. The data will not be transferred outside the European Union. In any case, it is understood that, should it become necessary to transfer the location of the servers, to Italy and/or the European Union and/or non-EU countries, this movement will always take place in accordance with Articles 45 and following, GDPR. In this case, however, the Data Controller ensures as of now that the transfer of non-EU data will take place in accordance with the applicable legal provisions by stipulating, if necessary,

9. Navigation data

During their normal activity, the IT systems and software procedures used to operate the site may acquire some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified (for example, parameters relating to the operating system and to the computer environment of the user). These data are used by the Data Controller for the sole purpose of obtaining anonymous statistical information on the use of the Site and to check its correct functioning and are deleted immediately after processing.

10. Cookies

While using the nanomid site, cookies are stored on your computer. Cookies consist of small text files that are saved on your computer and provide us with certain information. They are widely used in order to make websites work or operate more efficiently to improve the user experience, as well as to provide certain information to site owners. Our site uses cookies that remain on your computer for different times. Some expire at the end of each session and some stay longer so that when you return to our site, you can benefit from a better user experience. Web browsers allow you to exercise some control over Cookies through your browser settings. Most browsers allow you to block cookies or block cookies from certain sites. Browsers can also help you eliminate cookies when you close your browser. However, he should keep in mind that this could mean that any opt-outs or preferences he has set up on the site will be lost. Please consult the technical information relating to your browser for instructions. If you choose to disable the setting of cookies or if you refuse to accept a cookie, some parts of the service may not work properly or may be significantly slower. Should bear in mind that this could mean that any opt-outs or preferences that you have set up on the site will be lost. Please consult the technical information relating to your browser for instructions. If you choose to disable the setting of cookies or if you refuse to accept a cookie, some parts of the service may not work properly or may be significantly slower. Should bear in mind that this could mean that any opt-outs or preferences that you have set up on the site will be lost. Please consult the technical information relating to your browser for instructions. If you choose to disable the setting of cookies or if you refuse to accept a cookie, some parts of the service may not work properly or may be significantly slower.

11. Rights of the interested party

In your capacity as an interested party, you have the rights referred to in art. 15, GDPR and precisely the rights of:

• obtain confirmation of existence or not of personal data concerning you, even if not yet registered, and their communication in an intelligible form;
• get there indication: a) of the origin of personal data; b) of the purposes to and methods to of the treatment also through profiling; c) the logic applied in case of treatment carried out with law no aid of electronic instruments; d) the identity of the owner, managers and designated representative (DPO) pursuant to art. 3, paragraph 1, GDPR; e) the subjects or categories of subjects to whom personal data may be communicated or who can become aware of it in quality to appointed representative in the State, managers or agents;
• obtain: a) updating, rectification or, when interested, data integration; b) the cancellation, transformation into anonymous form or blocking of data processed in violation of the law, including those of which not is conservation required in relation to the purposes for which the data were collected or subsequently processed; c) certification that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case where this fulfillment proves impossible or involves a use of means manifestly disproportionate to the protected right;
• object, in whole or in part: a) for legitimate reasons to the processing of personal data concerning you, even if is relevant to the purpose of the collection; b) to the processing of personal data concerning you for the purpose of sending advertising materials or direct selling or for carrying out market research or commercial communication, by means of the use of automated call systems without the intervention of an operator by email and/or through modality to traditional marketing by telephone and/or paper mail. Please note that the right of opposition of'concerned, set out in point b) above, for purposes to of direct marketing through modality to automated extends to the traditional ones and the possibility remains to for l'interested to exercise the right of opposition, even if only partially. Therefore, interested puor decide to receive only communications through modality to traditional or only automated communications or neither of the two types of communication. Where applicable, it also has the rights referred to in articles 16- 21, GDPR (Right to rectification, right to oblivion, right to limitation of treatment, right to portability to of data, right of opposition), as well as is the right to lodge a complaint authority to Guarantor
• THE INTERESTED CAN AT ANY TIME, WITHDRAW THE CONSENT TO THE PROCESSING OF THE DATA PROVIDED. HOWEVER CAN HE BEHAVIOR UNABLE TO CONTINUE THE CONTRACTUAL RELATIONSHIP BETWEEN THE PARTIES.

12. How to exercise your rights

You have the right to ask the Data Controller for access to the Data concerning you, their correction or cancellation, the integration of incomplete Data, the limitation of the treatment; to receive the Data in a structured format, commonly used and readable by an automatic device; to revoke any consent given in relation to the processing of your sensitive data at any time and oppose, in whole or in part, the use of the Data; to lodge a complaint with the Authority, as well as to exercise the other rights recognized by the applicable discipline. You can exercise your rights at any time by sending: an email to: [email protected]

13. Minors

If the person providing the data is under the age of 16, this treatment is only lawful if and to the extent that such consent is given or authorized by the owner of parental responsibility for which the identification data is acquired.

14. Owner, manager and agents

NANOMID EMEA SRL, in the person of the administrator, Mr. Marco Nanì, (VAT/CF: RO39415291) with registered office at Street Ion Vidu n°15, Ap.1 - Judet Timis - 300225 - Municipiul Timisoara - ROMANIA. Mr. Marco Nanì can be contacted via the email address: [email protected]. The updated list of data processors and appointees is kept at the headquarters of the Data Controller.

15. DPO - Data Protection Officer

Cesare Tallarico – mail: [email protected]

16. DATA PROTECTION AUTORITY(DPA)

The authorities to guarantor of personal data to whom to submit any requests and/or complaints is:

Autoritatea Naţionala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (in English: National Supervisory Authority for Personal Data Processing)

• Address: 28-30 G-ral Gheorghe Magheru Bld., District 1, post code 010336, Bucharest, Romania
• Website: dataprotection.ro

17. Changes to this Policy

This information notice canor under go variations. We therefore recommend that you regularly check this Policy and refer to the most updated version.

18. MANIFESTATION OF CONSENT

By registering on the nanomid site and/or using and purchasing the products on the nanomid site, the user expresses the unequivocal desire to give consent to the processing of the data provided by him in compliance with this information.