INDUSTRY PURCHASE PROGRAM - PRIVACY POLICY

The company ASG International S.r.l. in the person of its legal representative p.t. with registered office in Via dell'industria, 9 - 36065, Mussolente (VI) Pec: [email protected] Peo: [email protected] (hereinafter referred to as "Holder"),

in its capacity as Data Controller of personal data pursuant to Article 1 of Legislative Decree No. 196 of 30 June 2003 - Privacy Code (hereinafter the "Code") and Articles 4, no.7) and 24 of EU Regulation 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data (hereinafter the "Regulation") informs the user, pursuant to Art. 13 of the Regulation that it will process personal data relating to individuals who have registered on the sciconsports.com website and wish to join the "Scicon Sports Industry Purchase Program".

1. Foreword

Under the European Data Protection Regulation (GDPR), legal persons are not considered data subjects and therefore GDPR does not apply. However, if personal data referring to a natural person (e.g. a company contact person) is collected in the context of the collection of corporate data, this person will be considered a data subject under the aforementioned regulation, with the consequent applicability of the relevant legislation.

2. Object of processing

The data processed are personal data, contact information, work information.

The provision of the requested data is compulsory as it is necessary to perform the service and any refusal to provide such data may result in the contractual relationship not being completed or maintained.

Processing will be carried out by digital and/or analogue means. The data will not be subject to public dissemination.

3. Purpose of processing and legal bases

The data will be processed to enable the performance of activities connected with the establishment and management of the service requested from the Controller.

The personal data indicated in Article 1 will be used for:

1. enrolment in the Scicon Sports Industry Purchase Programme
2. bookkeeping and administrative management
3. performance of contractual obligations
4. the defence of a right in litigation

In relation to points i to iii it is noted that the processing is necessary for the performance of a contract to which the data subject is party; for accounting and administrative purposes; for the legitimate interest of the data controller in exercising or defending its rights.

The data will be processed lawfully, fairly and confidentially, in compliance with the appropriate security measures as set out in the Code and the Regulation.

4. Modalities of processing

The Owner will process personal data for as long as necessary to fulfil the above-mentioned purposes and in any case until the User unsubscribes from the programme. Limited to work information with which the User demonstrates compliance with the condition that membership of the programme is restricted to employees of companies working in the field of sport, this will be deleted once the condition of participation has been fulfilled.

Data may be kept for a longer period in the event of litigation.

5. Communication of data

The Controller may communicate the data for the purposes set out in Article 2 to:

• to Entities, companies, or entities that have relations with ASG International S.r.l. in support of the pursuit of the statutory purposes that perform outsourcing activities on behalf of the Data Controller, in their capacity as external data processors;
• to companies that carry out management and maintenance activities for electronic communication equipment and related obligations on behalf of ASG International S.r.l.;
• to judicial and police authorities or other public administrations for the fulfilment of regulatory obligations;

6. Data Storage and Transfer

The management and storage of personal data will take place on servers located both within the European Union and in non-EU countries of the Data Controller and/or third party companies appointed and duly appointed as Data Processors. In relation to export to non-EU countries, the Data Controller guarantees that the non-EU transfer takes place in compliance with Articles 44-47 Chapter V of the GDPR through the signing of standard contractual clauses and/or through the adequacy decision of 10 July 2023.

The list of data processors can be found at the head office.

7. Rights of the data subject

The subscriber, in his capacity as data subject, has the rights set out in Article 15 of the Regulation, namely:

7.1. The data subject shall have the right to obtain confirmation as to whether or not personal data concerning him/her exist, even if not yet recorded, and communication of such data in intelligible form.

7.2. The person concerned has the right to be informed:

• the origin of personal data;
• the purposes and methods of processing;
• the logic applied in the event of processing carried out with the aid of electronic instruments;
• the identification details of the owner, the persons responsible and the representative;
• of the entities or categories of entity to whom or which the personal data may be communicated or who or which may become aware of them in their capacity as designated representative(s) in the territory of the State, data processor(s) or person(s) in charge of processing.

7.3. The data subject has the right to obtain:

• updating, rectification or, when interested, integration of the data;
• the cancellation, transformation into anonymous form or blocking of data processed in breach of the law, including data whose storage is not necessary in relation to the purposes for which the data were collected or subsequently processed;
• certification to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected.

7.4. The data subject has the right to object, in whole or in part:

• for legitimate reasons to the processing of personal data concerning him/her, even if pertinent to the purpose of collection;
• the processing of personal data concerning him/her for purposes not covered by Art. 2.

Also pursuant to Articles 15 et seq. of the GDPR, the supplier has the right to request at any time, access to his personal data, rectification or deletion thereof, restriction of processing in the cases provided for by Article 18 of the GDPR, obtain in a structured, commonly used and machine-readable format the data concerning him, in the cases provided for by Article 20 of the GDPR. At any time, the supplier may revoke pursuant to Article 7 of the GDPR the consent given; lodge a complaint with the competent supervisory authority pursuant to Article 77 of the GDPR if he considers that the processing of his data is contrary to the legislation in force.

The subscriber may formulate a request to object to the processing of his or her personal data pursuant to Article 21 of the GDPR in which he or she must give evidence of the reasons justifying the objection: the Data Controller reserves the right to assess the request, which would not be accepted in the event of the existence of compelling legitimate grounds for processing that prevail over the interests, rights and freedoms of the user.

The interested party may at any time exercise the rights referred to in the preceding article by sending a registered letter or email/pec to the above addresses.

Date: 31/01/2024