PRIVACY NOTICE

pursuant to Article 13 of EU Regulation 2016/679 (“GDPR”)

Pursuant to and for the purposes of Article 13 of European Regulation 2016/679, we inform you that your personal data will be processed using electronic and manual tools, innovative technologies, and any possible software.

This policy, drawn up based on the principle of transparency and all the elements required by the GDPR, is divided into individual sections, each of which deals with a specific topic to make it quicker, easier, and more understandable to read (hereinafter “Policy”).

Data controller

The Data Controller is Beintoo S.p.A., with registered office at Via Paleocapa 3, Milan – Italy (hereinafter “Controller”).

Data Protection Officer

The Data Controller has appointed a Data Protection Officer (hereinafter “DPO”) based at Viale Europa 48 – 20093 Cologno Monzese (MI) – Italy. Pursuant to Article 38, paragraph 4 of the GDPR, you may contact the DPO for all matters relating to the processing of Your personal data and the exercise of Your rights under the GDPR by writing to the following email address: infoprivacy.dpo@mediaset.it.

Purposes of data processing

Your personal data will be collected and processed for the following purposes:

1. to follow up on the contact request submitted through the appropriate form;
2. to send you the newsletter, with Your prior consent.

The provision of data is necessary for the achievement of purpose no. 1, and failure to provide such data, or the provision of partial or inaccurate data, could make it impossible to achieve the aforementioned purpose; consent for purpose no. 2 is optional.

Legal basis of data processing

The legal basis for processing is:

• the performance of a contract for purpose no. 1;
• the consent, freely revocable at any time, for purpose no. 2.

Data communication

Personal data will be processed exclusively by persons authorized to do so (Article 29 of the GDPR) and by third parties who may be designated as Data Processors (Article 28 of the GDPR) or who are considered independent Data Controllers, in order to carry out all processing activities necessary to pursue the purposes detailed in this Policy. The data may also be disclosed to public bodies or judicial and public security authorities, where required by law or to prevent or suppress the commission of a crime.

Revocation of consent

The data subject has the right to withdraw the consent given to Data Controller, in whole or in part, at any time without affecting the lawfulness of processing based on consent given before its withdrawal. To withdraw consent, the data subject may contact the Data Controller at the addresses published in this policy.

Data retention

All data collected will be processed for the period necessary to achieve the purposes set out in this Policy and in particular:

• for 12 months from receipt of the contact request for purpose no. 1;
• until the withdraw of the consent, for the purpose no. 2.

Territorial scope of processing

Personal data will be processed by the Data Controller within the European Union. If, for technical and/or operational reasons, it is necessary to use entities located outside the European Union, we hereby inform you that the transfer will take place in compliance with the rights and guarantees provided for by current legislation. Therefore, the transfer of personal data to such entities will be regulated in accordance with the provisions of Chapter V of the GDPR. In any case, if Your personal data has been processed outside the European Union, You may request further details from the Data Controller, requesting evidence of the specific safeguards adopted.

Data subjects’ rights

We remind you that You may exercise Your rights under Articles 15 et seq. of the GDPR and request:

• confirmation as to whether or not personal data concerning You are being processed and access to the data and the following information: the purposes of the processing, the categories of personal data, the recipients and/or categories of recipients to whom the data have been and/or will be disclosed, the storage period;
• the rectification of inaccurate personal data concerning you and/or the integration of incomplete personal data, including by providing a supplementary statement;
• the erasure of personal data, in the cases provided for by the GDPR;
• restriction of processing, in the cases provided for by the GDPR;
• portability of data concerning You and/or direct transmission of data to another Data Controller, if the processing is based on consent or is necessary for the performance of a contract and is carried out by automated means;
• objection to processing at any time, for reasons related to Your particular situation, in the cases provided for by the GDPR.

You can exercise Your rights by writing to the following email address: infoprivacy@mediaset.it. In any case, if You believe that the processing of Your data is contrary to current privacy legislation, we inform You that you can, at any time, lodge a complaint with the competent supervisory authority (Data Protection Authority), pursuant to Article 77 of the GDPR.

Version 2 (V2); march 202