SUBJECT: “Information on the processing of your personal data,
pursuant to Articles 13 and 14 of EU Regulation 2016/679 on the
protection of personal data”

Pursuant to EU Regulation 2016/679 (GDPR General Data Protection Regulation), we inform you that your "personal data", acquired verbally, directly or through third parties, are and will be processed by us and entered into databases as this is essential to meet the need for proper execution of the contractual relationships with you in progress. Pursuant to Articles 13 and 14 of the GDPR, we inform you that:
1 • Nature and purpose of the processing: The personal data you provide are processed: a) Without your express consent (pursuant to Article 6 letters b), e) GDPR), for the following purposes: - For preliminary needs related to the conclusion of contracts (order management/supply of goods or services as well as those connected to them, such as archiving, invoicing); - For the performance of contractual relationships in place with your company and the consequent fulfillment of legal, tax, insurance, and social security obligations; - To comply with legal obligations, regulations, community legislation, or orders from authorities (e.g., anti-money laundering); - To exercise the rights of the Data Controller (e.g., the right of defense in court); b) Only with your specific and distinct consent (pursuant to Article 7 GDPR), for the following purposes: - In an anonymous and/or aggregated form to monitor the market, carry out market analyses and research, improve the products or services provided; - For marketing activities such as market research, analysis, periodic sending of promotional material and newsletters about products, services, promotions, and events organized by or participated in by VEGANOK, and any invitations to the same, also personalized, through automated contact methods (email, fax, sms, mms) and traditional methods (postal mail); - To use, disseminate and publish your images and personal data in graphic/photographic form (labels) and/or in audiovisual form (which may or may not include your voice), through TV broadcasts, events, web publications, downloading, public projection, dissemination on paper, optical and magnetic media.
2 • Processing methods: The data will be processed mainly with electronic and IT tools and stored on both computer and paper media, as well as any other suitable media, to ensure the security, integrity, and confidentiality of the data in compliance with the organizational, physical, and logical measures provided by current regulations.
3 • Retention period: The Data Controller will process your personal data for the time necessary to fulfill the purposes mentioned above and will, in any case, retain them for no longer than 10 years after the end of the relationship for the purposes referred to in point 1 a) and for no longer than 2 years from the collection of the data for the purposes referred to in point 1 b).
4 • Access to data: Your data may be made accessible for the purposes mentioned above: - To employees and collaborators of the Data Controller, in their capacity as persons authorized to process personal data under the direct authority of the Data Controller pursuant to Article 4 No. 10 GDPR (data processors) according to the directives identified in a specific Company Regulation; - To collaborators of the Data Controller in their capacity as system administrators (IT technicians); - To third-party companies or other subjects (such as credit institutions, professional firms, consultants, insurance companies providing insurance services, etc.) that perform outsourcing activities on behalf of the Data Controller, in their capacity as external data processors.
5 • Communication and dissemination of data: Your data will be "disseminated" by us, meaning they will be made known to unspecified subjects, also through publication on the web in compliance with what is contractually provided. Without the need for express consent, the Data Controller may communicate your data for the purposes referred to in point 1 a) to supervisory bodies, judicial authorities, as well as to those subjects to whom the communication is mandatory by law for the accomplishment of the said purposes. We may communicate your personal data to: - Service companies, data processing companies, accounting/tax consultants, and generally all bodies responsible for checks and controls regarding the proper fulfillment of the aforementioned purposes; - Personnel and collaborators as data controllers and processors for the services requested by you, all of whom are duly informed and instructed about the obligations and measures to be taken regarding privacy; - Any external subjects with whom we have entered into specific agreements regarding the measures to be taken to ensure the security of the data entrusted to them, in any case, the data will be processed exclusively for the pursuit of the purposes mentioned above, to pursue the further purposes mentioned above, your data may be disclosed to the heads of Marketing and Commercial Departments, as well as the managers of our information systems and marketing consultants of our affiliated companies, as well as other affiliated companies, the companies that manage promotional activities on our behalf, organizing and managing them or being responsible for market analysis and research, or in charge of analyzing purchases and processing promotions and commercial communications.
6 • Transfer of data: Personal data are stored on servers located within the Italian territory. However, it is understood that the Data Controller, if necessary, will have the right to move the servers also outside the EU. In this case, the Data Controller ensures from now on that the transfer of data outside the EU will take place in compliance with the applicable legal provisions, subject to the stipulation of the standard contractual clauses provided by the European Commission.
7 • Obligation or option to provide data and consequences of refusal: As for the data that we are obliged to know, to comply with the obligations provided by laws, regulations, and community legislation, or by instructions issued by authorities empowered by law and supervisory and control bodies, failure to provide such data by you will result in the impossibility of establishing or continuing the relationship, within the limits in which such data are necessary for the execution of the same. As for the data that we are not obliged to know, their failure to obtain will be evaluated by us on a case-by-case basis, and will determine the consequent decisions related to the importance of the data requested and not provided by you.
8 • Data Controller, external data processors, and authorized subjects: For all legal purposes, the Data Controller of your data is VEGANOK S.r.l. Società Benefit, located at VIA GHINO VALENTI No. 12, 00191 ROME (RM), C.F. / VAT No. 13693571005, PEC: [email protected], represented by its pro tempore legal representative (the body responsible for decisions regarding the purposes and methods of personal data processing, including the security profile). The list of data processors is available at VEGANOK S.r.l., and can be viewed at any time upon your simple request.
9 • Your rights: As an interested party, you are the holder, pursuant to Articles 7 and 15-21 GDPR, of the following rights: 1) Obtain confirmation of whether or not personal data concerning you are being processed and, if so, obtain access to the personal data and the following information: a) the purposes of the processing; b) the categories of personal data in question; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed; d) where possible, the period for which the personal data will be stored or, if not possible, the criteria used to determine that period; e) if the data are not collected from the data subject, all available information about their origin; f) the logic applied in the case of processing carried out with the aid of electronic means (automated decision-making processes); 2) Obtain the rectification of inaccurate personal data, the integration of incomplete personal data, and the deletion of personal data (right to be forgotten) concerning you; 3) Obtain the restriction of processing; 4) Receive in a structured, commonly used, and machine-readable format the personal data concerning you provided to a data controller and transmit those data to another data controller without hindrance (right to data portability); 5) Object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you (right to object); 6) Withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. Consent will be withdrawn as easily as it is given; 7) Lodge a complaint with a supervisory authority.
10 • How to exercise your rights: You can exercise your rights at any time by sending: A registered letter with return receipt to the company VEGANOK S.r.l. Società Benefit, VIA GHINO VALENTI No. 12, 00191 ROME (RM) or a PEC to the address: [email protected]