Tezze di Vazzola, 15/05/2019

Dear Sir / Madam,

Pursuant to Regulation (EU) 679/2016 regarding the protection of personal data, we hereby inform you that EUROTEC Tecnopolimeri S.R.L. (Tax Code and VAT No. 03453800264), with registered office at Via Venezia 77, Frazione Tezze, 31028 Vazzola (TV), Italy, Tel. +39 0438 488233, will act as the Data Controller for the processing of your personal data in connection with the relationship that may arise with you.

In accordance with the applicable data protection legislation, any processing of your personal data will be based on the principles of lawfulness, fairness, transparency, and the other principles laid down in Article 5 of Regulation (EU) 679/2016.

We therefore provide you with the following information:

A) Processing of Personal Data

“Processing” shall mean, in accordance with Article 4(2) of Regulation (EU) 679/2016, any operation or set of operations performed, with or without the aid of automated processes, on personal data, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

B) Purpose of the Processing

Your personal data will be processed for the purposes related to the contract/agreement with you (including, for example, invoice payments and related tax obligations).

C) Data Processing Personnel

Your personal data may be accessed by individuals specifically designated as Authorised Data Processors by the Data Controller and/or any appointed Data Processor(s).

These individuals will act only under the authorisation of the Data Controller or Processor and, in compliance with Articles 29 and 32(4) of the Regulation, shall process your data solely on instructions received and under their direct authority.

D) Recipients of the Data

To carry out certain activities related to the processing of your personal data, the Data Controller may disclose said data to parties involved in services necessary or useful for the execution of your agreement or services requested, including (but not limited to):

• Providers of specific processing or consulting services (e.g. legal, accounting or tax advisory services);

• Public or private bodies for the fulfilment of legal obligations.

A detailed and updated list of such parties can be requested from the Company.

The Company will identify which of these act as Data Processors, processing data on behalf of the Controller. These processors are contractually bound to implement appropriate technical and organisational measures to ensure the processing complies with Regulation (EU) 679/2016 and protects your personal data.

The processors have also undertaken to comply with all specific obligations under Article 28 and to act under the authority and instructions of the Data Controller, as per Article 29. Additionally, they are required to report any personal data breaches under Article 33(2).

E) Transfer of Data Abroad

Your personal data may be transferred abroad. As it is currently not possible to determine the countries to which data may be transferred, the Company undertakes to inform you accordingly before any such transfer occurs. In the case of transfer to a third country, we will obtain your consent or offer other suitable safeguards.

F) Method of Processing

Your data will be processed using methods that ensure appropriate security and confidentiality. This includes both paper and electronic or digital systems.

Processing may also be carried out using automated tools designed to record, manage or transmit the data, in accordance with Regulation (EU) 679/2016.

G) Data Subject Rights, Complaints and Legal Remedies

You may exercise your rights under Articles 15 et seq. of Regulation (EU) 679/2016 at any time with respect to the Data Controller. These include the rights of access, rectification, erasure, restriction of processing, objection to processing, and data portability.

You may also lodge a complaint with the competent Supervisory Authority (Art. 77) or seek judicial remedy (Art. 79) if you believe that your rights under the Regulation have been violated.

H) Data Retention Period

Your personal data will be retained by the Company for the duration of the relationship with you and for any additional time required to fulfil legal or contractual obligations following the termination of the relationship. In any case, data will be retained for no longer than ten (10) years from the end of the relationship, after which it will be deleted or anonymised.

I) Mandatory Nature of Data Provision

Providing your personal data is both a legal and contractual requirement, and it constitutes a necessary condition for entering into the agreement. Refusal to provide the required personal data would make it impossible for the Company to fulfil the agreement and related legal obligations (e.g. tax compliance).

J) Data Protection Officer

The Company has not appointed a Data Protection Officer (DPO) pursuant to Articles 37 et seq. of Regulation (EU) 679/2016, as it is not legally required to do so.