Phone: +39 391 100 1741
Fax: +39 0832 1836515

Spin-off of the National Research Council

admin@echolight.it
www.echolightmedical.com

PRIVACY INFORMATION referring to the processing of personal data of contact
representatives of client/supplier companies
GENERAL INFORMATION
We inform the contact representatives of client companies and/or supplier companies (hereinafter"interested", pursuant to Article 4, paragraph 1 of the GDPR)) that the professional relationships establishedwith the undersigned Data Controller may involve the processing of personal data, in compliance with thefollowing general principles:• all data are processed in a lawful, correct and transparent manner towards the interested party, incompliance with the general principles set out in Article 5 of the GDPR;• specific security measures are observed to prevent data loss, illicit or incorrect use and unauthorizedaccess;• the Data Controller is the undersigned Echolight Spa, Via R. Sanzio 18 - 73100 Lecce (LE), to whom it
is possible to contact in order to exercise all the rights provided for by articles 15-21 of the GDPR
(right of access, rectification, cancellation, limitation, portability, opposition), as well as revoke apreviously granted consent or propose a complaint to the supervisory authority for the protection of
personal data;• Contact details: telephone number: +39 0832 159 26 07/5; email: privacy@echolight.it
OBJECT OF THE TREATMENT
The Data Controller processes personal identification data of contact persons of client companies and/orsupplier companies (for example, name, surname, indicative data relating to the pertinent company such ascompany name, personal/fiscal data, address, telephone, e-mail, bank and payment references) acquired
and used in the provision of the services covered by the contract.
PURPOSE AND LEGAL BASIS OF THE PROCESSING
The data is processed for:• concluding contractual/professional relationships;• fulfil the pre-contractual, contractual and tax obligations deriving from existing relationships, as wellas manage the necessary communications connected to them;• fulfil the obligations established by law, by a regulation, by community legislation or by an order ofthe Authority• exercise a legitimate interest as well as a right of the Data Controller (for example: the right ofdefence in court, the protection of credit positions; the ordinary internal needs of an operational,managerial and accounting nature).
Failure to provide the aforementioned data will make it impossible to establish a relationship with the DataController. The aforementioned purposes represent, pursuant to Article 6, paragraphs b, c, f, suitable legal
bases for the lawfulness of the processing. If it is intended to carry out treatments for different purposes, aspecific consent will be requested from the interested parties.
METHOD OF TREATMENT
The processing of personal data is carried out by means of the operations indicated in Art. 4 no. 2) GDPR andmore precisely: collection, registration, organization, storage, consultation, processing, modification,selection, extraction, comparison, use, interconnection, blocking, communication, cancellation anddestruction of data. Personal data are subjected to both paper and electronic and / or automated processing.
Echolight Spa - Via R. Sanzio, 18 - 73100 Lecce (LE) - VAT 04303250759 - REA 280626 - Registered Capital € 65,361.60 fpu

Phone: +39 391 100 1741
Fax: +39 0832 1836515

Spin-off of the National Research Council

admin@echolight.it
www.echolightmedical.com

The Data Controller will process personal data for the time necessary to fulfil the purposes for which they
were collected and related legal obligations.
SCOPE OF TREATMENT

The data are processed by internal subjects duly authorized and instructed pursuant to Article 29 of
the GDPR. It is also possible to request the scope of communication of personal data, obtaining
precise information on any external subjects who operate as managers or independent data controllers(consultants, technicians, banks, transporters, etc.). We also inform you that personal data may besubject to intercompany communication between the companies of the Group. The data may be spreador transferred to non-EU countries. If it becomes necessary, in the context of tenders/contracts or in
the fulfilment of regulatory obligations (e.g. joint and several liability, anti-corruption, anti-mafia,anti-money laundering, etc.) to acquire personal data of their employees from customers/suppliers, it
is agreed between the parties that the undersigned company will be entitled to the processing as anexternal manager (Article 28 of the GDPR) or as an authorized person (Article 29 of the GDPR). As
part of this relationship, the undersigned company undertakes to process such data in compliance withthe requirements set out in the GDPR, guaranteeing any communication to other subjects exclusively
within the scope of specific legal obligations.
RIGHTS OF THE INTERESTED PARTY (GDPR articles 15-22)
At any time, the interested party may exercise the right to:• ask for confirmation of the existence or not of their personal data.
• obtain information on the purposes of the processing, the categories of personal data, the recipientsor categories of recipients to whom the personal data have been or will be communicated and, whenpossible, the retention period.
• obtain the correction and deletion of data.
• obtain the limitation of the treatment.
• obtain data portability, i.e. receive them from a data controller, in a structured format, commonlyused and readable by an automatic device, and transmit them to another data controller without
impediments.
• oppose the processing at any time and also in case of processing for direct marketing purposes.
• oppose an automated decision-making process relating to natural persons, including profiling.
• propose a complaint to the Italian Data Protection Authority.

Date the document was last modified
Lecce, February 15th, 2022

Echolight Spa - Via R. Sanzio, 18 - 73100 Lecce (LE) - VAT 04303250759 - REA 280626 - Registered Capital € 65,361.60 fpu