NOTICE PURSUANT TO REGULATION (EU) 2016/679 – "GDPR"
Pursuant to Regulation (EU) 2016/679 (" GDPR "), Datalogic S.p.A. (" Company " or the "Data Controller" or“Datalogic ”) provides this information regarding the processing of your personal data for the managementof the report from you brought to the attention of the Company through the use of the whistleblowing
platform accessible via the website: https://datalogic.integrity.complylog.com/ (the “Platform”). “Report”
means any communication received from Datalogic via the Platform concerning conduct referable toDatalogic Persons carried out in violation of the Code of Conduct, laws, regulations, provisions of theAuthorities, internal regulations, Model 231 however suitable for cause damage or prejudice, even if only toits image, to Datalogic.
For any clarification regarding this information and/or the processing of your personal data, you can contact
the Data Controller at any time at the contact details indicated below.
1. Data Controller
The Data Controller is Datalogic S.p.A., with registered office in Via Candini n. 2, 40012 Calderara di Reno
(BO) - Italy, contactable at the aforementioned address.
2. Purpose of the processing and legal basis of the processing
The Data Controller will process your personal data relating to: (i) information provided by you in the Report;(ii) information possibly acquired during the necessary investigative activities for the following purposes: a.
manage and follow up on the Reports received. The legal basis of the processing is the fulfillment of a legal
obligation to which the Data Controller is subject (ex art. 6, letter b, GDPR); b. Establish internal proceduresin order to prevent and effectively combat fraudulent behavior and illicit or irregular conduct and to support
the effective application and operation of the Italian Organisation, Management and Control Model pursuant
to the Italian Legislative Decree 231/2001 (so-called "Model 231" ) and, in relation to the seriousness of theviolation, to possibly impose disciplinary measures. The legal basis of the processing is represented by thepursuit of the legitimate interest of the Data Controller (ex art. 6, letter f, GDPR); c. Ascertain, exercise or
defend a right or interest of the Owner in the competent extrajudicial and judicial offices. The legal basis ofthe processing is represented by the pursuit of the legitimate interest of the Data Controller (ex art. 6, letterf, GDPR) to defend its legal position. This legitimate interest has been appropriately assessed by the DataController; d. Follow up on requests from the competent administrative or judicial authority and, moregenerally, from public entities in compliance with legal formalities. The legal basis of the processing is thefulfillment of a legal obligation to which the Data Controller is subject (ex art. 6, letter b, GDPR).
For all the purposes as described above, the provision of personal data is optional but, in compliance withregulatory requirements, the Data Controller may refuse to follow up on anonymous reports.

3. Methods
The data - where provided and collected, on a voluntary basis or by law - will also be processed with electronic
tools, through the Platform and recorded in specific databases based in the European Economic Area andused strictly and exclusively for the purposes indicated. In any case, the identity and personal data of theinterested party (or also " Reporter ") will be processed in compliance with their confidentiality, also wherepossible through the use of encrypted systems and all appropriate technical and organizational measures forthe purposes of ensure the safety of the treatment.
4. Recipients of personal data
For the pursuit of the purposes indicated in point 2, your personal data may be known by the Data Controller,
by the subjects authorized by him to process the Report as well as by any data controllers pursuant to art. 28of the GDPR. The latter will be specifically identified by the Data Controller who will also provide specificinstructions on the methods and purposes of the processing and ensure that they are subject to adequate
confidentiality and confidentiality obligations.
The Data Controller may also communicate, provided it is necessary to pursue the purposes of the processing
and on the basis of the same lawfulness assumptions indicated in paragraph 2, the personal data collectedto third parties belonging to:(i)

To police, competent authorities and other public administrations. These subjects will act as
independent data controllers;(ii)

To other companies of the Datalogic Group, bodies or associations, limited to the aspects within
their competence (for example in the event that the Report also concerns their employees).
Unless otherwise indicated, these subjects will act as independent data controllers;(iii)

To consultant, auditing/revision companies and other companies contractually linked to the DataController (even belonging to the same group) which carry out, by way of example, consultancy
activities, support for the provision of services etc., which will act, depending on the case, as
autonomous data controllers, or data controllers on the basis of a specific agreement on theprocessing of personal data concluded pursuant to art. 28 GDPR.

The Data Controller guarantees the utmost care so that the communication of your personal data to theaforementioned recipients concerns exclusively the data necessary to achieve the specific purposes for which
they are intended.
Your personal data will not be disclosed.
5. Transfer of personal data outside the European Economic Area

The transfer of personal data outside the European Economic Area is not foreseen. Where this occurs, thetransfer of data to third parties based outside the EU will be carried out in compliance with the requirements
established by EU Regulation 2016/679.
6. Data retention period
The data will be processed in the Data Controller's paper and computer archives and protected by suitablesecurity measures for a period of time not exceeding that necessary to achieve the purposes for which they
are collected and for any longer period necessary to comply with legal provisions. and/or for judicial
protection purposes, in compliance with the ordinary statute of limitations. In detail, your personal data will
be kept for 2 years in the event that there is a negative outcome of the assessment of admissibility of thecommunication, and therefore the communication is not classified as a Report, 5 years in the event that thecommunication is classified as Reporting, starting from the filing of the file. At the end of the retention period,
your personal data will be deleted or irreversibly anonymized.
7. Rights of interested parties
As an interested party, you are granted, where applicable and within the limits identified by the relevant legal
provisions, the rights summarized below: a. Right of access; b. Right to rectification and cancellation.
However, the Data Controller has the right to reject the cancellation request if the right to freedom ofexpression and information prevails or for the exercise of a legal obligation, to defend one's right in court orfor the legitimate interest of the Data Controller; c. Right to limitation of processing; d. Right of opposition.
This remains without prejudice to the possibility for the Data Controller to continue the processing bydemonstrating the existence of compelling legitimate reasons that prevail over your interests, rights andfreedoms; e. Right to lodge a complaint and/or an appeal with the Italian Authority for the protection of
personal data and/or an appeal with the Italian judicial authority.
You can exercise the rights listed above by writing to the Data Controller at the addresses referred to in point1.