INFORMATION NOTICE REGARDING THE PROCESSING OF SUPPLIERS’ PERSONAL DATAIN ACCORDANCE WITH EU REGULATION 2016/679 (GDPR)DATA CONTROLLER

Company name: Each company (IdB Holding SpA, Indena SpA,DATA PROTECTION OFFICER (DPO)

Bernett Srl, Indena SaS), part of the corporate Group IdB Holding,as Data Controller.
The Data Controller can be reached at the e-mail address:
privacy@idbholding.com(“Company”)
The Data Protection Officer of each company of the group (IDBHolding S.p.A.) is Partners4Innovation S.r.l., Via Copernico 35,
20125 Milano (tel. 02/92852779), and can be reached at the email address: dpo@idbholding.com

PERSONAL DATA PROCESSEDThe term “Data” includes data on consultants/suppliers that are legal entities processed by the Company toagree and execute the contractual relationship (“Suppliers”).
DATA
PROCESSINGPURPOSES
Purposes relating to establishing andexecuting the contractual relationshipbetween the Supplier and the Company.

LEGAL BASIS FOR
PROCESSING DATA
Executing the contract.

DATA RETENTIONPERIOD

Duration of the contract and after
completion,
forthestatutory
prescription period of 10 years.

Fulfillmentof
administrative- Requirement to meet the Company'saccounting requirements, such as legal obligations.
For the duration of any legal disputes
until completion of the terms ofaccountancy
andtreasury
implementation outlined in legal
management, as well as invoicing (e.g.
remedies.
logging and checking invoices) inaccordance with the requirements ofcurrent regulations.
If necessary to ascertain, exercise and/or Legitimate interest (legal protection)
safeguard Company rights in legal
proceedings.
Once the aforementioned retention period has expired the data will be destroyed or made anonymous compatibly withtechnical erasure and backup procedures and with the accountability requirements of the Data Controller.
DATA PROVISION

The provision of Data is necessary for the conclusion and/or execution of the contract.
The refusal to provide the Data therefore means that it will not be possible to establish
the contractual relationship and/or to fulfil the resulting contractual obligations.
DATA RECIPIENTS

Data may be communicated to parties operating as data controllers, such as supervisory
bodies and authorities, and private or public organisations in general authorised to requestdata.
The data may be processed, on behalf of the data controller, by other companies
belonging to the Group and by external parties designated as data processors (accordingto art. 28 of the GDPR), who carry out specific activities on behalf of the data controller(for example, accounting, tax and insurance obligations, shipment of correspondence,
management of collections and payments, etc.).
PARTIES AUTHORISED TO PROCESS DATA

Data may be processed by employees and/or collaborators of the Data Controller/DataProcessor who have been expressly authorised to process the Data and have received
suitable operating instructions.

PERSONAL DATA TRANSFERS OUTSIDE THE EU

The data may be transferred abroad to non-European countries in accordance with theprovisions of Articles 45 and 46 of the GDPR..

DATA SUBJECTS’ RIGHTS - COMPLAINT TO THE SUPERVISORY BODY

By contacting the Data Protection Committee via e-mail to the addressprivacy@idbholding.com data subjects can ask the Company for access to their personaldata, their rectification, their cancellation, the restriction of the processing in the cases
provided for by art. 18 GDPR, as well as the opposition to the processing, for reasons
related to their particular situation, in the hypothesis of legitimate interest of the DataController.
Furthermore, in the case where processing is based on consent or contract and carriedout with automated tools, data subjects have the right to receive the personal data in astructured, commonly used and machine-readable format, and to transmit the data to
another data controller without obstruction.
Data subjects have the right to lodge a complaint to the competent Supervisory
Authority in the member state where they are resident or work, or the member state
where the alleged breach took place.