INFORMATION NOTICE REGARDING THE PROCESSING OF CUSTOMERS’ PERSONAL DATAIN ACCORDANCE WITH EU REGULATION 2016/679 (“GDPR”)

DATA CONTROLLER

Company name: Each company (IdB Holding SpA, Indena

DATA PROTECTION OFFICER(DPO)

SpA, Bernett Srl, Indena SaS), part of the corporate Group IdB
Holding, as Data Controller.
The Data Controller can be reached at the e-mail address:
privacy@idbholding.com(“Company”)
The Data Protection Officer of each company of the group(IDB Holding S.p.A.) is Partners4Innovation S.r.l., ViaCopernico 35, 20125 Milano (tel. 02/92852779), and can bereached at the e-mail address: dpo@idbholding.com

PERSONAL DATA PROCESSED“Data” means those relating to natural persons processed by the Company.
By way of example but not limited to: name, surname, date and place of birth, residence, e-mailaddress, telephone numbers, ID number, VAT number etc.
DATA
PROCESSINGPURPOSES

LEGAL
BASIS
PROCESSING DATAFORDATA RETENTIONPERIOD

Conclusion and continuation ofthe contract and all related
fulfilments

Execution of the contract involving the datasubject.

Contractual duration and, after itstermination, for the statutory
limitation period of 10 years.

Fulfillment of regulatory andlegal obligations as foreseen byapplicablenationalandinternational laws

Necessity to fulfill an obligation imposed bylaw.

For the duration of any legal
disputes until completion of theterms of implementation outlined
in legal remedies.

If necessary, to ascertain,
exercise and/or safeguard
Company rights in legal
proceedings

Legitimate
receivables)

Out-of-court debt recovery

Legitimate interest (legal protection)

Direct marketing activities : byway of example, sending - byautomated means of contact(such as sms, mms and e-mail)and traditional means (such as
telephone calls with operator
andtraditionalmail)promotional and commercial
communications relating toservices/products offered by
the Company or to corporate
events, as well as carrying out
market studies and statisticalanalysis

Consent (which is optional and can bewithdrawn at any time)interest(recoveringdue

Personal data and contact details:
until the withdrawal of consent.
Data relating to marketing activities
will be processed for 24 months.

Once the aforementioned retention period has expired data will be destroyed or made anonymous compatibly withtechnical erasure and backup procedures and with the accountability requirements of the Data Controller.

DATA PROVISION
The provision of data is necessary for the conclusion and/or execution of thecontract; the refusal to provide such data does not allow, therefore, to use the services.
The provision of data for marketing purposes is entirely optional: these activities will
be carried out only with your express and unequivocal consent, without prejudice toyour right to withdraw your consent at any time. The withdrawal of consent does notaffect the lawfulness of the processing based on consent before such withdrawal.
DATA RECIPIENTS
Data may be communicated to parties acting as data controllers such as e.g.
supervisory and regulatory authorities and, more generally, public or private entities,
legally authorised to requests data.
The data may be processed, on behalf of the data controller, by other companies
belonging to the Group and by external parties designated as data processors(according to art. 28 of the GDPR), who carry out specific activities on behalf of thedata controller (for example, accounting, tax and insurance obligations, shipment ofcorrespondence, management of collections and payments, etc.).
PARTIES AUTHORISED TO PROCESS DATA
Data may be processed by employees and/or collaborators of the DataController/Data Processor who have been expressly authorised to process the dataand have received adequate operating instructions.
PERSONAL DATA TRANSFERS OUTSIDE THE EU
The data may be transferred abroad to non-European countries in accordance with theprovisions of Articles 45 and 46 of the GDPR.

DATA SUBJECTS’ RIGHTS – COMPLAINT TO THE SUPERVISORYAUTHORITY
By contacting the Data Protection Commitee via e-mail to the addressprivacy@idbholding.com data subjects can ask the controller for access to theirpersonal data, their rectification, their cancellation, the restriction of the processing in
the cases provided for by art. 18 GDPR, as well as the opposition to the processing,for reasons related to their particular situation, in the hypothesis of legitimate interestof the Data Controller.
Furthermore, in the case where processing is based on consent or contract and iscarried out with automated tools, data subjects have the right to receive the personal
data in a structured, commonly used and machine-readable format, and to transmit thedata to another data controller without obstruction.
Data subjects have the right to withdraw their consents at any time for marketing
purposes. The possibility for the data subject who prefers to be contacted exclusively
through traditional methods, to oppose the processing for marketing purposes only in
relation to the receipt of communications through automated means, remains
unchanged.
Data subjects have the right to lodge a complaint to the competent Supervisory
Authority in the member state where they are resident or where they work, or themember state where the alleged breach took place.