WEBSITE PRIVACY POLICY
Indena S.p.A. ("Company") provides you, pursuant to article 13 of the European Regulation n.2016/679,
concerning the protection of natural persons with regard to the processing of personal data (hereinafter referred
to as "GDPR"), some information relating to the processing of your personal data when you visit the website
www.indena.com (“website”)
Data controller and Data Protection Officer (DPO)The Data Controller is Indena S.p.A., having its registered office in Milan, Viale Ortles, n. 12, VAT Number
04411780150, e-mail privacy@idbholding.com (“Company” or “Data Controller”).
The Data Protection Officer is Partners4Innovation S.r.l., Via Copernico 35, 20125 Milano (tel. 02/92852779)
and can be reached at the e-mail address: dpo@idbholding.com
Data processing purposes, legal basis for data processing and data retention period
Navigation data
The computer systems and software procedures used to operate this website acquire, during their normaloperation, some personal data whose transmission is implicit in the use of Internet communication protocols.
This information is not collected to be associated with identified data subjects, but by its very nature, could,
through processing and association with data held by third parties, allow users to be identified.
This data category includes IP addresses or the domain names of computers used by users who connect to thewebsite, the URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, themethod used to submit the request to the server, the size of the file obtained in response, the numerical code
indicating the status of the response given by the server (successful, error, etc..) and other parameters relating tothe operating system and computer environment of the user.
This data is used for the following purposes:• to obtain anonymous statistical information on the use of the website and to check its correctfunctioning;• for technical administration of the website;• to ascertain any liability in the event of hypothetical computer crimes to the detriment of the website.
This data is deleted immediately after processing.
Data provided voluntarily by the user
In some sections of the website, you will be asked to provide personal information. According to art. 13 of theGDPR relating to the processing of personal data, in relation to the specific purposes pursued you shall find thefollowing information notices in the "privacy" section of the website:• To apply for open job positions by Indena or to apply spontaneously;• To subscribe to the newsletter;• To contact the Data Controller.
Cookieless Tracking Solution
The Company has implemented the Web Site with a tracking solution that proposes pseudoanonymous andcookieless data collection. The Cookie Policy exposes the related functionality.
Cookies
Information regarding the cookies used on this Site can be found at the “privacy” section, in a specificprocedure.
Data ProvisionWith the exception of what has been specified for navigation data, the provision of data for further processing
purposes is optional. Failure to provide such data may make it impossible to pursue such further purposes.
Methods of data processing
Your Personal Data will be processed using automated tools and in compliance with the principle of necessityand proportionality, avoiding processing Personal Data if the operations can be carried out through the use ofanonymous data or by other means. Specific security measures are observed to prevent the loss of data, unlawful
or incorrect use and unauthorized access.

Data Recipients
Pursuant to art. 28 of GDPR, the Data Controller must appoint the third-party companies that process Personal
Data on its behalf as External Data Processors to whom appropriate operating instructions are given (hereinaftercollectively referred to as "Data Processors"). These subjects are essentially included in the following categories:• other companies, part of the corporate Group IdB Holding;• companies that carry out computer systems maintenance services;Your data may also be processed by third parties, as independent data controllers, namely:• persons, companies, associations or professional firms that provide assistance and advice (lawyers,accountants, auditors ...).
Your personal data will in no case be disseminated.
Parties authorised to process dataYour Personal Data will be processed by employees and/or collaborators of the Data Controller/Data Processor
who have received adequate operating instructions and who have been expressly authorized to process it by the
Data Controller/Data Processor.
Any further indications regarding the scope of communication and dissemination of your Personal Data will beprovided in the individual sections of the website.
Personal data transfers outside the EU
Without prejudice to the provisions in relation to cookies, your data will not be transferred abroad to nonEuropean countries.
Your rights
In relation to the processing of personal data carried out by the Data Controller, you may ask the data controller
for access to the data concerning you, their cancellation, rectification of inaccurate data, integration ofincomplete data, limitation of processing in the cases provided for by art. 18 GDPR, as well as opposition toprocessing in cases of legitimate interest of the data controller.
In the event that the processing is based on consent or contract and is carried out by automated means, you havethe right to receive your data in a structured, commonly used and machine-readable format and, if technicallyfeasible, to transmit them to another data controller without hindrance.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint withthe competent supervisory authority in the Member State where you are habitually resident or in the State where
the alleged infringement has occurred.
In order to exercise your rights, you may contact the Data Controller by sending a written communication to theabove address or an e-mail to privacy@idbholding.com