INFORMATION NOTICE REGARDING THE PROCESSING OF PERSONAL DATA – “CONTACT US”
IN ACCORDANCE WITH EU REGULATION 2016/679 (“GDPR”)

DATA CONTROLLERDATA PROTECTION OFFICER(DPO)DATAPROCESSINGPURPOSES

Indena S.p.A.
Viale Ortles 1220139 Milano
privacy@idbholding.com(“Company”)
Partners4Innovation S.r.l.
Via Copernico 35
20125 Milano
02/92852779
dpo@idbholding.com

LEGAL
BASIS
PROCESSING DATAFORDATA RETENTIONPERIOD

The data you provide in thedata collection form will beprocessed by the Company torespond to your request forinformation
abouttheCompany and/or its products/services

Execution of the contract involving the datasubject.

Retained for the time necessary inorder to respond to yourinformation requests.

Direct marketing activities : byway of example, sending - byautomated means of contact(such as sms, mms and e-mail)and traditional means (such as
telephone calls with operator
andtraditionalmail)promotional and commercialcommunications relating toservices/products offered by
the Company or to corporate
events, as well as carrying out
market studies and statisticalanalysis

Consent (which is optional and can bewithdrawn at any time)

Personal data and contact details:
until the withdrawal of consent.

Once the aforementioned retention period has expired data will be destroyed or made anonymous compatibly withtechnical erasure and backup procedures and with the accountability requirements of the Data Controller.
DATA PROVISION
The provision of data is necessary to provide the requested information; the refusal to provide such data
does not allow, therefore, to process your request.
The provision of data for marketing purposes is entirely optional.

DATA RECIPIENTS
Data may be communicated to parties acting as data controllers such as e.g.
supervisory and regulatory authorities and, more generally, public or private entities,
legally authorised to requests data.
The data may be processed, on behalf of the data controller, by other companies
belonging to the Group and by external parties designated as data processors(according to art. 28 of the GDPR), who carry out specific activities on behalf of thedata controller (for example, maintenance of the website, marketing advice and press
agencies, mail delivery services, etc.).
PARTIES AUTHORISED TO PROCESS DATA
Data may be processed by employees and/or collaborators of the Data
Controller/Data Processor who have been expressly authorised to process the dataand have received adequate operating instructions.
PERSONAL DATA TRANSFERS OUTSIDE THE EU
The data may be transferred abroad to non-European countries in accordance with theprovisions of Articles 45 and 46 of the GDPR.

DATA SUBJECTS’ RIGHTS – COMPLAINT TO THE SUPERVISORYAUTHORITY
By contacting the Data Protection Commitee via e-mail to the addressprivacy@idbholding.com data subjects can ask the controller for access to theirpersonal data, their rectification, their cancellation, the restriction of the processing in
the cases provided for by art. 18 GDPR, as well as the opposition to the processing,for reasons related to their particular situation, in the hypothesis of legitimate interestof the Data Controller.
Furthermore, in the case where processing is based on consent or contract and iscarried out with automated tools, data subjects have the right to receive the personal
data in a structured, commonly used and machine-readable format, and to transmit thedata to another data controller without obstruction.
Data subjects have the right to withdraw their consents at any time for marketing
purposes. The possibility for the data subject who prefers to be contacted exclusively
through traditional methods, to oppose the processing for marketing purposes only in
relation to the receipt of communications through automated means, remains
unchanged.
Data subjects have the right to lodge a complaint to the competent Supervisory
Authority in the member state where they are resident or where they work, or themember state where the alleged breach took place.