ABOUT US ACTIVITIES CORPORATE GOVERNANCE INVESTOR RELATIONS SUSTAINABILITY CONTACTS Privacy Policy DATA PROTECTION POLICY REGULATORY FRAMEWORK • Directive 2002/58/EC – on the “personal data processing and protection of private life in the electronic communications field” • EU Regulation 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with reference to the processing of their personal data, as well as the free circulation of such data, abrogating the EC directive 95/46/EC (General Data Protection Regulation) DATA CONTROLLER Following the visit of this web site, data concerning identified or identifiable persons can be processed. The “Data Controller”, pursuant to the EU Regulation 2016/679 (General Data Protection Regulation, hereinafter called GDPR) is Bastogi S.p.A., seated in Via G.B. Piranesi 10 – 20137 Milan – Italy. DATA PROCESSING PLACE AND STORING TIMES The processing operations connected with the web services of this site are carried out at the Data Controller’s seat only by the expressly authorized staff, or by possible third suppliers in charge of occasional maintenance operations, appointed as Data Processors pursuant to article 28 of the GDPR. The collected data will be stored – for each type of data processed – only for the time needed to carry out the specific purposes explained in the special summarizing information notices displayed in the pages of the web site and drawn up for particular services. TYPES OF DATA PROCESSED Surfing data The information systems and the software procedures needed for the operation of this web site acquire, during their normal exercise, some personal data whose transmission is implicit in the use of the Internet communication protocols. Such data are not collected to be associated with identified Data Subjects, but due to their nature, they could allow to identify the users, through processing and association with data held by third subjects. To this category of data belong the IP addresses or the domain names of the PC used by the users who connect to the web site, the URI notation addresses of the required resources, the time of the request, the method used while sending the request to the server, the size of the file obtained as an answer, the numeric code specifying the status of the answer given by the server (successful, error, etc.) and other parameters concerning the operation system and the user’s information environment. Such data are used only to obtain anonymous statistical information on the use of the web site and to control its correct operation and are cancelled immediately after their processing. The data could be used to ascertain the liability in case of possible cybercrimes damaging the web site. Without prejudice to this possibility, the data concerning the web contacts at the moment don’t persist for more than seven days. Data voluntarily supplied by the user The optional, explicit and voluntary supply of personal data by the user in the registration forms present in this web site entails the following acquisition of the data supplied by the sender, needed to provide the service required. Specific summarizing Information Notices will be progressively shown or displayed in the pages of the web site created for particular services upon request. COOKIES Cookies are little text files containing a certain quantity of information exchanged between a web site and the user’s terminal (usually, the browser). They are mainly used with the purpose of operating the web sites in a more efficient way and of providing information to the web site’s owners. Cookies can be session or persistent ones. Session cookies are stored in the terminal for a short time and eliminated as soon as the user closes the browser. Their use is strictly limited to the transmission of the session identifiers (constituted by numbers generated random by the server) needed to allow the safe and effective surfing of the web site. Persistent cookies, on the contrary, are stored in the user’s terminal up to a pre-set period of time. Since they are not cancelled directly at the closure of the browser, they allow to remember the user’s choices made on its web site, as well as to collect information on the pages of the web site that have been surfed by the user, the frequency with which the site is surfed and to identify the user’s surfing path, in order to improve the experience on the web site. Session or persistent cookies can be internal or third party’s cookies, depending on the subject that installs them on the user’s terminal. If it’s the manager of the web site the user is surfing we speak of internal cookies, if it’s a different subject, we speak of third parties’ cookies. Cookies used by this web site This web site uses both internal and third party’s cookies, since it avails itself of the functions of Google Analytics’ services, offered by Google Inc. Google Analytics uses the cookies to collect and analyse information on the methods of employment of the web sites surfed by the user. For further information on Google Analytics’ cookies and on their employment by Google Inc., you can check: the information notice on the use of cookies by Google available at the following link: http://www.google.com/intl/it/policies/technologies/cookies/ and https://developers.google.com/analytics/devguides/collection/analyticsjs/cookies-usage the information notice for Google Analytics’ data protection policy, at the following link: http://www.google.com/intl/en/analytics/privacyoverview.html In the following table the cookies present in the web site are detailed. COOKIE NAME DEFAULT EXPIRATION TYPE COOKIE DESCRIPTION _ga The default expiration is set after 2 years Third Party analytical cookie This cookie is associated with Google Analytics and used to distinguish the users, assigning to each of them a random generated number as identifier. It’s used to calculate the number of visitors of the page, the sessions and data in order to produce an anonymized statistical analysis report. _gat The default expiration is set after 24 hours Third Party analytical cookie _gid The default expiration is set after 24 hours Third Party analytical cookie cms_lang The deadline is set after one year First part This cookie is used for language selection More than the analytical cookies in the above table, the web site avails itself of further session cookies. The employment of session cookies is strictly limited to the transmission of session identifiers (constituted by numbers generated random by the server) needed to allow the use of a particular service and the safe and effective surfing of the web site. The so-called session cookies used in this web site avoid the need to use further information techniques, that could potentially be detrimental for the confidentiality of the users’ surfing and don’t allow the acquisition of personal data that could identify the user. Cookies management Usually, browsers allow to control most of the cookies through the settings of the browser. However, the total or partial disabling of the so-called technical cookies can compromise the use of the web site functions. Anyway, in case users don’t want to receive the cookies on their processor, neither from this site, nor from others, they can increase the data protection level, by modifying the security settings of the browser: Mozilla Firefox: https://support.mozilla.org/it/kb/Gestione%20dei%20cookie Google Chrome: https://support.google.com/chrome/answer/95647?hl=it Internet Explorer: http://windows.microsoft.com/it-it/windows-vista/block-or-allow-cookies Safari 6/7 Mavericks: https://support.apple.com/kb/PH17191?viewlocale=it_IT&locale=it_IT Safari 8 Yosemite: https://support.apple.com/kb/PH19214?viewlocale=it_IT&locale=it_IT Safari on iPhone, iPad, or iPod touch: https://support.apple.com/it-it/HT201265 OPTIONAL SUPPLY OF DATA Apart from what has been specified for the surfing data, users are free to supply their personal data or not. However, the non-supply of them can entail the impossibility to obtain what has been asked. PROCESSING METHODS Personal data are processed even with the aid or automated devices. Specific security measures are taken in order to prevent the loss of data, the unlawful or wrong use of them and the non-authorized accesses. The Data Controller adopted all minimum security measures provided by the law and, inspiring to the main international standards, it adopted further security measures to minimize the risks on confidentiality, availability and integrity of the personal data collected and processed. SHARING, COMMUNICATION AND DIFFUSION OF DATA The collected data can be transferred or communicated to other companies for activities strictly connected and instrumental to the operativeness of the service, such as the management of the information system. The personal data provided by the users that submit requests of literature (brochures, etc.) are used only in order to execute the service or performance required and communicated to third parties only in case it is necessary for such purpose (companies providing enveloping, labelling, shipment services). Apart from these cases, personal data won’t be communicated unless there’s a contractual or legal provision, or upon specific consent by the Data Subject. Personal data could be transmitted to third parties, but only in case: a) There’s an explicit consent to share the data with third parties; b) There’s the need to share information with third parties in order to provide the service required; c) It’s needed in order to meet a request by the judicial or public security authorities. The data deriving from the web service are not disseminated. DATA SUBJECTS’ RIGHTS The regulation protecting the personal data expressly provides some rights for the subjects to whom the data are referred (the so-called Data Subjects). In particular, pursuant to articles 15 and following ones of the EU Regulation 2016/679, each Data Subject has the right to obtain the confirmation of the existence of his/her data, the specification about the origin, purposes and methods of processing, the updating, rectification, integration of data, as well as their cancellation in case they are processed infringing the law or in case one of the reasons specified by article 17 of the EU Regulation 2016/679 should exist. MODIFICATIONS TO THIS DATA PROTECTION POLICY The Data Controller periodically controls its data protection and security policy and – if needed – reviews it in connection with modifications deriving from regulations or organization or dictated by the technological evolution. In case the policy should be modified, the new version will be published on this web page. QUESTIONS, CLAIMS, SUGGESTIONS AND EXERCISE OF RIGHTS Those who are interested in more information, who want to contribute with their suggestions or make a claim on the data protection policy or on the way our Company processes the personal data, or want to assert the rights provided by the data protection regulation, can contact the Data Controller, writing to Bastogi S.p.A., seated in Via G.B. Piranesi 10 – 20137 Milan – Italy, or sending an e-mail to info@bastogi.com DATA PROTECTION POLICY REGULATORY FRAMEWORK • Directive 2002/58/EC – on the “personal data processing and protection of private life in the electronic communications field” • EU Regulation 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with reference to the processing of their personal data, as well as the free circulation of such data, abrogating the EC directive 95/46/EC (General Data Protection Regulation) DATA CONTROLLER Following the visit of this web site, data concerning identified or identifiable persons can be processed. The “Data Controller”, pursuant to the EU Regulation 2016/679 (General Data Protection Regulation, hereinafter called GDPR) is Bastogi S.p.A., seated in Via G.B. Piranesi 10 – 20137 Milan – Italy. DATA PROCESSING PLACE AND STORING TIMES The processing operations connected with the web services of this site are carried out at the Data Controller’s seat only by the expressly authorized staff, or by possible third suppliers in charge of occasional maintenance operations, appointed as Data Processors pursuant to article 28 of the GDPR. The collected data will be stored – for each type of data processed – only for the time needed to carry out the specific purposes explained in the special summarizing information notices displayed in the pages of the web site and drawn up for particular services. TYPES OF DATA PROCESSED Surfing data The information systems and the software procedures needed for the operation of this web site acquire, during their normal exercise, some personal data whose transmission is implicit in the use of the Internet communication protocols. Such data are not collected to be associated with identified Data Subjects, but due to their nature, they could allow to identify the users, through processing and association with data held by third subjects. To this category of data belong the IP addresses or the domain names of the PC used by the users who connect to the web site, the URI notation addresses of the required resources, the time of the request, the method used while sending the request to the server, the size of the file obtained as an answer, the numeric code specifying the status of the answer given by the server (successful, error, etc.) and other parameters concerning the operation system and the user’s information environment. Such data are used only to obtain anonymous statistical information on the use of the web site and to control its correct operation and are cancelled immediately after their processing. The data could be used to ascertain the liability in case of possible cybercrimes damaging the web site. Without prejudice to this possibility, the data concerning the web contacts at the moment don’t persist for more than seven days. Data voluntarily supplied by the user The optional, explicit and voluntary supply of personal data by the user in the registration forms present in this web site entails the following acquisition of the data supplied by the sender, needed to provide the service required. Specific summarizing Information Notices will be progressively shown or displayed in the pages of the web site created for particular services upon request. COOKIES Cookies are little text files containing a certain quantity of information exchanged between a web site and the user’s terminal (usually, the browser). They are mainly used with the purpose of operating the web sites in a more efficient way and of providing information to the web site’s owners. Cookies can be session or persistent ones. Session cookies are stored in the terminal for a short time and eliminated as soon as the user closes the browser. Their use is strictly limited to the transmission of the session identifiers (constituted by numbers generated random by the server) needed to allow the safe and effective surfing of the web site. Persistent cookies, on the contrary, are stored in the user’s terminal up to a pre-set period of time. Since they are not cancelled directly at the closure of the browser, they allow to remember the user’s choices made on its web site, as well as to collect information on the pages of the web site that have been surfed by the user, the frequency with which the site is surfed and to identify the user’s surfing path, in order to improve the experience on the web site. Session or persistent cookies can be internal or third party’s cookies, depending on the subject that installs them on the user’s terminal. If it’s the manager of the web site the user is surfing we speak of internal cookies, if it’s a different subject, we speak of third parties’ cookies. Cookies used by this web site This web site uses both internal and third party’s cookies, since it avails itself of the functions of Google Analytics’ services, offered by Google Inc. Google Analytics uses the cookies to collect and analyse information on the methods of employment of the web sites surfed by the user. For further information on Google Analytics’ cookies and on their employment by Google Inc., you can check: the information notice on the use of cookies by Google available at the following link: http://www.google.com/intl/it/policies/technologies/cookies/ and https://developers.google.com/analytics/devguides/collection/analyticsjs/cookies-usage the information notice for Google Analytics’ data protection policy, at the following link: http://www.google.com/intl/en/analytics/privacyoverview.html In the following table the cookies present in the web site are detailed. Links Credits Where we are Work with us privacy policy Bastogi S.p.A., sede legale in Via G.B. Piranesi 10, 20137 Milano - C.F. e Reg. Impr. Milano n. 00410870588, P.IVA: 06563660155 - Capitale sociale: Euro 49.116.015 i.v. This web site uses technical and statistical analysis cookies, both internal and Third Party cookies. For further information on cookies, to know the cookies used by the web site and possibly disable them, please consult our Data Protection Information Notice.PrivacyI’ve understood