INFORMATION ON THE PROCESSING OF PERSONAL DATA

PURSUANT TO EU REGULATION 2016/679

1. Data Controller

• Controller: Flos SRL

• Controller’s Data: Via Perugia, 52 – 71036 Lucera (FG) VAT ID 04164260715

• Contact Data: Via Perugia, 52 – 71036 Lucera (FG)

1. Purpose and Legal Basis of Processing

Personal data collected will be processed, both automated and non-automated, for the purposes indicated below based on the legal basis specified. Providing such data may be necessary for the performance of the relationship or the provision of the requested service, or alternatively, it may be optional, as more specifically detailed below.

Purpose: Fulfillment of legal obligations – Data Category: Personal data (mainly personal data) – Legal Basis: Necessary for compliance with a legal obligation (accounting, administrative, tax, etc.) to which the data controller is subject (Art. 6, 1, c).

Purpose: Website management – Data Category: Personal data (IP addresses, the type of browser used, the operating system, the domain name, and addresses of websites from which access was made, information about pages visited by users within the site, access time, time spent on each page, internal path analysis, and other parameters related to the user’s operating system and computer environment. This information is collected through the installation of small text files called ‘cookies’ and other similar technologies. For all information on how we use cookies, you can refer to the Cookie Policy) – Legal Basis: Necessary for the pursuit of the legitimate interest of the data controller (Art. 6, 1, f).

Purpose: Handling requests received through the contact form or contact addresses on the website – Data Category: Personal data (mainly personal and contact data voluntarily provided by the user) – Legal Basis: Necessary for the performance of a contract or the execution of pre-contractual measures (Art. 6, 1, b). In case of non or incomplete insertion of the email address in the contact form, the management of the received requests cannot proceed.

Purpose: Management of disputes – Data Category: Personal data (mainly personal and contact data) – Legal Basis: Necessary for the pursuit of the legitimate interest of the data controller (Art. 6, 1, f).

Purpose: Sending information on commercial initiatives, through newsletter subscription, related to promotions and/or offers and/or services – Data Category: Personal data (email address voluntarily provided by the user) – Legal Basis: Consent (Art. 6, 1, a). In case of non or incomplete insertion of the email address, newsletter subscription cannot proceed.

You will be informed, at each stage, whether the provision of personal data is necessary or optional by placing a symbol (*) on the required information.

1. Categories of Recipients

Within the purposes mentioned above, the collected data may be communicated, in compliance with a legal or contractual obligation or for instrumental reasons, to the following subjects: Public entities, bodies responsible for controls and checks, entities assimilated to public bodies, professionals, consultants, or companies that operate for Phi Comunicazione di Federica Berardi as external Data Processors (e.g., companies providing IT services).

1. Data Disclosure

The data will not be subject to disclosure.

1. Data Transfer

The data controller may transfer personal data to a third country for instrumental reasons to the purposes mentioned above. If it is necessary to resort to subjects residing outside the European Union, it is informed that the precautions required by the Regulation will be adopted, basing the transfer on:

-decisions on the adequacy of the third-party recipient countries expressed by the European Commission; -adequate guarantees expressed by the subject residing outside the European Union; -binding corporate rules.

1. Data Retention

Personal data will be processed and stored for the time necessary for the execution of the purposes for which they were collected and in accordance with the storage times provided by applicable regulations or until you revoke the consent given for processing, if applicable. Subsequently, personal data will be deleted or permanently anonymized.

1. Data Subject’s Rights Regarding the Provided Data

You can request to exercise the following rights: access, erasure, rectification, restriction of processing, objection to processing, data portability, revocation of the consent provided when processing is based on such consent. If you believe that processing violates Regulation (EU) 2016/679, you can also file a complaint with the supervisory authority of the member state in which you reside, work, or where the violation occurred. To exercise your rights, you can send a request to the contact details of the Data Controller indicated in point 1. You can also revoke your consent using the ‘unsubscribe’ link in all our newsletters.

Flos SRL reserves the right to modify this privacy notice at any time.

Last update: February 18, 2022.”