PRIVACY POLICY – WEBSITE USE

Pursuant to Art. 13 -14 of the Data Protection Regulation 679/2016
Last update: November 2024

1 FAG ARTI GRAFICHE S.P.A. with registered office in Via Torino, 347 – 12063 Dogliani (CN) Italy, (the “Company” or the “Data Controller”) guarantees compliance with the regulations on the protection of personal data (and in accordance with EU Regulation 2016/679 “GDPR”) by providing the following information on the processing of data communicated or otherwise collected during browsing on this site.

2 Processed data, purpose and legal basis for processing
Data generated by accessing the site
The computer systems and software procedures used to operate this site acquire, in the course of their normal operation, certain personal data that is transmitted implicitly in the use of Internet communication protocols.

This data (e.g. domain names, IP addresses, operating system used, type of browser device used to connect) is not accompanied by any additional personal information and is used for the following purposes:

to obtain anonymous statistical information on the use of the site;
to manage control requirements of how it is used;
to ascertain liability in the event of hypothetical computer crimes.

The legal basis legitimising the processing of such data is the need to make the site’s features usable following user access.

Data provided voluntarily by the user
Personal data provided by the user are collected and processed for the following purposes:

By filling in the Contact Request Form, FAG ARTI GRAFICHE S.P.A. will process personal data in order to provide the requested information;
In the presence of specific consent, for the periodic sending, by e-mail, of newsletters and advertising material relating to the services provided by the companies belonging to the Group;
If you send your curriculum vitae, please read and expressly accept the processing.

The legal basis legitimising processing is the performance of a contract to which the data subject is party or the performance of pre-contractual measures taken at the data subject’s request. In the cases expressly indicated, the legal basis is the consent freely given by the person concerned.

3 Nature of data provision
Apart from what is specified for navigation data, the provision of data:

with respect to the purposes referred to in letter a) is optional, but refusal will make it impossible for FAG ARTI GRAFICHE S.P.A. to carry out the activities indicated;
with respect to the purposes set out in letters b), c) is also optional and their use is conditional to explicit consent. Any refusal will make it impossible for FAG ARTI GRAFICHE S.P.A. to send newsletters and advertising material or invitations to events and initiatives and to access personnel selections for companies belonging to the Group.

4 Data processing methods and retention periods
Data will be processed with the aid of electronic and/or paper instruments, according to logic strictly related to the purposes indicated below and in any case adopting procedures and measures suitable to protect its security and confidentiality.

For the purposes of letters a), b) and c) we keep your data for a maximum period of 12 months.

In the event of exercising the right to be forgotten through a request for express deletion of personal data processed by the data controller, please note that such data will be retained, in a protected form and with limited access, solely for the purpose of investigating and prosecuting criminal offences, for a period not exceeding 12 months from the date of the request, and will thereafter be securely deleted or irreversibly anonymised.

5 Persons authorised for data processing, the data processor and data communication
The data collected is processed by internal staff of FAG ARTIGRAFICHE S.P.A., identified, authorised and duly trained for this purpose by the data controller.

The data collected, where necessary or instrumental to the performance of the aforementioned purposes, may be processed by third parties appointed as external data processors, or, as the case may be, communicated to them as autonomous data controllers, namely:

companies that are part of our corporate group for the purposes set out in letters a), b) and c) and in particular (Artigrafiche Reggiane & Lai Spa);
. persons, companies, associations or professional firms providing assistance and consultancy to our Company, for the purposes set out in letters a) and c);
companies, bodies, associations carrying out services related and instrumental to the execution of the above-mentioned purposes (hosting service, maintenance of IT systems).

The collected data may also be transferred to third parties outside the European Union, guaranteeing the appropriate level of protection and in accordance with the provisions of current legislation.

In any case, personal data may not be disseminated.

6 Rights of the data subject
It is possible for the data subject to exercise their rights at any time:

access to personal data;
obtaining the rectification or erasure of their data or the restriction of their processing;
objecting to processing;
data portability;
revoking consent, where applicable: revocation of consent does not affect the lawfulness of processing based on consent given before revocation;
lodging a complaint with the supervisory authority (Privacy Authority);
one may exercise these rights by sending an e-mail to: info@fagartigrafiche.com

CUSTOMER/SUPPLIER PERSONAL DATA PROCESSING POLICY

Pursuant to article 13 of Regulation 679/2016 on the Protection of Personal Data
Last update: November 2024

Dear Customer/Supplier,
FAG ARTI GRAGICHE S.P.A. (hereinafter the “Company” or “The Controller“), in its capacity as data controller wishes to inform you, pursuant to Articles 13 and 14 of European Regulation 679/2016 on the protection of personal data (“Regulation”) of the following.

1 Type of personal data
The data transmitted by you in relation to your personnel involved in the execution and management of contracts with the Company, including name, surname, contact details, e-mail addresses, professional qualifications where relevant, any data relating to wages and contributions paid and the payment of contributions in relation to the personnel you employ for the provision of services at the Company, when such data are necessary to conduct checks on compliance with the rules on the protection of workers included in tender contracts, directly provided by you, they will be processed by the Company, in accordance with the Regulation and national legislation including any measures issued by the Supervisory Authority where applicable.

In the case of suppliers who are natural persons, in addition to the data highlighted above, invoicing and payment data (including VAT number and tax code), bank data, registration in registers or registers, economic and financial data (e.g. balance sheet) may also be processed.

2 Purpose of processing
The processing of Data Subjects’ data is carried out by the Company in the course of its economic and commercial activities for purposes related to the possible selection, establishment, management and execution of the contractual relationship (including the management of the pre-contractual relationship). In particular, the data will be processed for the fulfilment of legal obligations (e.g. tax and accounting obligations, obligations arising from the regulation of contracts and hygiene and safety at work); for the opening of the suppliers master data; the administrative management of contracts, including the management of payments and invoices; obligations aimed at the supply of goods and services, as well as the management of any litigation, the performance of internal audits (safety, productivity, quality of services, asset integrity), certification. The data of the Subjects may also be processed for periodic activities to assess the existence of the ethical and legal requirements established by the Company in its Code of Ethics and as part of audits, also at your site, of quality, process, product or sustainability. For the above-mentioned purposes, it is not necessary to obtain specific consent as the Company may make use of the exemptions set out in articles 6.1 b), 6.1 c) of the Regulation.

In the case of suppliers who are natural persons, for the processing of data of an economic-financial nature, such as business information and balance sheets, the Company avails of the exemption of letter 6.1 f) (legitimate interest of the Company in verifying the economic-financial soundness of its business partners).

3 Nature of provision and processing method
The provision of the data of the Data Subjects is necessary and, without it, it will not be possible to establish any business relationship, to properly perform pre-contractual and contractual obligations or, where a contractual relationship has already been established, to fulfil the obligations and commitments arising therefrom.

Any personal data of the Data Subjects will also be collected through the video-surveillance system, present in the Dogliani and Canneto Sull’Oglio plants in the access and exit areas of the premises and inside the premises themselves, if the Data Subjects are present on the Company’s premises, according to what is set out in the information notice on data processing for video-surveillance purposes, available upon request at the gatehouse premises.

The data of the Data Subjects will be processed by the Company and its authorised personnel, with electronic and manual systems in accordance with the principles of fairness, loyalty and transparency laid down in the applicable legislation on the protection of personal data and protecting the confidentiality of the data subject through technical and organisational security measures to ensure an adequate level of security (e.g. preventing access to unauthorised persons except in cases required by law, or the ability to restore access to the data in the event of physical or technical incidents).

4 Data retention
The data will be stored in accordance with the applicable data protection regulations for as long as is necessary to fulfil the above-mentioned purposes. In particular, the data will be retained for the entire duration of the contractual relationship and also after the termination thereof in compliance with civil and tax obligations (e.g. civil obligation to retain invoices and company documents for at least 10 years).

The data acquired during the selection process, if no subsequent contractual relationship with the Company arises, will be retained for a period of 5 years after its acquisition.

The data collected by the video surveillance system will be stored for 24 hours and subsequently overwritten by the system.

5 Communication, dissemination and transfer of data
Without prejudice to the communications carried out in fulfilment of legal and contractual obligations, the data may be communicated to tax or legal consultants, collaborators of the Company, credit institutions, entities and public administrations where necessary, as well as to parties legitimated by law to receive such information, Italian and foreign judicial authorities and other public authorities, for purposes connected with the fulfilment of legal obligations, or for the fulfilment of obligations assumed and arising from the contractual relationship, including for the need to defend oneself in court. These bodies act as autonomous data controllers.

Contact data may be disclosed for occasional needs to further customers and/or suppliers of the Company, e.g. if they have to cooperate with such parties for the purpose of performing contractual obligations. The Company also uses third parties to provide certain services involving the processing of personal data, including, for example, suppliers of replacement storage services or of quality, process and product audit services. These persons act as data processors, on the basis of specific and adequate instructions in terms of processing methods and security measures set out in specific contractual documentation. The complete and updated list of persons who process personal data as data controllers is available upon request from the Company at the contact details below.

Data may be disclosed to other group companies, including subsidiaries and affiliates both within and outside the European Union (an updated list of which is available on the corporate website www.fagartigrafiche.com), where necessary for internal administrative and group coordination purposes or where they have to cooperate in the performance of contractual obligations. In this case, with regard to transfers outside the European Union, the Company undertakes to guarantee adequate levels of protection and safeguards, including contractual ones, in accordance with the applicable rules, including the stipulation of standard contractual clauses (a copy of the commitments undertaken with the Group Companies in the context of such clauses may be requested by sending a request to the Company to the contacts indicated below).

Personal data will not be disseminated.

6 Rights of data subjects
In relation to the processing of data described in Regulation (Articles 15-21), Data Subjects may exercise their rights therein, including:

receiving confirmation of the existence of their personal data and access to their content (access rights);
updating, amending and/or correcting one’s personal data (right of rectification);
requesting the deletion or restriction of data processed in breach of the law, including data whose retention is not necessary for the purposes for which the data were collected or otherwise processed (right to be forgotten and right to restriction);
except where processing is required to comply with a legal obligation, objecting to the processing in the cases provided for in the Regulation (right to object);
revoking consent, where given, without prejudice to the lawfulness of the processing based on the consent given before revocation;
receiving a copy of one’s data in electronic format that was provided in the context of the contract and requesting that such data be transmitted to another data controller (right to data portability).

To exercise these rights or to request further information regarding this policy, the data subject may contact the Data Controller by sending an e-mail to privacy@fagartigrafiche.com.

Data subjects may also lodge a complaint with the supervisory authority in the event
of a breach of the rules on the protection of personal data.

7 Identity and contact details of the Data Controller and contact details of the
Data Protection Officer
The data controller of personal data is FAG ARTI GRAGICHE S.P.A. with registered office in Via Torino, 347 – 12063 Dogliani (CN) Italy, telephone 0173.721240, in the person of the Legal Representative.

The Data Controller invites its Customers and Suppliers to inform the Data Subjects (e.g. directors, employees and collaborators whose data the Company comes into possession of for the purposes of executing the contract) of the content of this Policy.