1. INTRODUCTION
Pursuant to art. 13 of Regulation (EU) 2016/679, concerning the protection of individuals with regard to the processing of personal data (“GDPR”), we provide the requested information on the processing of personal data concerning you (“Data”) made by AF Systems S.p.A.

2. CONTACTS OF CONTROLLER

Once the retention periods indicated above have elapsed, the Data will be destroyed, deleted or made anonymous, consistent with
the technical cancellation and backup procedures.

5. METHOD OF TREATMENT
Data processing is based on principles of correctness, lawfulness, transparency and data minimization (privacy by design); it may be carried out either manually or through automated procedures designed to
store, process and transmit them and will take place through appropriate technical and organizational measures, taking into account the state of the art and implementation costs. AF Systems S.p.A.
guarantees the security, confdentiality, integrity, availability and resilience of systems and services, avoiding the risk of loss, destruction, unauthorized access or disclosure or, in any case, illicit use, as
well as through reasonable measures to cancel or rectify timely inaccurate data with respect to the purposes for which they are processed.

6. RIGHTS OF THE INTERESTED PARTY (Articles 15- 22 of the GDPR)
6.1 The parties concerned are granted the rights referred to in Articles 15 to 22 of the GDPR, where applicable.
6.2 In particular, data subjects may request access to the Data, correction of inaccurate Data, integration of incomplete Data, deletion of Data, as well as limitation of processing in the cases provided for by
art. 18 of the GDPR.
6.3 The interested parties have the right to object at any time, in whole or in part, to the processing of the Data necessary for the pursuit of the legitimate interest of the Data Controller.
6.4. The interested parties, moreover, in the cases provided for by art. 20 of the GDPR for the exercise of the right to portability, have the right to receive in a structured format, commonly used and readable
by automatic device, the Data provided to the Owner, as well as, if technically feasible, to transmit them to another holder without impediments .
6.5 The interested parties have the right to revoke the consent given at any time for marketing and / or profling purposes, as well as to oppose the processing of data for marketing purposes, including
profling related to direct marketing. The possibility remains for the interested party who prefers to be contacted for the aforementioned purpose exclusively through traditional methods, to express his opposition only to the receipt of communications through automated methods.
6.6 The interested parties have the right to lodge a complaint with the competent Supervisory Authority (in particular in the Member State in which they normally reside or work or in the State where the
alleged violation has occurred).
6.7 These rights may be exercised, by registered mail or PEC, to the address of the Data Controller or the Person in charge of Protection of Personal Data, as identifed in point 2.

7. PRIVACY MANAGEMENT MODEL
7.1 The Company, in its capacity as Data Controller, has prepared a model for the protection of personal data, identifying roles and responsibilities in terms of data protection, identifying, in particular,
the heads of corporate organizational units, limited to the treatments under their jurisdiction. , as responsible for the execution of the model in compliance with the applicable regulatory requirements
(“Privacy Contact Persons”).
7.2 The Data may be processed by employees of the corporate functions appointed for the pursuit of the aforementioned purposes (hereinafter, “Authorized Employees”). These Authorized Employees
have been appointed as Data Processors and have received appropriate operating instructions in this regard.

8. CATEGORIES OF ADDRESSEES TO WHICH DATA MAY BE DISCLOSED AS QUALIFYING OR THAT COULD COME TO KNOWLEDGE AS A DEPARTURE
8.1 The Data may be communicated to external subjects operating as data controllers, by way of example, authorities and supervisory and control bodies and in general subjects, public or private,
entitled to request the Data.
8.2 The Data may be processed, on behalf of the Data Controller, by external subjects designated as data processors, who perform on behalf of the Data Controller specific activities, for example,
accounting, tax and insurance obligations, mailing of correspondence, management of receipts and payments , etc.

9. TRANSFER OF EXTRA EU DATA
9.1 The Data may be transferred abroad to non-European countries, and in particular: Hypothesis 1) “whose level of data protection was deemed adequate by the European Commission
pursuant to art. 45 of the GDPR” or Hypothesis 2) “after signing the standard contractual clauses (Standard Contractual Clauses) adopted/approved by the European Commission pursuant to art. 46, 2, lett. c) and d)” or Hypothesis 3) “after adoption of the other guarantees referred to in art. 46 and 47 of the GDPR” or Hypothesis 4) “subject to the presence of one of the exemptions referred to in art. 49 of the GDPR”