INFORMATION ON THE PROCESSING OF PERSONAL DATA

pursuant to Article 13 of Legislative Decree 196/2003 and Article 13 of EU Regulation 2016/679 on the protection of individuals with regard to the processing of personal data (hereinafter referred to as "Regulation" or "EU REG.")

Bignami S.p.A. has the purpose of contributing to the achievement of the general strategic objectives of the company, pursuant to and for the purposes of Article 13 of Legislative Decree 196/2003 and Article 13 of the European Regulation 679/2016, and therefore provides you with the following information regarding the processing of your personal data.

1. Purposes of the processing for which personal data and legal basis of processing are intended

The collection and processing of your personal data are carried out:

a) to implement the purposes of Bignami S.p.A., provided for by its statutory and regulatory provisions for the aim of administering the services of the articles of association of the company.

b) In such cases, the legal basis of the treatment consists in the execution of contractual obligations by Bignami S.p.A.

c) for the correct execution of obligations provided for by laws, regulations or by the community legislation, as well as to comply with provisions issued by public Authorities authorized to do so, or by supervisory and control bodies to which Bignami S.p.A is subject. Legal basis of the treatment consists in the fulfillment of a legal obligation pursuant to art. 6.1, lett. c) of the RGDP);

d) subject to your explicit consent, for purposes ancillary to the provision of statutory and regulatory services, such as, for example, to use "News Alert" services via email or text message, for the receipt of the newsletter on Bignami S.p.A activities or promotional brochures, for surveying the quality of services or statistical surveys. In such cases, the legal basis of the processing consists in the manifestation of the explicit consent pursuant to art. 6.1, lett. a) of the EU REG.);

2. Nature of the provision of data and consequences of non-disclosure of data

The refusal to provide personal data or the failure to give consent to their handling implies the impossibility for Bignami S.p.A. to proceed with the liquidation of the services requested and to implement the purposes set out in point 1, letters a) b) and c) of this statement.

The provision of data for the purposes referred to in paragraph 1, letter d) of this information is optional and the person concerned is therefore free to lend or deny their consent. Even after the provision of consent, the interested party is free to revoke it at any time.

3. Methods of data processing

The processing of your personal data will be based on the principles of lawfulness, fairness and transparency, protecting your privacy as well as those of your family, in compliance with principles set out in Article 5 of the EU REG. The handling can be performed manually, with paper documents and also with the aid of electronic or automated means;

The data are collected and processed at the headquarters of Bignami S.p.A., in appropriate documentary / server archives.

Your personal data are processed using appropriate technical and organizational security measures pursuant to art. 32 of the EU REG., in order to guarantee a level of security appropriate to the risk, minimizing the risks of destruction or loss, unauthorized access or processing that does not comply with the purpose of the collection.

Your personal data are not the subject of an automated decision-making process or of profiling.

4. Particular categories of personal data ("sensitive data")

Pursuant to art. 9 paragraph 1 of the REG. EU, "sensitive data"are considered personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or union membership, as well as genetic data, bio-metric data intended to uniquely identify a person, data relating to the health or sexual life or sexual orientation of the person ".

For the implementation of its statutory and regulatory purposes, and in particular for the provision of supplementary health care services to the SSN, Bignami S.p.A. may process your sensitive data, such as data relating to your health or that of your family members, as well as membership in a trade union.

The processing of sensitive data concerning you will take place with all the guarantees and in compliance with the limits set by the EU REG. In particular, the treatment will concern only data strictly pertinent to the above indicated obligations, tasks or purposes that cannot be fulfilled or achieved through the processing of anonymous data or personal data of a different nature.

The processing of sensitive data can take place if the data subject has given explicit consent, or pursuant to art. 9, paragraph 2, lett. d) of the EU REG., even without the consent of the interested party when the processing is carried out, within the scope of its legitimate activities and with adequate guarantees from an association or other non-profit organization that pursues trade union purposes, provided that the treatment only concerns the members, former members or persons who have regular contacts with the association or the body because of its purposes and that personal data are not communicated outside without the consent of the interested party;

Pursuant to art. 9, paragraph 2, lett. h) of the EU REG., moreover, sensitive data can be processed without consent where necessary, inter alia, for the management of health or social systems and services on the basis of Italian or European Union law.

5. Communication of data

Your personal data are not subject to disclosure.

For the performance of the purposes referred to in point 1) of this information, Bignami S.p.A. may need to communicate your personal data to external parties of their own trust and in particular:

a) to the category organizations including their territorial articulations, as well as to the companies belonging to the group, limited, where necessary, to the performance of services and tasks of the institute;

b) to credit institutions for banking services and payments, companies that manage computerized postal services, document archiving and storage companies, other outsourcing providers of outsourced services;

c) to health structures and specialist doctors with whom a conventional relationship is in progress;

d) to the medical consultants, health personnel and legal advisors of Bignami S.p.A .;

e) to insurance or reinsurance companies or directly to third parties responsible in the event of an exercise by the Reversing Action Bank.

The aforesaid subjects, depending on the case, will process the data as independent data controllers or "data processors" duly appointed in accordance with contractual agreements drawn up in compliance with the provisions of article 28 of the EU REG.

Your personal data will not be transferred to a third country outside the EU or to international organizations. Sometimes, at the explicit request of the interested party (for example, for members residing abroad), in compliance with the provisions of the EU REG., personal data can also be transferred outside the national territory to make the payment of services to foreign banks.

6. Period of retention of personal data

Your personal data will be kept for the duration of the contractual agreement and also after the termination of the same for the time necessary for the fulfillment of all applicable legal obligations (for example of a fiscal nature) and/or administrative obligations related or arising from the associative bond itself.

7. Identity and contact details of the Data Controller

The data controller is: Bignami S.p.A., with registered office at 39040 Ora (BZ) via Lahn n. 1

For the purposes of the exercise of your rights of interest listed below, the Data Controller may be contacted at the email address privacy@bignami.it or at the telephone number of the secretariat 0471 803000, fax 0471 810899, PEC: pec@pec.bignami .it

The updated list of data processors, where required, is available at the Bignami S.p.A. headquarters, at 39040 Ora (BZ) via Lahn n. 1

The Privacy Contact Person, for the exercise of the rights provided by the EU REG. listed in the following point 8, can be contacted using the following addresses: 39040 Ora (BZ) via Lahn n.1 Bignami S.p.A. Fax: 0471 810899 PEC: pec@pec.bignami.it, Email: privacy@bignami.it

8. Rights of the interested party

At any time, where you can exercise, pursuant to art. 7 of Legislative Decree 196/2003 and of articles from 15 to 22 of the Regulations, you will have the right to:

a) request confirmation of the existence or otherwise of personal data;

b) obtain information on the purposes of the processing, the categories of personal data, recipients or categories of recipients to whom the personal data have been or will be communicated and, where possible, the retention period;

c) obtain the correction and deletion of data;

d) obtain the treatment limitation;

e) (where applicable) obtain data portability, i.e. to receive them from a data controller, in a structured format, commonly used and readable by an automatic device, and transmit them to another data controller without hindrance;

f) oppose the processing at any time and also in the case of treatment for direct marketing purposes;

g) oppose an automated decision-making process concerning individuals, including profiling.

h) ask the data controller to access personal data and to rectify or cancel them or limit their processing or to oppose their processing, in addition to the right to data portability;

i) withdraw the consent at any time without prejudice to the lawfulness of the treatment based on the consent given prior to the revocation;

j) propose a complaint to the Guarantor for the protection of personal data, based in Rome, Piazza di Monte Citorio n. 121, official website of the Authority www.garanteprivacy.it

The exercise of rights is not subject to any form constraint and is free.