Privacy & Cookies Policy

Data Controller identity and contact information
The Data Controller is GERMO S.p.A., with registered office at via Giotto 19/21 – 20032 Cormano (MI).

Data Protection Officer (“DPO”) contact information
You can contact the DPO designated by the Company at:
– e-mail: germospa@legalmail.it ;
– by mail: GERMO SPA – Via Giotto, 19/21 – 20032 – Cormano (MI) – Italy

1) Any ordinary personal data provided by you when you are interacting with the Website functions including browsing data, or when you request the Website services (registration to any reserved areas/competitions and other initiatives, use of any Apps, requests for information or reports including through contact forms, and more), as well as the data collected through the cookies as specified in the Cookie Policy;

2) Sensitive personal data such as health conditions or special categories of data pursuant to Article 9 of the Regulation. If this happens, the data is processed based on your consent, to comply with the obligations related to reporting adverse events, to comply with the obligations set out by the law or regulations, or to comply with contractual or pre- contractual obligations regarding the provision of goods or services (including requests for information about our products and their proper use). In any case, the lawful basis for processing special categories of data is Art. 9.2 letters (a), (g) and (i) of the Regulation, which is the consent; or, in order to fulfill the legal obligations related to health or social diagnosis, assistance or therapy, or to the management of health or social systems and services; or treatments delivered in relation to a public interest in the area of public health.

Necessary treatments and optional treatments
The forms to be filled on this Site include both data that are strictly necessary to manage communications and user requests, marked with the symbol [*], whose failure to indicate does not allow to follow up on the requests themselves, and optional conferment data which are not strictly necessary to respond to the requests of the interested parties. Failure to provide the latter will not entail any consequences.

Why we process your personal data and how
With you consent the Company may process your ordinary personal data to allow the use of Website services and functions and optimize its functioning, to run statistical analyses on the visits, to manage requests and reports received through the Website, to register to any reserved areas or initiatives such as contests and the like, as set out in Article 6.1.(a) of the Regulation. The Company may also process your personal data to comply with the legal obligations required by laws, regulations, EU legislation: the lawful basis for processing data for these purposes is set out by Article 6.1.(c) of the Regulation.

With your optional consent, ordinary and/or sensitive personal data can also be processed to handle applications pursuant to Articles 6.1.(a) and 9.2.(a) of the Regulation.

The user’s common and sensitive data may also be processed to manage and carry out the obligations related to reports of adverse events, pursuant to Article 9.2. Letters (a), (g) and (i) of the Regulation.

Also, with your optional consent, ordinary personal data may also be used to send institutional communications (newsletters included) or perform promotional activities (marketing), meaning sending promotional materials and/or commercial communications regarding the services provided by the Company to the addresses specified, both via traditional methods and/or means of contact (such as paper mail, phone calls with operators, etc.) and automatic ones (such as communications over the Internet, fax, e- mails, text messages, applications for mobile devices such as smartphones and tablets – so-called APPS – social media accounts, such as via Facebook – etc.). The lawful basis for processing for these purposes is Article 6.1.(a) of the Regulation.

Personal data is processed using both automatic and non-automatic tools according to the very purpose of the processing and, in any case, with methods and procedures that guarantee the safety and confidentiality of the data.

Browsing data
The processing of personal data of users who visit the Website only (meaning those who do not send communications or use any of the services/functions available) will be limited to browsing data, which means personal data which need to be transferred to the Website in order for the IT systems that manage the Website and the Internet communication protocols to work. For example, this category includes IP addresses, or the domain of the computer use to browse the Website and other parameters related to the operating system used by the user to access the Website. The Company collects this and other data (such as the number of visits and time spent on the Website) for statistical purposes only and anonymously in order to check the Website operation and improve its functions. This information is not collected to be combined with other information about the users and to identify them; however, given its nature, this information may allow for the identification of users by processing and combining it with data controlled by third parties. Browsing data is normally erased after anonymous processing but may be stored and used by the Company to investigate on and identify the perpetrators of any cybercrimes committed against the Website or through the Website. Without prejudice to this circumstance and the provisions in the Cookie Policy section, the browsing data above is temporarily kept in compliance with the applicable regulations.

Links to other websites
The Website may contain links to other websites (so-called third-party websites). The Company has no access to and has no control over the cookies, web beacons and other user tracking technologies used by third-party websites which you can access to from the Website; the Company has no control over the contents and materials published by or obtained through third-party websites, or the way they process your personal data, and expressly does not accept any responsibilities on this. You must check out the privacy policy of the third-party websites you visit through the Website and to get information about the conditions applicable to the processing of your personal data. This Privacy Policy applies to the Website as defined above only.

How we store data and for how long
In compliance with the provisions set out by Article 5.1.(c) of the Regulation, the way the IT systems and programs used by the Company are set up allows to minimize the use of personal and identification data; this data is processed only to the extent necessary to achieve the purposes specified in this Policy; the data will be stored for as long as necessary to fulfill the purposes that are actually pursued and, in any case, the criteria used to determine the storage duration comply with the terms allowed for by the applicable laws and the principles of data minimization, storage limitation and rational records management. In order to determine the right retention period for the personal data stored by the Website upon your consent, the controller also considers the following criteria: the specific purposes described in the policy for which the website stores the personal data; the type of current relationship with you (how frequently you log in to your account; if you submit requests using the contact form; if you continue to receive newsletters or commercial communications; how regularly you browse the website, etc.); any specific request to erase your data or consent withdrawal by you; the data controller’s legitimate business interest.

How we guarantee safety and the quality of personal data
The Company commits to protect the safety of your personal data and complies with the applicable safety provisions to prevent data loss, unlawful or illegal use of and any unauthorized access to the data, with special but not exclusive reference to Articles 25-32 of the Regulation. The Company uses multiple advanced safety technologies and procedures to protect the personal data of users; for example, personal data is stored in safe servers located in places with access control and protection measures in place. You can help the Company update and keep your personal data correct by communicating any change to your address, qualification, contact information, etc.

Additionally, the data may be communicated to: (i) institutions, authorities, public entities for their institutional purposes; (ii) professionals, self-employed workers, even if associated; third parties and vendors hired by the Company to receive commercial, professional and technical services aimed at managing the Website and its functions (for example IT service and Cloud Computing providers), pursuing the purposes specified above and providing the services to you; (iii) third parties in case of mergers, acquisitions, company or branch transfers, audits or other extraordinary operations. These subjects will only receive the data necessary for their functions and will commit to use it for the purposes above only, and to process it in compliance with the applicable privacy regulations. The data may also be communicated to legitimate recipients pursuant to the

applicable laws. Exception made for the above, data is not shared with third parties, either physical or legal persons, who do not perform any commercial, professional or technical functions for the Controller and will not be disclosed. The subjects who receive the data will process it as Controllers, Processors or people authorized to process personal data, as the case may be for the purposes specified above and in compliance with the applicable privacy laws.

About the transfer of data to a third Country, including Countries that may not guarantee the same level of protection set out by the applicable regulations, the Controller informs that the processing will still occur in compliance with one of the methods allowed for by the Regulation, such as the user’s consent, the adoption of Standard Clauses approved by the European Commission, the selection of subjects which have joined international frameworks for the free movement of data (e.g. EU-USA Privacy Shield) or operate in Countries the European Commission considers safe.

If you have any requests about personal data processing by the Company, to exercise the rights recognized by the applicable regulations, as well as to know about the updated list of subjects who can access the data, you can contact the Controller and/or the DPO using the contact details above.

Changes to this Privacy Policy
If any changes are made to this Privacy Policy, the updated version will be published on this Website. The Company will inform you about those changes as soon as they are made and will be enforceable as soon as they are published on the Website. So, the Company invites you to check out this section regularly to learn about the latest and most recently updated version of the Privacy Policy.

This Privacy Policy was updated on 1st September 2020.

There are several types of cookies, based on their characteristics and functions. These can be stored on your computer computer or mobile device for different duration periods: session cookies are automatically erased when you close the browser; persistent cookies stay in your equipment until a preset expiry date.
According to current regulations in force in Italy, your express consent is not always needed to use cookies. To be more specific, no consent is required for “technical cookies”, which are the cookies used to allow the transmission of a communication over an electronic communications network, or to the extent strictly necessary to provide a service you expressly request. In other words, these cookies are essential for a website to work or are necessary to perform the tasks you may request.
The Italian Personal Data Protection Authority (see Decision about Simplified Arrangements to Provide Information and Obtain Consent Regarding Cookies – 8 May 2014, hereinafter “Decision”) has included the following cookies among the technical cookies that do not require the express consent for their use:
• “Analysis cookies” if they are used by the website manager directly to collect aggregate information on the number of users and their browsing patterns on the website;
• Browsing or session coolies (to log in);
• Function cookies, which allow your browsing based on a series of selected criteria (for example, the language, the products selected for purchase) to provide a better service. On the contrary, “profiling cookies”, which are those used to create profiles about you and to send advertisements that match the preferences expressed by you during web browsing, require your prior consent.

Types of cookies used by the Website
The Website uses the following types of cookies and allows to disable them, except for third-party cookies, for which you should refer directly to the enabling and disabling methods of the respective cookies specified via link:

• Technical cookies – browsing or session cookies – which are strictly necessary for the functioning of the Website or to allow you to enjoy the contents and services you request.
• Analysis cookies, which allow the Website manager to understand how it is used by the users. These cookies do not collect information about your identity or any of your personal data. The information is processed in an aggregate and anonymous way.
• Function cookies, used to enable specific functions on the Website and a series of selected criteria (for example, the language, the products selected for purchase) to provide a better service.

ATTENTION: by disabling technical and/or function cookies, you may not be able to visit the Website, or some services or specific functions of the website may not be available or work properly, and you may need to change or enter certain information or preferences manually each time you visit the Website.

• Third-party Cookies, which are cookies of websites or web servers other than the Controller’s used for the specific purposes of those third parties, including analysis and profiling cookies. Please remember that said third parties, which are listed below along with the links to their privacy policies, act as independent controllers of the data collected through the cookies sent by them; therefore, you have to refer to their personal data processing policies, notices and any consent form (enable and disable the respective cookies).

The cookies sent directly by the Controller through the Website are detailed below:

How to manage cookie preferences also through the browser
If you don’t know the type or version of your browser, click on “Help” at the top of the browser window to check out all the information you need. Below are the pages of browser providers which explain in detail how to set privacy and tracking preferences based on the browser you use: